TransWikia.com

Is there a way to resume execution of a process for a given amount of time then suspend it?

Reverse Engineering Asked on January 11, 2021

I am using the following IDC script in IDA:

#include <idc.idc>

static main()
{   
    for (i=0; i<10; i++)
    {                           
        PauseProcess();
        
        GetDebuggerEvent(WFNE_SUSP, -1);
        Message("%sn", GetFunctionName(ScreenEA()));
            
        ResumeProcess();    

        //Sleep(50);                      //does not work, see remarks below
        //GetDebuggerEvent(WFNE_SUSP, 1); //same
    }
}

The main idea is to pause/resume process at regular intervals and check what is the current function (for profiling purposes).

What I am searching for is a IDC function that will pause the script for a given amount of time (eg : 50ms) while the process will be still running. A function that would resume debugged process execution from a suspended state and run code for a given amount of time will be OK too.

What I have tried so far :

  • Sleep(time) : does not works as expected as it stop the execution of the debugged process as well (which is not what I want). I would like process to continue running while script is waiting.

  • GetDebuggerEvent(WFNE_SUSP, 1) : idea is wait for suspend event (which will never happen) and use timeout (set to 1 second here). It works but the issue is time is specified in seconds which is a too big interval (it would have been OK if I could specify it in milliseconds).

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP