1

So I want to track when a certain file is loaded into an Win32 app. That's way I put a break-point on 'CreateFile' which compares the first parameter with the target file name, but the problem is that it is a case-sensitive comparison. How to do it non-sensitive?

Here is the break-point condition on 'CreateFileA':

GetString(DbgDword(esp + 0x4), -1, ASCSTR_C)  == "D:\\3K-MILLENNIUM\\3K-MILLENNIUM\\USER_LAW.TXT"

Any ideas?

Improve this question
2
  • What version of IDA are you using? Versions 6.6+ allow you to enter breakpoint conditions in Python - i.imgur.com/4Z2xwfP.gif
    – Jason Geffner
    Dec 25, 2014 at 18:29
  • I was with 6.5 but just got one 6.6. So can you tell me how would the script looks like then?
    – sasho648
    Dec 25, 2014 at 22:43

2 Answers 2

Reset to default
2

In the breakpoint settings for the given breakpoint, press the ... button, select Python as the scripting langauge, and use the following script body:

GetString(DbgDword(esp + 0x4), -1, ASCSTR_C).upper()  == "D:\\3K-MILLENNIUM\\3K-MILLENNIUM\\USER_LAW.TXT"

Conditional breakpoint

Improve this answer
4
  • Sorry but your code doesn't work. It says that <string> has no attribute 'upper'.
    – sasho648
    Dec 26, 2014 at 20:34
  • Odd, that error doesn't repro for me. Can you try the following? string.upper(GetString(DbgDword(esp + 0x4), -1, ASCSTR_C)) == "D:\\3K-MILLENNIUM\\3K-MILLENNIUM\\USER_LAW.TXT"
    – Jason Geffner
    Dec 26, 2014 at 20:47
  • It just doesn't work, at all. Can I talk with you?
    – sasho648
    Dec 26, 2014 at 21:31
  • OK - I was able to get my hands on IDAPython 1.7.0. But now it doesn't work either. Any suggestions?
    – sasho648
    Jan 8, 2015 at 17:46
1

I was able to do this comparsion using IDA-Python 1.7.0 and IDA Demo 6.6. The script code is this:

Tmp = GetString(DbgDword(cpu.ESP + 0x4), -1, ASCSTR_C)

return str(Tmp).upper() == "D:\\3K-MILLENNIUM\\3K-MILLENNIUM\\USER_LAW.TXT"

Link to IDA-Python 1.7.0, compiled for Win32 (32bit & 64bit).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.