1

With conditional breakpoints I'm able to alter the return value of a function. For example, when setting a breakpoint on the return instruction, the following IDC expression ensures that the function always returns false:

EAX=0

Now I would like to override the second argument that the function receives with a value of zero. The breakpoint is set on the first instruction of the function (push 1Ch). Unfortunately, I cannot get the following IDC expression to work as intended:

(ESP+8)=0

When the function is called, the value located at ESP+8 refers to the size of the buffer that is about to receive a bunch of values. By purposely setting the buffer size to zero, the function won't return any values.

How can I configure a conditional breakpoint with IDA that sets the value at ESP+8 to zero? And is it possible to do this by simply editing the breakpoint instead of running a script?


You have to use IDC functions to write to memory addresses. I recommend write_dbg_memory() function.

I still can't get the script to run successfully. When using the write_dbg_memory function, I get the following error message:

Runtime error at _idc+0x00000022: Attempt to call undefined function 'write_dbg_memory'

It also seems that the write_dbg_memory function that is listed here and here, uses different arguments (long ea, string data).

2

You can use IDC functions to write to memory addresses. I recommend write_dbg_memory() function.

write_dbg_memory(ESP+8, 0, size)

https://www.hex-rays.com/products/ida/support/idapython_docs/

Actually the line/s you put in condition of a breakpoint is also considered as a script which is executed when encountering the BP. So it has to follow the rules of writing a script. EAX = 0 is a simple line you've used before.

If IDC is not working you can use idaapi.dbg_write_memory api. I've tried the following line as a condition and it works fortunately! Choose "Python" for the "Scriptinng Language" menue bar.

daapi.dbg_write_memory(GetRegValue("ESP")+8,"HELLO")
  • Thank you for your answer. Unfortunately, I still can't get the script to run properly. Please check my question again, I've updated it accordingly. – treintje Oct 23 '17 at 18:58
  • WLC! I've added a new line to the answer check it out... Hope it works – EWD-0- Oct 23 '17 at 20:12
  • When I try to run that code via File > IDC command..., I receive the following error message: Variable 'daapi' is undefined. Maybe those features aren't supported by IDA version 5.0.0.879? – treintje Oct 23 '17 at 20:56
  • Have you chosen Python as scripting language? If you go with IDC, which is the default value, it won't work. – EWD-0- Oct 23 '17 at 21:13
  • Right click on the address and choose "Edit Breakpoint". Then on the condition bar click on "..." bar. On the new page at the right bottom side choose Python as scripting language – EWD-0- Oct 23 '17 at 21:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.