行业解决方案查看所有行业解决方案
IDA 用于解决软件行业的关键问题。
发布时间:2023-05-29 13: 36: 30
You can use the"Condition"field of the breakpoint properties to enter an expression which is evaluated when the breakpoint is hit.It can be either an actual condition or just any valid code in IDC or another supported scripting language syntax.By using the"..."button,you can open a multi-line editor for the condtition and switch the scripting language used for evaluating it.
Expressions
If you enter an expression,the result will be used to determine whether
the selected actions are exectuted.Some examples of IDC expressions:
Check if EAX is equal to 5:
EAX==5
Check if the first argument to the function is 1:
get_wide_dword(ESP)==1
Interpret the second argument to the function as a pointer to Unicode string,print it,
and return 0(so that the execution continues immediately):
msg("Filename:%s\n",get_strlit_contents(get_wide_dword(ESP+4),-1,STRTYPE_UNICODE)),0
Set EAX to 0 and continue:
EAX=0,0
Statements
You can enter several statements in the multi-line editor.If the last one is a'return'statement,
it is used as the result of the condition.Otherwise the condition is assumed to return 0.
See also Breakpoints list
Edit breakpoint
Breakpoints submenu
Index of IDC functions
中文翻译:
您可以使用断点属性的条件字段输入命中断点时计算的表达式。它可以是实际情况或IDC中的任何有效代码或其他支持的脚本语言语法。通过使用...按钮,您条件打开多行编辑器并切换脚本语言用于评估它。
表达式
如果输入表达式,结果将用于确定是否
选定的动作被执行。IDC表达式的一些示例:
检查EAX是否等于5:
EAX==5
检查函数的第一个参数是否为1:
get_wide_ dword(ESP)==1
将函数的第二个参数解释为指向Unicode字符串的指针,打印它,并返回0(以便立即继续执行):
msg(文件名:%s\n,get_strlit_contents(get_wide_dword(ESP+4),-1,STRTYPE_UNICODE),0
将EAX设置为0并继续:
EAX=0,0
报表
您可以在多行编辑器中输入多个语句。如果最后一个是“return”语句,
它用作条件的结果。否则假定条件返回0。
另见断点列表
编辑断点
断点子菜单
IDC功能索引
展开阅读全文
︾