![]() |
#1
|
|||
|
|||
Windows debugger that can run code on breakpoint?
Is there a Windows debugger where I can set a breakpoint on a specific instruction (in a binary that I have been reverse engineering with IDA in this case) and then instead of stopping and waiting for user action, run some code that can access the current registers and memory of the process (and do some things with the results like writing some things to a log) before letting the program continue to run?
The binary is a 32-bit x86 binary and I want to do this break-then-log-stuff-then-continue in a few different places. |
#2
|
|||
|
|||
Ollydbg conditional log breakpoint
http://www.ollydbg.de/Help/Condlogbreakpoint.htm |
#3
|
|||
|
|||
Is this what you are referring to?
https://help.x64dbg.com/en/latest/introduction/ConditionalTracing.html https://help.x64dbg.com/en/latest/commands/conditional-breakpoint-control/SetBreakpointLogCondition.html Last edited by Stingered; 10-13-2021 at 23:46. |
The Following User Says Thank You to Stingered For This Useful Post: | ||
niculaita (01-18-2022) |
#4
|
|||
|
|||
WinDbg has "debugger command programs" https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/debugger-command-program-examples and allows such macros. Not sure if they can be triggered on breakpoints but it should be possible. Ollydbg and x64dbg I reckon are just as capable of being scripted.
|
The Following User Says Thank You to chants For This Useful Post: | ||
niculaita (01-17-2022) |
#5
|
|||
|
|||
I think you might find WinDBG's javascript debugger scripting useful. You can have a script trigger upon a breakpoint, do whatever you need to do (log data, modify values, etc), and the script can then decide whether or not to continue running the app based on whatever logic you provide it. You can find the documentation for it here:
https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/javascript-debugger-scripting |
The Following User Says Thank You to lahma For This Useful Post: | ||
niculaita (01-17-2022) |
![]() |
Thread Tools | |
Display Modes | |
|
|
![]() |
||||
Thread | Thread Starter | Forum | Replies | Last Post |
Whether IDA can set memory breakpoint when use Remote Linux debugger? | bridgeic | General Discussion | 7 | 09-10-2014 18:07 |
(Q) .NET App Source Code Protection (Silverlight, Windows Phone, Windows 8) | delidolunet | General Discussion | 7 | 08-02-2013 10:33 |