Overriding the second argument with conditional breakpoints

Question

With conditional breakpoints I'm able to alter the return value of a function. For example, when setting a breakpoint on the return instruction, the following IDC expression ensures that the function always returns false:

EAX=0

Now I would like to override the second argument that the function receives with a value of zero. The breakpoint is set on the first instruction of the function (push 1Ch). Unfortunately, I cannot get the following IDC expression to work as intended:

(ESP+8)=0

When the function is called, the value located at ESP+8 refers to the size of the buffer that is about to receive a bunch of values. By purposely setting the buffer size to zero, the function won't return any values.

How can I configure a conditional breakpoint with IDA that sets the value at ESP+8 to zero? And is it possible to do this by simply editing the breakpoint instead of running a script?

---

You have to use IDC functions to write to memory addresses. I recommend write_dbg_memory() function.

I still can't get the script to run successfully. When using the write_dbg_memory function, I get the following error message:

Runtime error at _idc+0x00000022: Attempt to call undefined function 'write_dbg_memory'

It also seems that the write_dbg_memory function that is listed here and here, uses different arguments (long ea, string data).

Answer 1

You can use IDC functions to write to memory addresses. I recommend write_dbg_memory() function.

write_dbg_memory(ESP+8, 0, size)

https://www.hex-rays.com/products/ida/support/idapython_docs/

Actually the line/s you put in condition of a breakpoint is also considered as a script which is executed when encountering the BP. So it has to follow the rules of writing a script. EAX = 0 is a simple line you've used before.

If IDC is not working you can use idaapi.dbg_write_memory api. I've tried the following line as a condition and it works fortunately! Choose "Python" for the "Scriptinng Language" menue bar.

daapi.dbg_write_memory(GetRegValue("ESP")+8,"HELLO")