I'm debugging an .exe file with IDA , and always I see specific value in my stack , for ex. AABBCCDDEEFF .

That value interests me, I want to know where this value comes from, how it gets pushed onto the stack.

How can I put some condition so that when my stack includes this value, the debugger breaks, so that I can see which function pushes/pushed it to stack?

  • it is not feasible as you phrase it that stack pointer is dynamic and can change on each instruction executed so unless you single step evaluate re single step you cant catch it if you know or have a boundary then you can use trace functions with evaluations and continuations but it would be horrendously slow generically – blabb Jul 13 '18 at 11:11
  • 3
  • 1
    @mrexodia question is about IDA, though. Although principles may be applicable. – 0xC0000022L Jul 17 '18 at 9:03

This has already been answered here : OllyDbg: How to set a conditional breakpoint for a value anywhere in the stack?

There is a specific plugin for the x64dbg debugger by mrexodia that can do exactly what you have asked for : https://github.com/mrexodia/StackContains

Taken from here :

Use it like this

This will break when the value 00E60000 appears on the stack like this :

enter image description here

As I'd already mentioned, the pics are taken from the thread that I'd linked to above.

I suggest that you read the full thread to gain a full understanding of the process.

I do realize that you'd mentioned IDA in your question but using the plugin in the x64dbg debugger that I linked to above, makes your job a whole lot easier.

Good luck :)

  • Can I move all to stuff I wrote in ida to x64dbg debugger ? I never use that before... is that free tool? It's hard to work with 2 tools, is there more adventage in x64dbg debugger compare to IDA? – ffdebugger Jul 13 '18 at 13:12
  • @ffdebugger : Yes, both x64dbg and the plugin are available along with their source code on Github and are therefore free. IDA and x64dbg each have their advantages and disadvantages. You need to see which to use depending on your primary purpose - decompliation or debugging. It is possible to achieve the same with IDA with scripting. x64dbg has a ready (and free) plugin that does exactly what you'd asked for... If you can script well then you can do it in IDA itself. – TechLord Jul 13 '18 at 15:26
  • @Biswapriyo The plugin checks and compares the values pushed on to the stack to what you'd entered and breaks if the values match. The screenshot in my answer above pretty much sum up and show what the plugin can do. – TechLord Jul 13 '18 at 15:29
  • @Biswapriyo : You would need to give us a lot more details with screenshots if possible, showing what exactly did and where it failed. With the info that you have presently provided, it's impossible to answer your question. – TechLord Jul 14 '18 at 4:37
  • what is please csp and what is max trace count – ffdebugger Aug 1 '18 at 17:26

You need a tracer for such things. See the tools like Ponce https://github.com/illera88/Ponce

  • I place the DLL in plugins folder but IDA 7.0 shows LoadLibrary(E:\IDA70\plugins\Ponce64.dll) error: The specified module could not be found. E:\IDA70\plugins\Ponce64.dll: can't load file. – Biswapriyo Jul 13 '18 at 13:08
  • sorry, I've used it only in IDA 6.8, and it worked fine then. – Anton Kukoba Jul 13 '18 at 13:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.