debugging - IDA Python - Why My code return incorrect ESP Value? -


i made ida python code checking code coverage. when used script, got runtime error , not correct esp value.

-my code-

from idaapi import * class dbghook(dbg_hooks):     def dbg_process_exit(self, pid, tid, ea, code):         # bpt del         fun in functions(segstart(screenea()),segend(screenea())):             delbpt(fun)         return         debugger.unhook()      def dbg_bpt(self, tid, ea):         refcode = get_long(getregvalue('esp'))         print "[*] hit : 0x%08x - %s" % (ea , getfunctionname(ea))         print " getregvalue : compare ret : 0x%08x" % refcode         return 1  fun in functions(segstart(screenea()),segend(screenea())):     fnname = getfunctionname(fun)     addbpt(fun)     setbptattr(fun, bptattr_flags, (getbptattr(fun, bptattr_flags) & ~bpt_brk ));  debugger = dbghook() debugger.unhook() debugger.hook()  num_bp = getbptqty() print "[*] set %d breakpoints " % num_bp 

and got error

[*] set 153 breakpoints  cannot find sync source "view:ida view-a"; ignoring group 400000: process c:\temp\nc.exe has started (pid=6336) 773c0000: loaded c:\windows\system32\ntdll.dll unloaded  unloaded  unloaded  unloaded  76050000: loaded c:\windows\syswow64\kernel32.dll 76550000: loaded c:\windows\syswow64\kernelbase.dll 76360000: loaded c:\windows\syswow64\msvcrt.dll 77409fa0: thread has started (tid=11496) 77409fa0: thread has started (tid=10228) 74010000: loaded c:\windows\syswow64\wsock32.dll 76130000: loaded c:\windows\syswow64\ws2_32.dll 762b0000: loaded c:\windows\syswow64\sechost.dll 75fa0000: loaded c:\windows\syswow64\rpcrt4.dll 740f0000: loaded c:\windows\syswow64\sspicli.dll 740e0000: loaded c:\windows\syswow64\cryptbase.dll 770b0000: loaded c:\windows\syswow64\bcryptprimitives.dll 77409fa0: thread has started (tid=9556) [*] hit : 0x004057f0 - tlscallback_0  getregvalue : compare ret : 0x77436aae [*] hit : 0x00405eb0 - sub_405eb0  getregvalue : compare ret : 0x00000000 [*] hit : 0x004061e8 - initializecriticalsection  getregvalue : compare ret : 0x00000000 exception in dbg hook function: swig director method error. error detected when calling 'dbg_hooks.dbg_bpt' traceback (most recent call last):   file "c:/users/jm/documents/makecode/ida-python/tutorial/code_cover.py", line 18, in dbg_bpt     refcode = get_long(getregvalue('esp')) stopiteration exception in dbg hook function: swig director method error. error detected when calling 'dbg_hooks.dbg_bpt' traceback (most recent call last):   file "c:/users/jm/documents/makecode/ida-python/tutorial/code_cover.py", line 18, in dbg_bpt     refcode = get_long(getregvalue('esp')) stopiteration [*] hit : 0x00401020 - sub_401020  getregvalue : compare ret : 0x00401178 [*] hit : 0x004057f0 - tlscallback_0  getregvalue : compare ret : 0x00401160 [*] hit : 0x00405620 - setunhandledexceptionfilter  getregvalue : compare ret : 0x00401160 [*] hit : 0x00405980 - sub_405980  getregvalue : compare ret : 0x00401160 [*] hit : 0x00405e10 - sub_405e10  getregvalue : compare ret : 0x00401160 [*] hit : 0x00406088 - __getmainargs  getregvalue : compare ret : 0x00401160 [*] hit : 0x00406090 - __p__fmode  getregvalue : compare ret : 0x00401160 [*] hit : 0x00405ba0 - sub_405ba0  getregvalue : compare ret : 0x00401160 [*] hit : 0x00405df0 - sub_405df0  getregvalue : compare ret : 0x9b3e0acd [*] hit : 0x00405d90 - sub_405d90  getregvalue : compare ret : 0x9b3e0acd exception in dbg hook function: swig director method error. error detected when calling 'dbg_hooks.dbg_bpt' traceback (most recent call last):   file "c:/users/jm/documents/makecode/ida-python/tutorial/code_cover.py", line 18, in dbg_bpt     refcode = get_long(getregvalue('esp')) stopiteration [*] hit : 0x00401300 - sub_401300  getregvalue : compare ret : 0x00000000 

when manually checked esp @ 0x00401300, see 0x0040620b value. code, there incorrect esp value 0x00000000 @ 0x00401300.

how fix it?

since op did not provide answer, i'll give shot

ida maintains it's own copy / representation of analyzed file in it's idb file format (and uncompressed files while active). files contain every byte in executable default, , contain bytes in allocated memory regions while debugging. similar thing happens registers.

ida not (and cannot) update state of memory , registers while executable running , periodically. assist that, function refreshdebuggermemory() force ida refresh memory (and register) state.


Comments