7

Let's say I have lots of breakpoints at some push instructions. I am trying to dereference the operand (if address) - get the actual relevant value for each one in a script, handling immediate, base + index, register, etc. Can I do this in any other way than:

  1. Read it with ESP after Step Into (executing the instruction at breakpoint) (DbgRead() of IDC, idaapi.dbg_read_memory())
  2. Read the operand and manually evaluate it in the script with respective calls to DbgRead(), GetRegValue(), etc.

This, if possible, I guess would imply a particular idaapi function.

  • Does the push line have an xref to the data? – tmr232 Jul 16 '15 at 22:38
1

No, you must implement the base + index * scale yourself (if on i386). On other architectures without this complexity (e.g. ARM) it is a bit easier.

If it helps any, I have already implemented this functionality in pwndbg for exactly the same purpose.

You can see the implementation here: https://github.com/zachriggle/pwndbg/blob/master/pwndbg/disasm/x86.py

Note that I am not using IDA's API, but rather pwndbg's internal API which relies on GDB. You will have to make some small changes to the way in which you fetch register and memory values from that code (e.g. pwndbg.regs.pc gives me the value of EIP or RIP as appropriate).

  • Getting the base, index, scale and offset values in IDA can be a bit tricky. You can use Sark to handle it (for x86 and x64). It doesn't do the actual reading of debug values, though. – tmr232 Mar 4 '16 at 21:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.