In WinDbg, how do I set a conditional breakpoint for checking a particular value contained in an address behind a register?

user_1452175 0
Viewed 198

I want to do something like break at Process!Function+0x66 but only if [RDX + 0x01c] == 1. What would the syntax of breakpoint like this be?

windbg
1 Answers

evaluate with ? Process!Function+0x66

copy the result for using in breakpoint 0x12345678`90abcdef

bp 0x12345678`90abcdef ".if ( poi(@rdx+0x1c) != 1) {gc}"

a sample flow

0:000> ? msvcrt!memcpy+0x40
Evaluate expression: 140735863146304 = 00007fff`9f214740

0:000> u msvcrt!memcpy+0x40 l1
msvcrt!memcpy+0x40:
00007fff`9f214740 8a0411          mov     al,byte ptr [rcx+rdx]

0:000> bp 00007fff`9f214740 " .if( poi(@rcx+@rdx) != 0x20) {gc}"

0:000> bl 0 e 00007fff`9f214740 0001 (0001) msvcrt!memcpy+0x40 ".if( poi(@rcx+@rdx) != 0x20) {gc}"
0:000> g

Microsoft (R) Windows Debugger Version 10.0.17763.132 AMD64

msvcrt!memcpy+0x40:
00007fff`9f214740 8a0411          mov     al,byte ptr [rcx+rdx] ds:000001d6`1ebc6ac1=20

0:000> .lastevent
Last event: 724.1718: Hit breakpoint 0
  debugger time: Wed Jun 16 00:25:26.965 2021 
  
0:000> g
msvcrt!memcpy+0x40:
00007fff`9f214740 8a0411          mov     al,byte ptr [rcx+rdx] ds:000001d6`20407c4a=20

0:000> .lastevent
Last event: 724.1718: Hit breakpoint 0
  debugger time: Wed Jun 16 00:25:45.283 2021 
0:000>
user_36228130
Related