I'm using idapro for arm native debugging (with androidseever) . I'd like to check when a memory data is read by code (what instruction and where). Hardware bp is not possible. How can i do? How to use watch option? With gbd? Thanksl
-
BP? Did you mean breakpoint? – Biswapriyo Nov 7 '18 at 16:21
-
Yes, sorry. Is theee a way to check memory data access, For example to find crc routine? – Silvius Nov 7 '18 at 18:12
What you are describing is called watchpoints
/memory breakpoints
.
Sadly, IDA doesn't let you place memory breakpoints.
Fortunately, you can implement those by changing the page protection and catching the page protection violation exception as described here and here.
-
Thanks amirag. Can you help me to understand how to do? Can you give an example with ida? I'd like to stop or trace when a code location is read. Many thanks – Silvius Nov 9 '18 at 5:58
-
doing it by hand will go something like that: shift+f7, right click on the segment that contains the address you want.and make it non-readable. continue execution until you get an exception. if the cause is not a read instruction to the address you want, just continue execution. if it is, you can have a lok at the code and stuff. don't forget that when you continue execution you should change the permissions back, step one instruction and remove the read permission again – Amirag Nov 9 '18 at 11:16
-
changing segment permissions in IDA does nothing to the running process, it's just internal flags for analaysis/decompiler. – Igor Skochinsky♦ Nov 9 '18 at 12:54
-
-
Thus, How I can do in order to find what instruction goes to read a single location? By stepping all code is very hard... – Silvius Nov 9 '18 at 14:39