1

In IDA I need to set a breakpoint that once it hit, I want to check if ZF is equal to 1, if it does, I want to change it to 0.

I don't know how to do it:
enter image description here

I searched for example scripts in IDC or IDAPython but I didn't find something that shows it.
How can I do it?

1

shift + f2

Message("zf flag when bp hit = %x\n" , GetRegValue("zf"));
SetRegValue(0,"zf");
Message("zf flag after setting it %x\n" , GetRegValue("zf"));

result

zf flag when bp hit = 1
zf flag after setting it 0
1

Since in your case the final value of ZF will be zero, there is no need to check the initial value but simply always zero it:

ZF=0,0

The ,0 at the end will ensure that the result of expression is 0 so IDA will continue execution of the program.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.