i made ida python code checking code coverage. when used script, got runtime error , not correct esp value.
-my code-
from idaapi import * class dbghook(dbg_hooks): def dbg_process_exit(self, pid, tid, ea, code): # bpt del fun in functions(segstart(screenea()),segend(screenea())): delbpt(fun) return debugger.unhook() def dbg_bpt(self, tid, ea): refcode = get_long(getregvalue('esp')) print "[*] hit : 0x%08x - %s" % (ea , getfunctionname(ea)) print " getregvalue : compare ret : 0x%08x" % refcode return 1 fun in functions(segstart(screenea()),segend(screenea())): fnname = getfunctionname(fun) addbpt(fun) setbptattr(fun, bptattr_flags, (getbptattr(fun, bptattr_flags) & ~bpt_brk )); debugger = dbghook() debugger.unhook() debugger.hook() num_bp = getbptqty() print "[*] set %d breakpoints " % num_bp
and got error
[*] set 153 breakpoints cannot find sync source "view:ida view-a"; ignoring group 400000: process c:\temp\nc.exe has started (pid=6336) 773c0000: loaded c:\windows\system32\ntdll.dll unloaded unloaded unloaded unloaded 76050000: loaded c:\windows\syswow64\kernel32.dll 76550000: loaded c:\windows\syswow64\kernelbase.dll 76360000: loaded c:\windows\syswow64\msvcrt.dll 77409fa0: thread has started (tid=11496) 77409fa0: thread has started (tid=10228) 74010000: loaded c:\windows\syswow64\wsock32.dll 76130000: loaded c:\windows\syswow64\ws2_32.dll 762b0000: loaded c:\windows\syswow64\sechost.dll 75fa0000: loaded c:\windows\syswow64\rpcrt4.dll 740f0000: loaded c:\windows\syswow64\sspicli.dll 740e0000: loaded c:\windows\syswow64\cryptbase.dll 770b0000: loaded c:\windows\syswow64\bcryptprimitives.dll 77409fa0: thread has started (tid=9556) [*] hit : 0x004057f0 - tlscallback_0 getregvalue : compare ret : 0x77436aae [*] hit : 0x00405eb0 - sub_405eb0 getregvalue : compare ret : 0x00000000 [*] hit : 0x004061e8 - initializecriticalsection getregvalue : compare ret : 0x00000000 exception in dbg hook function: swig director method error. error detected when calling 'dbg_hooks.dbg_bpt' traceback (most recent call last): file "c:/users/jm/documents/makecode/ida-python/tutorial/code_cover.py", line 18, in dbg_bpt refcode = get_long(getregvalue('esp')) stopiteration exception in dbg hook function: swig director method error. error detected when calling 'dbg_hooks.dbg_bpt' traceback (most recent call last): file "c:/users/jm/documents/makecode/ida-python/tutorial/code_cover.py", line 18, in dbg_bpt refcode = get_long(getregvalue('esp')) stopiteration [*] hit : 0x00401020 - sub_401020 getregvalue : compare ret : 0x00401178 [*] hit : 0x004057f0 - tlscallback_0 getregvalue : compare ret : 0x00401160 [*] hit : 0x00405620 - setunhandledexceptionfilter getregvalue : compare ret : 0x00401160 [*] hit : 0x00405980 - sub_405980 getregvalue : compare ret : 0x00401160 [*] hit : 0x00405e10 - sub_405e10 getregvalue : compare ret : 0x00401160 [*] hit : 0x00406088 - __getmainargs getregvalue : compare ret : 0x00401160 [*] hit : 0x00406090 - __p__fmode getregvalue : compare ret : 0x00401160 [*] hit : 0x00405ba0 - sub_405ba0 getregvalue : compare ret : 0x00401160 [*] hit : 0x00405df0 - sub_405df0 getregvalue : compare ret : 0x9b3e0acd [*] hit : 0x00405d90 - sub_405d90 getregvalue : compare ret : 0x9b3e0acd exception in dbg hook function: swig director method error. error detected when calling 'dbg_hooks.dbg_bpt' traceback (most recent call last): file "c:/users/jm/documents/makecode/ida-python/tutorial/code_cover.py", line 18, in dbg_bpt refcode = get_long(getregvalue('esp')) stopiteration [*] hit : 0x00401300 - sub_401300 getregvalue : compare ret : 0x00000000
when manually checked esp @ 0x00401300, see 0x0040620b value. code, there incorrect esp value 0x00000000 @ 0x00401300.
how fix it?
since op did not provide answer, i'll give shot
ida maintains it's own copy / representation of analyzed file in it's idb file format (and uncompressed files while active). files contain every byte in executable default, , contain bytes in allocated memory regions while debugging. similar thing happens registers.
ida not (and cannot) update state of memory , registers while executable running , periodically. assist that, function refreshdebuggermemory()
force ida refresh memory (and register) state.
Comments
Post a Comment