Is it possible to trace data without adding a break point?

Question

I'm using IDA Pro and trying to analyze a parameter passed to a function call. Problem is, when i add a breakpoint on function address to see what values are being passed , the application crashes. Is there a way to monitor what parameters passed other than setting a breakpoint ?

Answer 1

Assuming you're using a software breakpoint (int 3), you have a few alternative options:

• Use a hardware breakpoint instead
• Use an OllyDbg-style memory breakpoint instead
• Hook the target function by overwriting the beginning of the function with a jump/call to an injected tracing function
• Find the code that's causing the application to crash (the code that's detecting your breakpoint) and disable it

Edit:

Based on your comment below, it looks like you're looking to log/hook imported API functions, in which case IAT hooking and EAT hooking are also options.

However, the easiest solution will likely be using an existing tool like API Monitor which allows you to easily log function parameters and choose the type of breakpoint you want to use.