0

I'm using IDA Pro and trying to analyze a parameter passed to a function call. Problem is, when i add a breakpoint on function address to see what values are being passed , the application crashes. Is there a way to monitor what parameters passed other than setting a breakpoint ?

1

Assuming you're using a software breakpoint (int 3), you have a few alternative options:

Edit:

Based on your comment below, it looks like you're looking to log/hook imported API functions, in which case IAT hooking and EAT hooking are also options.

However, the easiest solution will likely be using an existing tool like API Monitor which allows you to easily log function parameters and choose the type of breakpoint you want to use.

3
  • Thanks for the detailed answer. I'm kind of new to this stuff so i'm not really sure which alternative suits me the best. But i'm interested at third option. As far as i understood, as it starts, application imports the function i'm interested at from the dll(advapi32.dll). With third option, would i be able to output(for example with a message box) the parameter ?
    – AcarX
    Aug 19 '15 at 14:28
  • I've updated my answer above. Aug 19 '15 at 14:59
  • Sadly, application detects API Monitor. I'm looking into IAT/EAT hooking.
    – AcarX
    Aug 19 '15 at 16:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.