2

I want to record the value of a certain register or specific memory location when the program is being debugged. e.g. in the following segment:

.text:0FD6268D                 shr     ecx, 4
.text:0FD62690                 and     esi, 0Fh
.text:0FD62693                 movzx   ecx, ds:byte_FF27790[ecx]
.text:0FD6269A                 mov     [edx], cl
.text:0FD6269C                 inc     dword ptr [eax]
.text:0FD6269E                 mov     edx, [eax]

This is a part of a function which is accessed many times and I want to print, to file, the values of:

ecx @.text:0FD6268D and ds:byte_FF27790 @.text:0FD62693. I need this printed every time the program gets there during the debugging.

How can I accomplish this using idapython?

2
  1. Create two Python-functions (menu File-Script command...). First for printing EAX and second - for printing memory @FF27790

Python-fuctions

def view_ecx():
    print GetRegValue("ecx")

def view_memory():
    print Byte(0xFF27790)    
  1. Set breakpoints:
    • @.text:0FD6268D - set condition view_ecx() and choose Python-type
    • @.text:0FD62693 - set condition view_memory() and choose Python-type
0

Thanks, I cam up with adding this the the BP:

def view_mem_0xF3E7790():   
    opAddr = 0xF3E7790
    for byte in idc.get_bytes(opAddr, 16):
        hexChar = ord(byte)
        print chr(hexChar),
print "\n"

2 questions: 1. how can i append the result to a log rather than printing to the screen. 2. Can i add these BP problematically somehow?, similar to idc.AddBpt(ea)

?

  • 2. As I understand, you want something like this: idaapi.add_bpt(0xF3E7790, 4, BPT_DEFAULT); bpt = idaapi.bpt_t(); idaapi.get_bpt(0xF3E7790,bpt); bpt.elang = 'Python'; bpt.condition = 'view_mem_0xF3E7790()'; idaapi.update_bpt(bpt); – prusanov Apr 3 at 16:17
  • 1. Do you meen write log to file? – prusanov Apr 3 at 17:20
  • yes, write log to file thank you – dandan Apr 3 at 17:35
  • Then just like in pure Python - pythonspot.com/write-file – prusanov Apr 3 at 17:38
  • thank you ..... – dandan Apr 4 at 4:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.