7

Let's say I have lots of breakpoints at some push instructions. I am trying to dereference the operand (if address) - get the actual relevant value for each one in a script, handling immediate, base + index, register, etc. Can I do this in any other way than:

  1. Read it with ESP after Step Into (executing the instruction at breakpoint) (DbgRead() of IDC, idaapi.dbg_read_memory())
  2. Read the operand and manually evaluate it in the script with respective calls to DbgRead(), GetRegValue(), etc.

This, if possible, I guess would imply a particular idaapi function.

algotroll
  • 71
  • 1

1 Answers1

1

No, you must implement the base + index * scale yourself (if on i386). On other architectures without this complexity (e.g. ARM) it is a bit easier.

If it helps any, I have already implemented this functionality in pwndbg for exactly the same purpose.

You can see the implementation here: https://github.com/zachriggle/pwndbg/blob/master/pwndbg/disasm/x86.py

Note that I am not using IDA's API, but rather pwndbg's internal API which relies on GDB. You will have to make some small changes to the way in which you fetch register and memory values from that code (e.g. pwndbg.regs.pc gives me the value of EIP or RIP as appropriate).

Zach Riggle
  • 2,337
  • 1
  • 16
  • 28
  • Getting the base, index, scale and offset values in IDA can be a bit tricky. You can use Sark to handle it (for x86 and x64). It doesn't do the actual reading of debug values, though. – tmr232 Mar 04 '16 at 21:54