Log in

View Full Version : searching for a script/method to change cpuid results with ida pro (while debugging)


joblack
December 18th, 2010, 21:31
I'm searching for a way to change cpuid results (e.g. EAX-EDX) when debugging a program. Any idea how to do that?

Indy
December 19th, 2010, 02:41
Set the break in the instructions, or to change it, or emulate during the tracing.

joblack
December 19th, 2010, 03:07
Quote:
[Originally Posted by Indy;88628]Set the break in the instructions, or to change it, or emulate during the tracing.


Of course I can set a breakpoint but then I have to change it manually every time it hits it. I need a short script which does something like

if (ASM == 'cpuid' AND EAX == 1): EAX = 0xffffffff, EBX = 0x ..., EDX = 0xabababab

which will be executed right after the cpuid command.

sikke
December 19th, 2010, 16:57
Quote:
[Originally Posted by joblack;88631]Of course I can set a breakpoint but then I have to change it manually every time it hits it. I need a short script which does something like

if (ASM == 'cpuid' AND EAX == 1): EAX = 0xffffffff, EBX = 0x ..., EDX = 0xabababab

which will be executed right after the cpuid command.


You could use WinDbg with IDA, where you coud use BP with a non-empty "CMDSTRING"
or BM (for patterns, with wildcards). See http://windbg.info/download/doc/pdf/WinDbg_cmds.pdf ("http://windbg.info/download/doc/pdf/WinDbg_cmds.pdf") for more documentation.
I quite like WinDbg (way better than the built-in debugger IMHO) and it does a lot of the stuff I used SoftIce for in the old days, like doing commands at every break point...

Eibon
January 19th, 2011, 09:19
Im not sure I entirely get it, but if you know your location of a cpuid, then a conditional BP in IDA could the trick.

BP on your cpuid or just after, with a condition something like this:

(eax == 1) & eax=0xffffffff & ebx=0xBAADF00D & ecx=0xabababab & edx=0xDEADBEEF

What this does, is everytime it breaks at your cpuid BP and eax == 1, then it sets eax-edx to whatever value you want.