5

How do i use IDA debugger to find some specific values in process memory, like values of float or integer, or string type?

Then how can i trace how program accesses them?

1 Answer 1

5

Question 1: You may use the Ida feature Menu Search, Sequence of Bytes...

In case you are e.g. looking for a float value, convert that float into a sequence of four bytes and let Ida search for it. The conversion can be done in Ida as well (IIRC), or in any other hex editor allowing to display different data types. Of course, if your variable is a double instead of a float you need the proper byte sequence for a double which is different. When searching for a string, you may use the same method. Of course here also you must know e.g. whether you are looking for an ascii string or another kind of string like unicode. With that method, the endian-ness must be observed, because the byte sequence may be different with Big-Endian or Little-Endian.

Question 2:

In case you found your memory address, put a breakpoint on it. In a memory region, a window opens where you may edit your breakpoint, e.g. select break or trace, as well as the condition when to break and other items. A breakpoint in a code region may be edited by first putting the breakpoint on the location with F2, and then selecting "Edit Breakpoint" with a right mouse click.

1
  • Thank you! Isn't there any plugin or etc to add friendly UI for automatically converting floats or strings to hex sequence?
    – Croll
    Commented Jul 14, 2015 at 8:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.