0

I'm usibng IDA 6.5.140116 and cannot seem to get a breakpoint to break.

My workflow is:

  1. Open the Imports subview
  2. Double click on the Name column for the row representing GetProcAddress. This jumps to the IDA View-EIP window.

IDA View-EIP window

  1. With the GetProcAddress line selected, I press F2 to set a breakpoint

Breakpoint settings

When I run the application, these breakpoints NEVER get hit. The application isn't using ASLR. I'm wary about the breakpoint being in .idata when perhaps I need it on the first instruction of GetProcAddress in kernel32. I'm not sure how to set that exactly.

I just want to have a breakpoint thrown whenever a certain API call (in this case GetProcAddress... but also RegQueryValueExA for example) but the press F2 on the address obtained via the Imports window doesn't seem to be working. What am I missing? How can I improve my workflow for this?

  • You're setting the breakpoint on the pointer to GetProcAddress, not the function itself. In your case, IDA seems not to have recognized the GetProcAddress function itself, and named it unk_7577126E. Set your breakpoint there. – Guntram Blohm Apr 11 '15 at 22:44
  • I agree @GuntramBlohm. Perhaps a better question would be: Why doesn't IDA properly identify GetProcAddress and instead calls it unk_757126E? – Float Apr 12 '15 at 3:35
  • @Float that is indeed a completely different question. One answer could be that the name "GetProcAddress" is already taken". – NirIzr Sep 2 '16 at 20:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.