Question

我制作了一个用于检查代码覆盖率的ida python代码。但是当我使用这个脚本时，我遇到了运行时错误，我无法获得正确的ESP值。

- 我的代码 -

from idaapi import *
class DbgHook(DBG_Hooks):
    def dbg_process_exit(self, pid, tid, ea, code):
        # bpt Del
        for fun in Functions(SegStart(ScreenEA()),SegEnd(ScreenEA())):
            DelBpt(fun)
        return
        debugger.unhook()

    def dbg_bpt(self, tid, ea):
        RefCode = get_long(GetRegValue('esp'))
        print "[*] Hit : 0x%08x - %s" % (ea , GetFunctionName(ea))
        print " GetRegValue : compare RET : 0x%08x" % RefCode
        return 1

for fun in Functions(SegStart(ScreenEA()),SegEnd(ScreenEA())):
    fnName = GetFunctionName(fun)
    AddBpt(fun)
    SetBptAttr(fun, BPTATTR_FLAGS, (GetBptAttr(fun, BPTATTR_FLAGS) & ~BPT_BRK ));

debugger = DbgHook()
debugger.unhook()
debugger.hook()

num_bp = GetBptQty()
print "[*] Set %d breakpoints " % num_bp

我收到了错误

[*] Set 153 breakpoints 
Cannot find sync source "view:IDA View-A"; ignoring group
400000: process C:\temp\nc.exe has started (pid=6336)
773C0000: loaded C:\WINDOWS\system32\ntdll.dll
Unloaded 
Unloaded 
Unloaded 
Unloaded 
76050000: loaded C:\WINDOWS\SysWOW64\kernel32.dll
76550000: loaded C:\WINDOWS\SysWOW64\KernelBase.dll
76360000: loaded C:\WINDOWS\SysWOW64\msvcrt.dll
77409FA0: thread has started (tid=11496)
77409FA0: thread has started (tid=10228)
74010000: loaded C:\WINDOWS\SysWOW64\wsock32.dll
76130000: loaded C:\WINDOWS\SysWOW64\ws2_32.dll
762B0000: loaded C:\WINDOWS\SysWOW64\sechost.dll
75FA0000: loaded C:\WINDOWS\SysWOW64\rpcrt4.dll
740F0000: loaded C:\WINDOWS\SysWOW64\sspicli.dll
740E0000: loaded C:\WINDOWS\SysWOW64\cryptbase.dll
770B0000: loaded C:\WINDOWS\SysWOW64\bcryptprimitives.dll
77409FA0: thread has started (tid=9556)
[*] Hit : 0x004057f0 - TlsCallback_0
 GetRegValue : compare RET : 0x77436aae
[*] Hit : 0x00405eb0 - sub_405EB0
 GetRegValue : compare RET : 0x00000000
[*] Hit : 0x004061e8 - InitializeCriticalSection
 GetRegValue : compare RET : 0x00000000
Exception in DBG Hook function: SWIG director method error. Error detected when calling 'DBG_Hooks.dbg_bpt'
Traceback (most recent call last):
  File "C:/Users/jm/Documents/MakeCode/ida-python/tutorial/Code_Cover.py", line 18, in dbg_bpt
    RefCode = get_long(GetRegValue('esp'))
StopIteration
Exception in DBG Hook function: SWIG director method error. Error detected when calling 'DBG_Hooks.dbg_bpt'
Traceback (most recent call last):
  File "C:/Users/jm/Documents/MakeCode/ida-python/tutorial/Code_Cover.py", line 18, in dbg_bpt
    RefCode = get_long(GetRegValue('esp'))
StopIteration
[*] Hit : 0x00401020 - sub_401020
 GetRegValue : compare RET : 0x00401178
[*] Hit : 0x004057f0 - TlsCallback_0
 GetRegValue : compare RET : 0x00401160
[*] Hit : 0x00405620 - SetUnhandledExceptionFilter
 GetRegValue : compare RET : 0x00401160
[*] Hit : 0x00405980 - sub_405980
 GetRegValue : compare RET : 0x00401160
[*] Hit : 0x00405e10 - sub_405E10
 GetRegValue : compare RET : 0x00401160
[*] Hit : 0x00406088 - __getmainargs
 GetRegValue : compare RET : 0x00401160
[*] Hit : 0x00406090 - __p__fmode
 GetRegValue : compare RET : 0x00401160
[*] Hit : 0x00405ba0 - sub_405BA0
 GetRegValue : compare RET : 0x00401160
[*] Hit : 0x00405df0 - sub_405DF0
 GetRegValue : compare RET : 0x9b3e0acd
[*] Hit : 0x00405d90 - sub_405D90
 GetRegValue : compare RET : 0x9b3e0acd
Exception in DBG Hook function: SWIG director method error. Error detected when calling 'DBG_Hooks.dbg_bpt'
Traceback (most recent call last):
  File "C:/Users/jm/Documents/MakeCode/ida-python/tutorial/Code_Cover.py", line 18, in dbg_bpt
    RefCode = get_long(GetRegValue('esp'))
StopIteration
[*] Hit : 0x00401300 - sub_401300
 GetRegValue : compare RET : 0x00000000

当我在0x00401300手动检查ESP时，我可以看到0x0040620b的值。但是使用我的代码，在0x00401300处有一个不正确的ESP值0x00000000。

我该如何解决？

Answer 1

由于OP没有提供答案，我会试一试

IDA以其IDB文件格式（以及处于活动状态的未压缩文件）维护它自己的分析文件的副本/表示。这些文件默认包含可执行文件中的每个字节，并且在调试时将包含大多数已分配内存区域中的大多数字节。寄存器也会发生类似的情况。

在可执行文件运行时，IDA不会（也不能）不断更新内存和寄存器的状态，并且只会定期更新。为了帮助解决这个问题，函数RefreshDebuggerMemory()将强制IDA刷新内存（和注册）状态。

IDA Python - 为什么我的代码返回错误的ESP值？

1 个答案: