1

I use the following script to set IDA in trace mode and make it stop as soon as EAX register is set to a given value :

#include <idc.idc>

static main()
{
    auto r_eip, code, eax;

    EnableTracing(TRACE_STEP, 1);

    for ( code = GetDebuggerEvent(WFNE_ANY|WFNE_CONT, -1); // resume
        code > 0;
        code = GetDebuggerEvent(WFNE_ANY, -1) )
    {                  
        r_eip = GetEventEa();

        eax = GetRegValue("EAX");
        Message("EAX:%08Xh\n", eax);

        if ( eax == 0x00000001 )
            break;
    }

    PauseProcess();
    EnableTracing(TRACE_STEP, 0);    
}

However it does not work : i get the following error message : "Variable 'EAX' is undefined

If i put the line with eax = GetRegValue(...) in comment, in run but then eax is always zero.

The code is adapted from here : https://www.hex-rays.com/products/ida/debugger/scriptable.shtml

  • See here – 0xec Jan 6 '16 at 20:11
  • I already saw that page. What is suggested is to use eax variable directly without GetRegValue() call. I tried (and had to add auto eax to avoid error) : eax is always 0. I also tried the script posted at 22:05.45 :same there : eax is zero. – tigrou Jan 6 '16 at 20:27
3

You can use the following IDC script for the purpose. It would stop whenever register eax contains 0. The debugger must be running when the script is executed.

#include <idc.idc>

static main()
{
    for(;;)
    {
        StepInto();
        if (GetDebuggerEvent(WFNE_SUSP, -1) == STEP)
        {
            if (eax == 0) 
            {
                break;
            }
        }        
    }
    PauseProcess();
}
| improve this answer | |
  • Thanks it works ! (although it is very slow, but this is to be expected) – tigrou Jan 6 '16 at 21:45
  • @tigrou For a faster implementation, you can use DBI frameworks such as Intel Pin and DynamoRIO. – 0xec Jan 7 '16 at 9:00
  • Actually it was used to debug DOSBOX, through idados. Unfortunately DOSBOX does not support memory read breakpoints, so the only way was to inspect registers continuously. – tigrou Jan 8 '16 at 22:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.