5

Right now I'm trying to place a trace point and hook it with the Python code that pulls all relevant stuff from the stack. Unfortunately it just gives me the garbage all the time, because the value in cpu.esp is being updated after this code is getting executed, while I need it to happen before.

class TraceRegisters(DBG_Hooks):
    def dbg_bpt(self, tid, ea):
        fn = GetFunctionName(ea)
        if fn.startswith("Read"):
            print "%s(0x%x)" % (fn, Dword(cpu.esp+4))
        elif fn.startswith("Write"):
            print "%s(0x%x, 0x%x)" % (fn, Dword(cpu.esp+4), Dword(cpu.esp+8))
        return 0

I'm feeling sorry for doing it in a callback that is intended for deciding if the debugger should stop, but I just couldn't find anything better.

Is there a way to do what I want with just the power of IDAPython and/or plain IDA?

Improve this question
6
  • If the instruction where you place your trace point is a call, just subtract 4 from each of your esp offsets, since the call will subtract 4 from esp. Likewise, if your trace point is on a ret, add 4 to each offset. And if it's anything else, put your trace point at the next instruction.
    – Guntram Blohm
    Commented May 30, 2015 at 16:07
  • The problem is that the value contained in cpu.esp is absolutely garbage. That's because this callback runs before IDA pro actually breaks, while I'd love it to run after.
    – vdudouyt
    Commented May 31, 2015 at 3:58
  • By the way, I managed to overcome this problem by attaching this callback to a hotkey in debugger. So that it stops on a breakpoint first, then I press F12, and then it logs this message and continues forward. And - voila! - it's working fine. The only problem is that now I have to tap this hotkey like crazy.
    – vdudouyt
    Commented May 31, 2015 at 4:00
  • 1
    I'm very astonished to read that the CPU registers doesn't seem to be updated when the breakpoint condition runs. This is against all my experience, and Hex-Rays explicitly mentions evaluating register variables in a breakpoint condition. Maybe it's a python problem, did you try idc directly? What happens if you print cpu.esp in your function, then compare it with what IDA shows in the breakpoint? Oh, and maybe you need to call RefreshDebuggerMemory if the memory configuration has changed.
    – Guntram Blohm
    Commented May 31, 2015 at 17:48
  • Had the exact same problem, RefreshDebuggerMemory at the top of the callback does indeed resolve the issue.
    – javs
    Commented Jan 19, 2018 at 0:14

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.