I'm using IDA Pro for ARM native debugging (with androidserver). I'd like to check when a memory address is read by code (what instruction and where). Hardware breakpoint is not possible. How can I do it? How to use watch option? With gdb?
Add a comment
|
1 Answer
What you are describing is called watchpoints/memory breakpoints.
Sadly, IDA doesn't let you place memory breakpoints.
Fortunately, you can implement those by changing the page protection and catching the page protection violation exception as described here and here.
-
Thanks amirag. Can you help me to understand how to do? Can you give an example with ida? I'd like to stop or trace when a code location is read. Many thanks– SilviusNov 9, 2018 at 5:58
-
doing it by hand will go something like that: shift+f7, right click on the segment that contains the address you want.and make it non-readable. continue execution until you get an exception. if the cause is not a read instruction to the address you want, just continue execution. if it is, you can have a lok at the code and stuff. don't forget that when you continue execution you should change the permissions back, step one instruction and remove the read permission again– user22970Nov 9, 2018 at 11:16
-
changing segment permissions in IDA does nothing to the running process, it's just internal flags for analaysis/decompiler.– Igor Skochinsky ♦Nov 9, 2018 at 12:54
-
so ignore my oh, i see. so that's pretty much nullifies my suggestion– user22970Nov 9, 2018 at 13:11
-
Thus, How I can do in order to find what instruction goes to read a single location? By stepping all code is very hard...– SilviusNov 9, 2018 at 14:39