I'm debugging an .exe file in IDA.

At a specific point during debugging, I want the Python code to automatically take the data in *(eax+8) and encrypt it with that module and print the result to file in my disk.

The Python package I want to use is pycrypto (more specifically the AES module from it).

for example:

from Crypto.Cipher import AES
from Crypto import Random

key = b'Sixteen byte key'
iv = Random.new().read(AES.block_size)
cipher = AES.new(key, AES.MODE_CFB, iv)
msg = iv + cipher.encrypt(b'here I want to put the data in eax+8')

and write the msg to c:\.txt

How can I do it?

  • From your question (before my edit and still now) it's unclear what exactly is at (eax+8). From the context I'd assume it's some array of bytes of arbitrary length, but from your use of *(eax+8) I'm more inclined to think it's a fixed size datum. So which is it?
    – 0xC0000022L
    Commented Jul 26, 2018 at 10:58

1 Answer 1


Use breakpoints with conditions and add your Python script as the condition. Do whatever you want in the Python code and then either return True or False if you want the debugger to stop or not.

  • Do I need to install IdaPython to write pyhon in condition? and how do I take to pyhon the value the in *(eax+8) ??
    – Jonert6544
    Commented Jul 25, 2018 at 16:44
  • You can use either IDC or IDAPython. To read the value from *(eax+8) you can use: Dword(cpu.EAX + 8), IIRC. Commented Jul 25, 2018 at 16:50
  • When making the condition make sure to hit the ... button to the right that brings out the big script editor and in the dropdown near the bottom change the language from IDC to python. I'm not sure if that'll actually wok though cause I've only written bp conditions in IDC
    – Avery3R
    Commented Jul 25, 2018 at 19:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.