Static analysis data combined with dynamic analysis knowledge

Question

What I'm doing now is placing an awful lot of comments about function variable values, global variable values as comments in my IDA database, which I find ugly after a while and obviously not a best practice.

I was wondering if it's possible to store runtime variable values of your target process from a dynamic debugging session in your IDA database(or any other storage/tool) in some way. For example you run IDA debugger, or some external tool like olly/immunity, and store the encountered values (globals, function parameters) in IDA, so you can see actual values when doing your static analysis in IDA (for example on mouse over).

I don't know if anybody done this before, but it think it would be a really helpful feature.

Is this possible, any similar tool/solution out there you know of? How do you process static+dynamic data of the reversed application?

I'm not tied to IDA, but I find that environment to be most fitting for storing my result data. I'm interested in any solution.

Answer 1

funcap uses IDA's debugging API to record function calls in a program together with their arguments (before and after).

This is very useful when dealing with malware which uses helper functions to decrypt their strings, or programs which make many indirect calls.