Search code examples
reverse-engineeringdisassemblyida

IDAPYTHON got wrong data from memory


I wrote a script to show the second param of NtQueryInformationProcess.however,I always got wrong data,it seems like the memory wasn't freshed and what I got was old data.Here is my code:

from idaapi import *
NtQueryInformationProcess=0x7798E740
class HookNQIP(DBG_Hooks):
    def dbg_bpt(self,tid,ea):
        if ea==NtQueryInformationProcess:
            print 'ProcessInformationClass:',hex(Dword(GetRegValue('ESP')+8))
AddBpt(NtQueryInformationProcess)
func=HookNQIP()
func.hook()

IDA 6.9 on Win10-64,thx


Solution

  • It's my fault to ask this question while here is an answer: IDA Python - Why My code return incorrect ESP Value?

    So the solution is adding code RefreshDebuggerMemory() to fresh memory

    In fact I've search word 'fresh' in idapython's docs,but there is too many things on that page so I've got nothing cause I closed that page before all the things were loaded,that's really a mistake.