breakpoint condition and string compare

[johanne...@gmail.com]

I am playing around with IDA's conditional breakpoints

I have a breakpoint at

push eax

Eax is a pointer to a string like 'C : \ P r o g r a m F i l e s'. The string has always a 00x in between the characters.

I want to use the breakpoint only if I have a specific path is matched. Does anybody have an idea how to do that?

[Elias Bachaalany]

Johannes,

Quick answer and pointers.

1. You are dealing with unicode strings

2. Look up the GetString in idc.py and ask that API to return a unicode string at an address instead of ASCII strings

3. modify your conditional BPT accordingly.

--

Elias

On Tuesday, August 22, 2017 at 9:18:40 AM UTC-7, johannes