The instruction highlighted in the trace window (upper-left part of screen-shot) is supposed to MOV a word from some memory address in the
.text segment (at the address given by the
EDX register), into the
EDX = 0x013D4021 and the bytes stored at this address are
50 53 51 52, shown in the HexView of IDA in the lower half of the screen-shot above.
Therefore, after executing the highlighted instruction
mov ebx, [edx] I was expecting that
EBX = 0x52515350.
However, as you can see in the Result column of the trace window this is not true because
EBX = 0x525153CC.
Can anyone explain why the least significant byte in
EBX is equal to
CC instead of
50? Is it a bug in IDA or is it caused by the OS?
NOTE: I tried the same program with IDA Pro 6.9 and encountered the same behavior.
UPDATE: If you also have this issue and still want to debug the program, use hardware breakpoints. Hardware breakpoints do not modify the code like in the example above. IDA Pro allows enabling hardware breakpoints: hex-rays.com/products/ida/support/idadoc/1407.shtml