1

I'm using IDA Pro and trying to analyze a parameter passed to a function call. Problem is, when i add a breakpoint on function address to see what values are being passed , the application crashes. Is there a way to monitor what parameters passed other than setting a breakpoint ?

1 Answer 1

1

Assuming you're using a software breakpoint (int 3), you have a few alternative options:

Edit:

Based on your comment below, it looks like you're looking to log/hook imported API functions, in which case IAT hooking and EAT hooking are also options.

However, the easiest solution will likely be using an existing tool like API Monitor which allows you to easily log function parameters and choose the type of breakpoint you want to use.

3
  • Thanks for the detailed answer. I'm kind of new to this stuff so i'm not really sure which alternative suits me the best. But i'm interested at third option. As far as i understood, as it starts, application imports the function i'm interested at from the dll(advapi32.dll). With third option, would i be able to output(for example with a message box) the parameter ?
    – AcarX
    Commented Aug 19, 2015 at 14:28
  • I've updated my answer above. Commented Aug 19, 2015 at 14:59
  • Sadly, application detects API Monitor. I'm looking into IAT/EAT hooking.
    – AcarX
    Commented Aug 19, 2015 at 16:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.