View Full Version : searching for a script/method to change cpuid results with ida pro (while debugging)
joblack
December 18th, 2010, 21:31
I'm searching for a way to change cpuid results (e.g. EAX-EDX) when debugging a program. Any idea how to do that?
Indy
December 19th, 2010, 02:41
Set the break in the instructions, or to change it, or emulate during the tracing.
joblack
December 19th, 2010, 03:07
Quote:
[Originally Posted by Indy;88628]Set the break in the instructions, or to change it, or emulate during the tracing. |
Of course I can set a breakpoint but then I have to change it manually every time it hits it. I need a short script which does something like
if (ASM == 'cpuid' AND EAX == 1): EAX = 0xffffffff, EBX = 0x ..., EDX = 0xabababab
which will be executed right after the cpuid command.
sikke
December 19th, 2010, 16:57
Quote:
[Originally Posted by joblack;88631]Of course I can set a breakpoint but then I have to change it manually every time it hits it. I need a short script which does something like
if (ASM == 'cpuid' AND EAX == 1): EAX = 0xffffffff, EBX = 0x ..., EDX = 0xabababab
which will be executed right after the cpuid command. |
You could use WinDbg with IDA, where you coud use BP with a non-empty "CMDSTRING"
or BM (for patterns, with wildcards). See http://windbg.info/download/doc/pdf/WinDbg_cmds.pdf ("http://windbg.info/download/doc/pdf/WinDbg_cmds.pdf") for more documentation.
I quite like WinDbg (way better than the built-in debugger IMHO) and it does a lot of the stuff I used SoftIce for in the old days, like doing commands at every break point...
Eibon
January 19th, 2011, 09:19
Im not sure I entirely get it, but if you know your location of a cpuid, then a conditional BP in IDA could the trick.
BP on your cpuid or just after, with a condition something like this:
(eax == 1) & eax=0xffffffff & ebx=0xBAADF00D & ecx=0xabababab & edx=0xDEADBEEF
What this does, is everytime it breaks at your cpuid BP and eax == 1, then it sets eax-edx to whatever value you want.
Powered by vBulletin® Version 4.2.2 Copyright © 2018 vBulletin Solutions, Inc. All rights reserved.