def addTracebp(self, ea=None):
if ea is None:
ea = idc.get_screen_ea()
rea = ea - self.offset
self.tracebp.add(rea)
if not idc.add_bpt(ea):
idc.enable_bpt(ea, True)
def bp_enable(self, enable, tracebp=True):
bplist = self.tracebp if tracebp else self.userbp
for ea in bplist:
try:
idc.enable_bpt(ea + self.offset, enable)
except Exception as e:
print(e)
self.userbp.remove(ea)
def delfuncbps(self, funcbps):
ea = funcbps.ea
bplist = self.bplist
funcbps = bplist.get(ea)
if funcbps:
for offset, _ in funcbps.bps.items():
idc.enable_bpt(offset + funcbps.addr, False)
del bplist[ea]
return True
return False
def addbp2(self, ea=None):
if ea is None:
ea = idc.get_screen_ea()
func = idaapi.get_func(ea)
start_ea = func.start_ea
bps = self.get_bp2(start_ea)
if bps.add(ea):
if not idc.add_bpt(ea):
idc.enable_bpt(ea, True)
return bps
else:
return False
def addbp(self, instr, ea=None):
if ea is None:
ea = idc.get_screen_ea()
func = idaapi.get_func(ea)
start_ea = func.start_ea
instrtable = self.get_func_instr(startEA)
l = instrtable.get(instr)
if l:
for disa in l:
pos = disa.offset + start_ea
if not idc.add_bpt(pos):
idc.enable_bpt(pos, True)
def delbp2(self, ea, offset, vea=None):
funcbps = self.get_bp2(ea, True)
if funcbps:
varlist = funcbps.bps.get(offset)
if varlist is None:
return False
if vea:
if vea in varlist:
del varlist[vea]
if len(varlist) == 0:
idc.enable_bpt(ea + offset, False)
return True
else:
idc.enable_bpt(ea + offset, False)
del funcbps.bps[offset]
return True
return False
def bp_recover(self, remove=True, suffix=""):
bplist = DbgInfo.config_load("breakpoints" + suffix, list)
if not bplist:
return False
if remove:
nbp = idc.get_bpt_qty()
bps = []
for i in range(nbp):
bp = idc.get_bpt_ea(i)
bps.append(bp)
for bp in bps:
idc.del_bpt(bp)
for bp in bplist:
ea = bp[0]
addr = ea + self.offset
idc.add_bpt(addr)
idc.enable_bpt(addr, bp[1])
return True
def break_switch(self):
_watch_debug()
bptree = self.bptree
for item in bptree.selectedItems():
parent = item.parent()
if parent:
if hasattr(parent, "bps"):
funcbps = parent.bps
bp = funcbps.addr + item.offset
state = idc.check_bpt(bp)
if state == 1 or state == 0:
idc.enable_bpt(bp, 1 - state)
else:
continue
else:
funcbps = item.bps
addr = funcbps.addr
for offset, _ in funcbps.bps.items():
bpea = offset + addr
state = idc.check_bpt(bpea)
if state != -1:
idc.enable_bpt(bpea, 1 - state)
def add_func(self):
_var_debug()
funcname = self.funcinput.text().encode('utf-8').strip()
if funcname:
afn = idc.get_name_ea_simple(funcname) # LocByName
if afn & 1:
self.funcinput.setText(funcname + " is not a function")
return False
else:
ea = idc.get_screen_ea()
func = idaapi.get_func(ea)
if not func:
return False
afn = func.start_ea
dbginfo = self.dbginfo
arg = dbginfo.append_func_watch(afn)
if not idc.add_bpt(afn):
idc.enable_bpt(afn, True)
# dbginfo.addbp("RET", afn)
if arg:
self.argtree_append(arg)
return True
return False
def addcallinfo(self, called, caller, tid=0):
offcaller = idc.get_func_off_str(caller)
ecalled = called - self.offset
calledinfo = self.get_callinfo(ecalled, tid)
if not offcaller:
calledinfo.ncalled += 1
return False
ecaller = caller - self.offset
l = offcaller.split("+")
if len(l) > 1:
eafn = ecaller - int(l[1], 16)
else:
eafn = ecaller
callerinfo = self.get_callinfo(eafn, tid)
callerinfo.addcall(ecalled, ecaller)
if calledinfo.addcalled(ecaller):
common.common_cmt(called, calledinfo.calledlist.keys(),
"called by: ", self.offset, False)
bpea = eafn + self.offset
if self.enabletrace:
if not idc.add_bpt(bpea):
idc.enable_bpt(bpea, True)
return True
def __call__(self):
try:
if self.hardware:
bp_flag = idc.BPT_EXEC # default is hardware https://www.hex-rays.com/products/ida/support/sdkdoc/group___b_p_t___h.html
else:
bp_flag = (idc.BPT_SOFT | idc.BPT_EXEC)
idc.add_bpt(self.address, bp_flag)
enable_res = idc.enable_bpt(self.address, True)
l.debug("bp flag value %x enable_res %s" % (bp_flag, enable_res))
self.result = enable_res
except Exception as e:
l.debug("set_breakpoint exception %s" % (e))
self.exception = True
def set_watchpoint(self, address, *args, **kwargs):
"""Inserts a watchpoint which is triggered when a read or a write is executed on address
:param address: The name of a variable or an address to watch
:param bool temporary: Temporary breakpoint
:returns: True on success else False
"""
idc.add_bpt(address)
bp_flag = idc.BPT_RDWR # BPT_RDWR = 3 https://www.hex-rays.com/products/ida/support/sdkdoc/group___b_p_t___h.html setting Read Write breakpoint because some debuggers (Linux local) doesn't support
l.debug("ida target set_watchpoing at %x value" % (address))
idc.set_bpt_attr(address, idc.BPTATTR_SIZE, 1)
attr_res = idc.set_bpt_attr(address, idc.BPTATTR_TYPE, bp_flag)
enable_res = idc.enable_bpt(address, True)
l.debug("bp flag value %x attr_res %s enable_res %s" %
(bp_flag, attr_res, enable_res))
return attr_res and enable_res # return False if enable or setting attributes fails
#!/usr/bin/python
import idc
import idautils
func_list = [
"kernelbase_VirtualAlloc",
"kernelbase_VirtualProtect",
"kernel32_CreateThread",
"kernelbase_CreateProcessA",
"kernelbase_CreateProcessInternalA"
"kernelbase_CreateProcessW",
"kernelbase_CreateProcessAsUserW",
"kernel32_FindResourceA",
"kernelbase_LoadResource",
]
if __name__ == "__main__":
for func in func_list:
func_addr = idc.LocByName(func)
print "Set BreakPoint: %X, %s" % (func_addr, func)
idc.add_bpt(func_addr, 0, BPT_SOFT)
idc.enable_bpt(func_addr, True)