1

I am new to reverse engineering. This is my problem: I am running a program and I know a value 'X' will be calculated during execution. Now how do i set the IDA or ollydbg to break when value X appears for the first time in the memory. (I guess it is similar to Memory/Data Breakpoints) Please help.

  • Do you know where in memory your value should appear? If so, you can set a breakpoint on that memory address. If not, the only way to do this is running an emulator and check the state of the emulated machine after each instruction. – Guntram Blohm supports Monica Nov 17 '14 at 14:16
  • The idea of reverse code engineering is usually not to "scan" a whole memory range for a specific value (on Windows Cheat Engine can do that for you; but don't do it for malicious samples!!!), but to selectively understand the code and work your way to the location of interest. This requires that you have an in-depth understanding of the representation certain library/runtime/OS features have in a program and being able to match those to the assembly code IDA or OllyDbg give you. – 0xC0000022L Nov 17 '14 at 14:20
  • @Guntram Blohm: This seems no longer quite accurate in Ida 6.3. Quote Hex-Rays: "Page breakpoints are memory access breakpoints that can be set to detect when the application reads, writes, or executes code/data in a specific memory range. Page breakpoints are very similar to hardware breakpoints but there is no limitation on the number of page breakpoints that can be set or their size, in contrast with normal hardware breakpoints." – josh Jun 28 '15 at 23:47
3

Well, I was tying few weeks ago to implement an ollyscript which triggers conditional beakpoints on each line where a desired alpha/numerical value is found.

This program gives the user the choice of following one of 3 methods:

1- Trace methode (which works with numbers)

2- Memory breakpoints

3- Smart research by setting unconditional breakpoints (works by two passes)

  • Golden script:
COE 
LC  
log " This script is realised by AGAWA001 of StackExchange "    
log " This script should be executed on ODbgScript version +1.82.6" 
log " This script must rerun twice atleast in case of smartresearch"    
log " you must restart your program once terminated to clear useless breakpoints"   
log " This script is used to check existence of an alpha/numeric value in memory"   
log " Unicode strings arent suppoted try to input first two unicode characters as number"   
log " in case when script stops, press spacebar focused on script window to force it to run"    
log " This script removes all beakpoints prealably set up and changes labels from command lines"    
log " To run this script as quick as possible, ollydbg window is prefered to be minimized during execution "    
log " All insider windows (log window,bp window,memory ,...) must be closed apart script window to ensure shortest runtime" 
log " Trace procedure can encounter T-flag error, in this case try to get a grasp on it by binding esc key focused on script window"    
log " Some debuggers dont support ask command, so values must be injected manually and carefully instead of userprompt command in same line"    

log "--------------------------------------------------------------------------------------"    
log " This is beta version, Contact me whether you find any bugs, regards." 
log "--------------------------------------------------------------------------------------"    

var str 
var tmp 
var start   
var finish  
var addr    
var ending  
var beginning   
var val 
var value   
var swtch   
var stack   
var stackend    
var buff    
var offset  
var dll 
var processkill 
mov processkill,0   
mov offset,4    
alloc 1000                          
mov buff, $RESULT   
mov offst,ff    
GMEMI esp, MEMORYBASE   
mov stack,$RESULT   
GMEMI $RESULT, MEMORYSIZE   
mov stackend,$RESULT    
add stackend,stack  
gmi eip,MODULEBASE  
mov start,$RESULT   
mov finish,$RESULT  
gmi eip,MODULESIZE  
add finish,$RESULT  
gcmt finish 
cmp $RESULT,"complete"  
je bypass   
cmp $RESULT,"done"  
je exit 
preop eip   
gcmt $RESULT    
cmp $RESULT,"ready" 
je check2   
preop eip   
gcmt $RESULT    
mov val,$RESULT 
len $RESULT 
ifg $RESULT,1   
atoi val    
mov val,$RESULT 
mov dll,0   
ife val>>1f,1   
mul val,-1  
mov addr,eip-val    
jmp boucl   
else    
mov addr,eip+val    
jmp boucl2  
endif   
endif   
check2: 
mov processkill,1   
bypass: 
mul offst,10    
ask "Enter value to look for (preceded by 'str:' in case of a formatted string ex: str:password ) " 
add offst,buff  
cmp $RESULT, 0  
je  theend  
mov str,$RESULT 
mov value,$RESULT   
str str 
len str 
mov tmp,$RESULT 
cmp tmp,5   
jb ok   
str str 
scmp  str, "str:", 4    
jne ok  
buf str 
mov [esp-100],str   
mov value,0 
mov value,[esp-100+4]   
keepon: 
mov [buff+offset-4],[esp-100+offset]    
add offset,4    
cmp tmp,offset  
jbe nok 
jmp keepon  
ok: 
mov [buff+offset-4],value   
nok:    
cmp processkill,1   
je loop 
MSGYN "do you want to set breakpoints on dlls ? "   
ifeq $RESULT, 0 
mov dll,0   
else    
mov dll,1   
endif   
cmp $RESULT,2   
je theend   
jmp firstcheck  
returnback: 
mov val,value   
MSGYN "do you want to trace the information ? press no to proceed smart research "  
cmp $RESULT, 2  
jne traced  




firstcheck: 
mov val,0   
mov addr,0  
mov tmp,0   
mov str,0   
repeat: 
mov [2*str+offst],c0+str    
add str,1   
cmp str,3   
jl repeat   
mov str,value   
buf str 
findmem str, addr   
cmp $RESULT, 0  
je cont 
mov addr,$RESULT    
itoa addr   
log "value found in memory at " + $RESULT   
ifeq tmp,0  
msgyn "value found in memory would you like to set memory breakpoint there (see log) ?" 
mov tmp,$RESULT 
cmp $RESULT,2   
je returnback   
endif   
mov val,addr    
GMEMI addr, MEMORYBASE  
mov addr,$RESULT    
gmi addr,PATH   
add buff,300    
mov [buff],$RESULT  
len [buff]  
mov str,$RESULT 
add str,buff    
sub str,3   
cmp [str],"dll" 
sub buff,300    
je cont 
GMEMI addr, MEMORYSIZE  
cmp val,start   
jb performm 
cmp val, finish 
ja performm 
add addr,$RESULT    
jmp repeat  
performm:   
cmp val,stack   
jb performm2    
cmp val, stackend   
ja performm2    
mov addr,val    
mov str,4   
jmp changeplan  
performm2:  
mov str,$RESULT     
sub str,1   
changeplan: 
cmp tmp,0   
je saut 
bprm addr,str   
mov val,[buff+400]  
mov [buff+404+val],addr 
mov [buff+408+val],str  
add val,8   
mov [buff+400],val  
saut:   
add addr,str    
cmp tmp,0   
je repeat   
jmp cont    





traced: 
cmp $RESULT, 0  
je smartsearch  



itoa val    
mov val,$RESULT 
concatenate:    
len val 
cmp $RESULT,8   
je stopit   
mov val,"0"+val 
jmp concatenate 
stopit: 
mov str, " EAX==" + val+ " | EBX==" + val+ " | ECX==" + val+ " | EDX==" + val+ " | ESI==" + val+ " | EDI==" + val   
log "---------------------value to trace is---------------------------" 
log str 
log "-----------------------------------------------------------------" 
ticnd str   
mov swtch,1 
jmp passover    
trace:  
precontinue:    
sti 
mov addr,eip    
ti  
cmp eip,addr    
je precontinue  
passover:   
ifeq dll,0  
cmp eip,start   
jb run  
cmp eip,finish  
ja run  
jmp continue    
run:    
rtr 
sti 
cmp eip,start   
jb run  
cmp eip,finish  
ja run  
jmp trace   
endif   
continue:   
preop eip   
mov addr,$RESULT    
GOPI addr, 1, DATA  
cmp $RESULT,value   
je detected1    
GOPI addr, 2, DATA  
cmp $RESULT,value   
je detected2    
GOPI addr, 1, ADDR  
cmp $RESULT,7   
ja checkval 
mov val,[buff]  
cmp swtch,1 
je trace    
jmp redo2   
checkval:   
mov tmp,0   
cmp [$RESULT],value 
and [offst+1],ff00ff00  
mov val,7   
je affect   
add tmp,1   
cmp [$RESULT+1],value   
je affect   
add tmp,1   
cmp [$RESULT+2],value   
je affect   
add tmp,1   
cmp [$RESULT+3],value   
je affect   
GOPI addr, 2, ADDR  
cmp $RESULT,8   
add [offst+1],400050    
add [offst+1],val   
add [offst+3],val   
jb compare  
jmp round2  
affect: 
add [offst+1],400050    
add [offst+1],val   
add [offst+3],val   
itoa $RESULT+tmp    
mov addr,$RESULT    
mov tmp,0   
mov val, buff+100   
jmp concat  
round2: 
mov tmp,0   
cmp [$RESULT],value 
je affect   
add tmp,1   
cmp [$RESULT+1],value   
je affect2  
add tmp,1   
cmp [$RESULT+2],value   
je affect2  
add tmp,1   
cmp [$RESULT+3],value   
je affect2  
cmp swtch,1 
je trace    
jmp redo2   
affect2:    
itoa $RESULT+tmp    
mov addr,$RESULT    
mov tmp,0   
mov val, buff+100   
jmp concat  
compare:    
mov val,[buff]  
mov [buff+e08],31303041 
cmp swtch,1 
je trace    
jmp redo2   
detected1:  
GOPI addr, 1, ADDR  
jmp branch  
detected2:  
GOPI addr, 2, ADDR  
branch:     
mov tmp,$RESULT 
mov str,addr    
itoa str    
mov str,$RESULT 
itoa value  
cmp tmp,0   
je eaxx 
cmp tmp,1   
je ecxx 
cmp tmp,2   
je edxx 
cmp tmp,3   
je ebxx 
cmp tmp,6   
je esii 
cmp tmp,7   
je edii 
log "eip="+str  
mov addr,tmp    
mov tmp,0   
mov val, buff+100   
itoa addr   
mov addr,$RESULT    
mov str,0   
concat: 
mov str,0   
mov str,[buff+tmp]  
itoa str    
mov str,$RESULT 
mov [val] , "[" 
mov [val+1],  addr  
len [val]   
mov [val+$RESULT], "] == "  
mov [val+$RESULT+5], str    
add val,$RESULT+5   
len [val]   
mov [val+$RESULT], "&"  
add val,$RESULT+1   
mov [val],0 
add tmp,1   
atoi addr   
mov addr,0  
mov addr,$RESULT    
add addr,1  
cmp offset-4,tmp    
jbe dobp    
cmp [addr],[buff+tmp]   
jne dobp2   
itoa addr   
mov addr,$RESULT    
jmp concat  
dobp:   
itoa addr   
log "found at :" + $RESULT  
msgyn "perfect value found in memory ,would you like to clear all previous conditional breakpoints? press no to keep all breakpoints, cancel to stop script (see log window)"   
ifeq $RESULT,1  
bc  
else    
ifeq $RESULT,2  
jmp theend  
endif   
endif   
dobp2:  
mov [val-1],0   
mov [buff+e04],57414741 
gstr buff+100   
BPCND eip, $RESULT  
cmt finish,"done"   
itoa eip    
LBL eip,"no"+$RESULT    
fill buff+100, val-buff-100, 0  
mov val,[buff]  
cmp swtch,1 
je trace    
jmp redo2   
eaxx:   
log "eip="+str  
BPCND eip, "EAX == " + $RESULT  
gcmt start  
cmp $RESULT,"done"  
jne check4  
gcmt finish 
cmp $RESULT,"complete"  
je check4   
itoa eip    
LBL eip,"no"+$RESULT    
check4: 
cmp swtch,1 
je trace    
jmp redo2   
ebxx:   
log "eip="+str  
BPCND eip, "EBX == " + $RESULT  
gcmt start  
cmp $RESULT,"done"  
jne check3  
gcmt finish 
cmp $RESULT,"complete"  
je check3   
itoa eip    
LBL eip,"no"+$RESULT    
check3: 
gcmt start  
cmp $RESULT,"done"  
jne check5  
gcmt finish 
cmp $RESULT,"complete"  
je check5   
itoa eip    
LBL eip,"no"+$RESULT    
check5: 
cmp swtch,1 
je trace    
jmp redo2   
ecxx:   
log "eip="+str  
BPCND eip, "ECX == " + $RESULT  
gcmt start  
cmp $RESULT,"done"  
jne check6  
gcmt finish 
cmp $RESULT,"complete"  
je check6   
itoa eip    
LBL eip,"no"+$RESULT    
check6: 
cmp swtch,1 
je trace    
jmp redo2   
edxx:   
log "eip="+str  
BPCND eip, "EDX == " + $RESULT  
gcmt start  
cmp $RESULT,"done"  
jne check7  
gcmt finish 
cmp $RESULT,"complete"  
je check7   
itoa eip    
LBL eip,"no"+$RESULT    
check7: 
cmp swtch,1 
je trace    
jmp redo2   
esii:   
log "eip="+str  
BPCND eip, "ESI == " + $RESULT  
gcmt start  
cmp $RESULT,"done"  
jne check8  
gcmt finish 
cmp $RESULT,"complete"  
je check8   
itoa eip    
LBL eip,"no"+$RESULT    
check8: 
cmp swtch,1 
je trace    
jmp redo2   
edii:   
log "eip="+str  
BPCND eip, "EDI == " + $RESULT  
gcmt start  
cmp $RESULT,"done"  
jne check9  
gcmt finish 
cmp $RESULT,"complete"  
je check9   
itoa eip    
LBL eip,"no"+$RESULT    
check9: 
cmp swtch,1 
je trace    
jmp redo2   



cont:   

log "-----------------end memorybreakpoints---------------------"   
loop:   
COE 
erun    


ifeq dll,0  
cmp eip,start   
jb run2 
cmp eip,finish  
ja run2 
jmp continue2   
run2:   
BPMC    
redoit: 
COE 
erun    
cmp eip,start   
jb redoit   
cmp eip,finish  
ja redoit   
mov val,0   
mov str,buff+404    
bpaffect:   
bprm [str],[str+4]  
add str,8   
add val,8   
cmp [buff+400],val  
jne bpaffect    
jmp loop    
continue2:  
endif                           



mov addr, eip   
GOPI addr, 1, DATA  
cmp $RESULT, value  
je detected1    
GOPI addr, 2, DATA  
cmp $RESULT, value  
je detected2    
GOPI addr, 1, ADDR  
cmp $RESULT,7   
ja checkval 
GOPI addr, 2, ADDR  
cmp $RESULT,8   
jb redo2    
jmp round2  
detected1:  
GOPI addr, 1, ADDR  
jmp branch  
detected2:  
GOPI addr, 2, ADDR  
jmp branch  



ifeq dll,0  
cmp eip,start   
jb run2 
cmp eip,finish  
ja run2 
jmp continue2   
run2:   
BPMC    
redoit: 
COE 
rtr 
sti 
cmp eip,start   
jb redoit   
cmp eip,finish  
ja redoit   
mov val,0   
mov str,buff+404    
bpaffect:   
bprm [str],[str+4]  
add str,8   
add val,8   
cmp [buff+400],val  
jne bpaffect    
jmp loop    
continue2:  
endif                           


redo2:  

jmp loop    



smartsearch:    
mov dll,0   
mov addr, eip   
boucl:  
mov str,addr    
preop addr  
ifeq $RESULT,addr-1 
preop $RESULT   
mov addr,$RESULT    
jmp boucl   
endif   
mov addr,$RESULT    
cmp addr,str    
je finishit 
opcode addr 
mov [buff+200],$RESULT_1    
mov str,buff+200    
ckecknext:  
add str,1   
scmp  [str], "[", 1 
je dobreak  
cmp [str],0 
je boucll   
jmp ckecknext   
dobreak:    
bp  addr    
mov dll,addr-eip    
itoa dll    
mov dll,$RESULT 
preop eip   
cmt $RESULT,dll 
mov val,addr    
itoa val    
LBL val,"yes"+$RESULT   
boucll: 
gstr buff+200   
len $RESULT 
fill buff+200, $RESULT, 0   
jmp boucl   

finishit:   
mov dll,0   
mov start,addr  
mov addr, eip   
boucl2: 
GCI addr, size  
cmp $RESULT,0   
je loopp    
mov addr,addr +$RESULT  
preop addr  
ifeq $RESULT,addr-1 
jmp boucl2  
endif   
opcode addr 
cmp addr,finish 
jae loopp   
mov [buff+200],$RESULT_1    
mov str,buff+200    
ckecknext2: 
add str,1   
scmp  [str], "[", 1 
je dobreak2 
cmp [str],0 
je boucll2  
jmp ckecknext2  
dobreak2:   
mov dll,addr-eip    
itoa dll    
mov dll,$RESULT 
preop eip   
cmt $RESULT,dll 
GCI addr, size  
bp  addr    
mov val,addr    
itoa val    
LBL val,"yes"+$RESULT   
boucll2:    
gstr buff+200   
len $RESULT 
fill buff+200, $RESULT, 0   
jmp boucl2  

loopp:  
preop eip   
cmt $RESULT,"ready" 
jmp loop    

exit:   
mov val,start   
again:  
ifeq val,finish 
jmp lafin   
endif   
endif   
mov str,""  
glbl val    
ifNeq $RESULT,0 
MOV str,$RESULT 
endif   
scmp str,"yes",3    
jne skipit  
bc val  
lbl val,""  
skipit: 
GCI val, size   
mov val,val+$RESULT 
jmp again   
lafin:  
preop eip   
cmt $RESULT,""  
cmt finish,"complete"   
msg "finished, save a copy of ./udd/<exename>.udd to store script results"  
theend: 
Ret                     
  • May you report me any bugs you find to this email atagawa@gmail.com -best regards-
0

I wouldn't say I'm new to RE but I'm certainly not an expert, so please take my answer with a grain of salt. Chances are, what you are actually looking for is probably not the actual value, but how that value relates to your program, ie; the number 42 doesn't really mean anything without any context or dimension.

What you've described would be a very naive way of finding how a program deals with and stores data, and effectively the only way to implement it, would be to continually search entire regions of memory (easily many megabytes in size), at every given moment - provided it actually stores the value in memory any way - OR, stop at every instruction to see if any reference is made to your value.

This is not impossible, but likely impractical. As mentioned in comments, The RE way of doing this, would be to find the context where your value might actually appear, for example, if you are looking for your health in a video game, you would start by finding any code that would heal you or damage you or check whether you are still alive etc.

Without any more information there is not more we can help you with, perhaps you could edit your question to provide more?

0

and I know a value 'X' will be calculated during execution

This has multiple interpretations, which you have to deal with differently.

  1. Value X is calucated on the fly. The value is used as a parameter or modifier and will never be stored in memory.

For this interpretation you have to find the code where your value is actually calculated. The you can set a breakpoint, inspect the values of the register in question, and continue if the value is not found.

  1. Value 'X' is calculated and stored in a fixed place in memory.

This is the easy one. Just set a memory breakpoint on the address you know where the value must appear. Additionally you can inspect the value and only break if the value X is actually set.

  1. Value 'X' is calculated and stored with an object (object oriented language is used).

In this case, the value may be stored in different adresses each time you run the code. However, you should still be able to identfy the code where the object is used, so you know the address of the object (or memoryblock). You can then reference this adress and inspect the value and continue if it is not reached.

How exactly you do each of those techniques depends on the debugger you use. I'm using usually windbg and with conditional breakpoints you can do all of this. The harder part is to find out, where exactly your value is, because in modern computers you have 4GB+ of RAM or more, so there are MANY places where the same value can be found if you just look for a particular number without context.

I once write a small tool for ding this though. I created a memory dump and and looked for all places, where my value was. Then I let the program continue and took another dump when the value changed. I compared only the addresses that I found before. Usually it took only 2-3 iterations to find the address. This method only works though, if the value is always at the same address and doesn't move with dynamic allocated memory.

0

You can try and use DIE.

DIE uses IDA's debugger to get the values passed to and from functions during runtime. After execution, it will generate a "value-view" window, listing all the values it collected. If your value is there, you can see where it was used / generated. Note that if the value is not passed to or returned from functions it will not appear in the value view.

From there, you can set breakpoints (or conditional breakpoints) at the relevant locations and debug the program again.

This does require an up-to-date version of IDA Pro, though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.