1

So I want to track when a certain file is loaded into an Win32 app. That's way I put a break-point on 'CreateFile' which compares the first parameter with the target file name, but the problem is that it is a case-sensitive comparison. How to do it non-sensitive?

Here is the break-point condition on 'CreateFileA':

GetString(DbgDword(esp + 0x4), -1, ASCSTR_C)  == "D:\\3K-MILLENNIUM\\3K-MILLENNIUM\\USER_LAW.TXT"

Any ideas?

2
  • What version of IDA are you using? Versions 6.6+ allow you to enter breakpoint conditions in Python - i.imgur.com/4Z2xwfP.gif Dec 25 '14 at 18:29
  • I was with 6.5 but just got one 6.6. So can you tell me how would the script looks like then?
    – sasho648
    Dec 25 '14 at 22:43
2

In the breakpoint settings for the given breakpoint, press the ... button, select Python as the scripting langauge, and use the following script body:

GetString(DbgDword(esp + 0x4), -1, ASCSTR_C).upper()  == "D:\\3K-MILLENNIUM\\3K-MILLENNIUM\\USER_LAW.TXT"

Conditional breakpoint

4
  • Sorry but your code doesn't work. It says that <string> has no attribute 'upper'.
    – sasho648
    Dec 26 '14 at 20:34
  • Odd, that error doesn't repro for me. Can you try the following? string.upper(GetString(DbgDword(esp + 0x4), -1, ASCSTR_C)) == "D:\\3K-MILLENNIUM\\3K-MILLENNIUM\\USER_LAW.TXT" Dec 26 '14 at 20:47
  • It just doesn't work, at all. Can I talk with you?
    – sasho648
    Dec 26 '14 at 21:31
  • OK - I was able to get my hands on IDAPython 1.7.0. But now it doesn't work either. Any suggestions?
    – sasho648
    Jan 8 '15 at 17:46
1

I was able to do this comparsion using IDA-Python 1.7.0 and IDA Demo 6.6. The script code is this:

Tmp = GetString(DbgDword(cpu.ESP + 0x4), -1, ASCSTR_C)

return str(Tmp).upper() == "D:\\3K-MILLENNIUM\\3K-MILLENNIUM\\USER_LAW.TXT"

Link to IDA-Python 1.7.0, compiled for Win32 (32bit & 64bit).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.