I'm using idapro for arm native debugging (with androidseever) . I'd like to check when a memory data is read by code (what instruction and where). Hardware bp is not possible. How can i do? How to use watch option? With gbd? Thanksl
-
BP? Did you mean breakpoint? – Biswapriyo Nov 7 '18 at 16:21
-
Yes, sorry. Is theee a way to check memory data access, For example to find crc routine? – Silvius Nov 7 '18 at 18:12
What you are describing is called watchpoints/memory breakpoints.
Sadly, IDA doesn't let you place memory breakpoints.
Fortunately, you can implement those by changing the page protection and catching the page protection violation exception as described here and here.
-
Thanks amirag. Can you help me to understand how to do? Can you give an example with ida? I'd like to stop or trace when a code location is read. Many thanks – Silvius Nov 9 '18 at 5:58
-
doing it by hand will go something like that: shift+f7, right click on the segment that contains the address you want.and make it non-readable. continue execution until you get an exception. if the cause is not a read instruction to the address you want, just continue execution. if it is, you can have a lok at the code and stuff. don't forget that when you continue execution you should change the permissions back, step one instruction and remove the read permission again – Amirag Nov 9 '18 at 11:16
-
changing segment permissions in IDA does nothing to the running process, it's just internal flags for analaysis/decompiler. – Igor Skochinsky♦ Nov 9 '18 at 12:54
-
-
Thus, How I can do in order to find what instruction goes to read a single location? By stepping all code is very hard... – Silvius Nov 9 '18 at 14:39
