How can I set memory breakpoint on field of structure ?
Currently if I mapped structure to memory region it uses starting address of structure as address of all fields. See screenshow
As result I cannot quickly add breakpoint to field isHandshakeReceived. I'd need to manually calculate its address.
Is there easier method ?
Like most input fields in IDA, the breakpoint dialogue's Location field accepts expressions like
eax + GetMemberOffset(GetStrucIdByName("foo_t"), "isHandshakeReceived")
I have no idea why IDA doesn't accept 0x376e5f0 + foo_t.isHandshakeReceived... Anyway, being able to enter expressions is very useful and it can save a lot of hassle.
The erroneous address display is a result of the simplistic way in which IDA manages things internally. Basically, everything contained in a struct or array belongs to its starting address ('head'), and if the display is continued over multiple lines then IDA simply reprints the starting address instead of the correct address. It's a bit annoying but that's the way IDA works.
P.S.: perhaps it would be worth it to file a defect report or post in IDA's bug forum; after all, the displayed addresses are definitely wrong. I wouldn't hold my breath but who knows...
To the best of my knowledge IDA can't go through and automatically identify
Use DbgHook in the following way:
class DbgHook(DBG_Hooks):
... snip ...
debugger = DbgHook()
debugger.hook()
Using this class will require you to implement the def dbg_bpt(self,tid,ea) callback. This call back is called when a breakpoint is hit in your code. From there you can set a breakpoint on the instruction where the base address of the structure is moved into a register. You can get the value of that register in your code using the following:
from idc import *
structAddr = idc.GetRegValue('EAX')
In your dbg_bpt callback you can calculate the offset inside the structure and set an access breakpoint on that address using SetBptAttr(address, bptattr, value) where address is the address of the member (calculated off of the register) and value is BPT_RDWR.
Here is the IDA Python API documentation and here is a good sample project implementing debugger callbacks.
