0

i'm using IDA to reverse some crypto code that seems to derive its key from some hashing functions. I have recognized the algoritm based on magic numbers, but i want to see its changes in memory easily.

Does there exist a way to mark changes in memory in the Hex view in IDA, or another debugger? I'm finding it tiresome to check and remember memory addresses all the time.

I'm imagining some feature that marks memory as it is touched, and lets you mouseover the fields to get more information on what made the change. That shouldn't be that intensive if done only when stepping

"Such is life, deal with it" is also an acceptable answer, but i just want to know if i am doing this the stupid cumbersome way, or of there's a better way.

Thanks!

  • I'm not sure I understood your question properly, but did you try to put Write Hardware breakpoints on addresses of your interest? This will break whenever the program writes to the addresses you've marked. – Megabeets Dec 1 '17 at 16:13
  • That is correct, and i am already doing this. My issue lies in the fact that i am trying to mark memory locations by name, such that i can easier keep track of what is what in memory. Think of the commenting feature of the IDA view, but for the Hex View – Liam S. Crouch Dec 1 '17 at 17:09
1

Probably you could use "Page breakpoints" for the area where it writes if your target runs in Windows and, then, editing the breakpoint (right click with the mouse over the line with the breakpoint, then click on "Edit Breakpoint") you can specify if you want it to be traced (Edit Breakpoint and check "Trace") or if you want the process to stop (Edit Breakpoint and check "Break").

PS: It will be slow, though.

0

Don't think there's something. Yet you could implement it yourself. If you know the memory region your code uses, you may mark memory pages as PAGE_GUARD via VirtualProtect(), as Armadillo protector once did :) On each access to the memory STATUS_GUARD_PAGE_VIOLATION will be raised and you'll know who did it and where it tried to access. Then you recover from exception and do it all over again.

  • Great suggestion! I'm trying not to reinvent the wheel here when we have great tools already, but if something like that us useful, i'l try it out. Thanks! – Liam S. Crouch Dec 1 '17 at 16:10
  • I think this is most efficent way to do that, debuggers use that method too. Even operating systems using similar technique for paging mechanisms. – de6f Dec 3 '17 at 22:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.