I can think of two methods to achieve this:
- Setting a breakpoint, hooking debugger events and implementing
This is nearly trivial to do, but does not give the same amount of control as the second approach. It might be better for quick and dirty type of solutions, if that's what you're after.
idc.RunTo(ea) will execute the process until an
ea is reached, allowing you to then call
idc.GetRegValue(name) to get the value of
Certain conditions (like an exception thrown or a different breakpoint being hit) will cause
RutTo to return before the provided
ea is reached. You could then call
idc.GetDebuggerEvent to figure out what happened, but if you're gonna do that I suggest switching to the second approach.
RunTo will also start up a process if there's no running process.
2. Setting a breakpoint, hooking debugger events and implementing
This is the safer and would be my recommended approach, while being harder to implement it allows properly handling other breakpoints and more control.
For this, you'll have to do three things:
- Set up a breakpoint at given address.
- Monitor for the breakpoint's trigger.
- And finally act upon it.
Set up a breakpoint at given address
The most basic method of achieving this is by calling the
idc.AddBpt(ea), which sets a software on execution breakpoint at that address.
Additional methods you could use include:
idc.AddBptEx(ea, size, bpttype) to have more control on the type of breakpoint you're creating.
idc. SetBptAttr(address, bptattr, value) to set the breakpoint's available attributes.
idc.SetBptCnd(ea, cnd) /
idc. SetBptCndEx(ea, cnd, is_lowcnd) to set the breakpoint's trigger condition.
Read the documentation for the exact details.
Monitor for the breakpoint's trigger
For that, you'll need to install a Debugger Hooking class (any class that inherits
idaapi.DBG_Hooks), which implements the
dbg_bpt(tid, ea) method, which describe the thread id and linear address in which the breakpoint triggered. Returning 0 from
dbg_bpt should prevent IDA from notifying the user it was triggered (assuming you'll handle it internally).
You'll have to instantiate your class and call the instance's
Unhook methods for it to actually function. Please note it's better practice to install the hooks before creating the breakpoint.
And finally act upon it
While the debugger is running, you can call
idc.GetRegValue(name) providing the register name to receive it's immediate value at that time.