1
import idaapi
x=0
while x<10:
    idaapi.step_into()
    rv = idaapi.regval_t()
    idaapi.get_reg_val('EIP',rv)
    ea = rv.ival
    print hex(ea)
    x+=1

Hi. Here is a script to step-into 10 times. I want to have an updated version of EIP value with idaapi.get_reg_val() API If i run this code here is what i get.

0xffffffffffffffffL
0xffffffffffffffffL
0xffffffffffffffffL
0xffffffffffffffffL
0xffffffffffffffffL
0xffffffffffffffffL
0xffffffffffffffffL
0xffffffffffffffffL
0xffffffffffffffffL
0xffffffffffffffffL

Although the actual EIP value is valid all the time I've also tried other path

while ea !=0x0040af75:
    idaapi.step_into()
    eip = GetRegValue('EIP')
    print eip

But then I just get pure error, the meaning of which is misterious to me

Traceback (most recent call last):
  File "<string>", line 3, in <module>
  File "C:\Program Files (x86)\IDA 6.8\python\idc.py", line 7889, in GetRegValue
    assert res, "get_reg_val() failed, bogus register name ('%s') perhaps?" % name
AssertionError: get_reg_val() failed, bogus register name ('EIP') perhaps?

So it looks like either way it calls this low-level func - get_reg_val but can't use the string argument normaly. Both theese functions get_reg_val and GetRegValue() work fine if not within a loop. Help me

4
  • 1
    Since your output shows 64 bit values, maybe you're debugging a 64 bit program and should use RIP instead of EIP ? Commented Dec 20, 2015 at 12:20
  • Ok. I'll try that. But why does it work without a loop and also why I've got 32bit registers show in the window while I'm debugging the app in the regular mode? It doesn't make sence Commented Dec 20, 2015 at 15:37
  • Didn't help and the program is actually 32 bit Commented Dec 20, 2015 at 18:21
  • Just a wild guess: maybe in 'EIP' string some symbol happens to be non-ascii (e.g. due to an accidental keyboard layout change)?
    – Igor R.
    Commented Dec 20, 2015 at 20:26

2 Answers 2

5

The valid answer to this problem is in the fact that python script and the debugger execution flows perform asynchornously. So each time we ask the debugger to do a step_into(), we also need to wait for this process to end. This can be done by inserting GetDebuggerEvent(WFNE_SUSP, -1) after step_into

import idaapi

x=0
while x<10:
    idaapi.step_into()
    GetDebuggerEvent(WFNE_SUSP, -1)      
    rv = idaapi.regval_t()
    print idaapi.get_reg_val('EIP',rv)
    ea = rv.ival
    print hex(ea)
    x+=1
1
  • 3
    btw, idautils has a nice helper class that is more readable: cpu.Eip
    – newgre
    Commented Dec 21, 2015 at 14:36
1

Have got the same error as in your other path, but with ESP register:

Python> GetRegValue('ESP')

File "C:\Program Files (x86)\IDA 6.8\python\idc.py", line 7889, in GetRegValue
    assert res, "get_reg_val() failed, bogus register name ('%s') perhaps?" % name
AssertionError: get_reg_val() failed, bogus register name ('ESP') perhaps?

In my case the reason of this was running Static Analysis session. Just started Debugging, then Suspend manually or by BP, and GetRegVal() works fine.

Python> GetRegValue('ESP')
1232116

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.