1

I'm debugging an .exe file with IDA , and always I see specific value in my stack , for ex. AABBCCDDEEFF .

That value interests me, I want to know where this value comes from, how it gets pushed onto the stack.

How can I put some condition so that when my stack includes this value, the debugger breaks, so that I can see which function pushes/pushed it to stack?

Improve this question
3
  • it is not feasible as you phrase it that stack pointer is dynamic and can change on each instruction executed so unless you single step evaluate re single step you cant catch it if you know or have a boundary then you can use trace functions with evaluations and continuations but it would be horrendously slow generically
    – blabb
    Jul 13, 2018 at 11:11
  • 3
    Possible duplicate of OllyDbg: How to set a conditional breakpoint for a value anywhere in the stack?
    – mrexodia
    Jul 16, 2018 at 0:09
  • 1
    @mrexodia question is about IDA, though. Although principles may be applicable.
    – 0xC0000022L ♦
    Jul 17, 2018 at 9:03

2 Answers 2

Reset to default
2

This has already been answered here : OllyDbg: How to set a conditional breakpoint for a value anywhere in the stack?

There is a specific plugin for the x64dbg debugger by mrexodia that can do exactly what you have asked for : https://github.com/mrexodia/StackContains

Taken from here :

Use it like this

This will break when the value 00E60000 appears on the stack like this :

enter image description here

As I'd already mentioned, the pics are taken from the thread that I'd linked to above.

I suggest that you read the full thread to gain a full understanding of the process.

I do realize that you'd mentioned IDA in your question but using the plugin in the x64dbg debugger that I linked to above, makes your job a whole lot easier.

Good luck :)

Improve this answer
5
  • Can I move all to stuff I wrote in ida to x64dbg debugger ? I never use that before... is that free tool? It's hard to work with 2 tools, is there more adventage in x64dbg debugger compare to IDA?
    – ffdebugger
    Jul 13, 2018 at 13:12
  • @ffdebugger : Yes, both x64dbg and the plugin are available along with their source code on Github and are therefore free. IDA and x64dbg each have their advantages and disadvantages. You need to see which to use depending on your primary purpose - decompliation or debugging. It is possible to achieve the same with IDA with scripting. x64dbg has a ready (and free) plugin that does exactly what you'd asked for... If you can script well then you can do it in IDA itself.
    – TechLord
    Jul 13, 2018 at 15:26
  • @Biswapriyo The plugin checks and compares the values pushed on to the stack to what you'd entered and breaks if the values match. The screenshot in my answer above pretty much sum up and show what the plugin can do.
    – TechLord
    Jul 13, 2018 at 15:29
  • @Biswapriyo : You would need to give us a lot more details with screenshots if possible, showing what exactly did and where it failed. With the info that you have presently provided, it's impossible to answer your question.
    – TechLord
    Jul 14, 2018 at 4:37
  • what is please csp and what is max trace count
    – ffdebugger
    Aug 1, 2018 at 17:26
1

You need a tracer for such things. See the tools like Ponce https://github.com/illera88/Ponce

Improve this answer
2
  • I place the DLL in plugins folder but IDA 7.0 shows LoadLibrary(E:\IDA70\plugins\Ponce64.dll) error: The specified module could not be found. E:\IDA70\plugins\Ponce64.dll: can't load file.
    – Biswapriyo
    Jul 13, 2018 at 13:08
  • sorry, I've used it only in IDA 6.8, and it worked fine then.
    – Anton Kukoba
    Jul 13, 2018 at 13:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.