Right now I'm trying to place a trace point and hook it with the Python code that pulls all relevant stuff from the stack. Unfortunately it just gives me the garbage all the time, because the value in cpu.esp is being updated after this code is getting executed, while I need it to happen before.
class TraceRegisters(DBG_Hooks): def dbg_bpt(self, tid, ea): fn = GetFunctionName(ea) if fn.startswith("Read"): print "%s(0x%x)" % (fn, Dword(cpu.esp+4)) elif fn.startswith("Write"): print "%s(0x%x, 0x%x)" % (fn, Dword(cpu.esp+4), Dword(cpu.esp+8)) return 0
I'm feeling sorry for doing it in a callback that is intended for deciding if the debugger should stop, but I just couldn't find anything better.
Is there a way to do what I want with just the power of IDAPython and/or plain IDA?