在 WinDbg 中，如何设置条件断点来检查寄存器后面的地址中包含的特定值？

Question

我想在 Process!Function+0x66 处做一些类似 break 的事情，但前提是 [RDX + 0x01c] == 1。像这样的断点语法是什么？

Answer 1

用? Process!Function+0x66

评价

复制断点使用的结果0x12345678`90abcdef

bp 0x12345678`90abcdef ".if ( poi(@rdx+0x1c) != 1) {gc}"

示例流程

0:000> ? msvcrt!memcpy+0x40
Evaluate expression: 140735863146304 = 00007fff`9f214740

0:000> u msvcrt!memcpy+0x40 l1
msvcrt!memcpy+0x40:
00007fff`9f214740 8a0411          mov     al,byte ptr [rcx+rdx]

0:000> bp 00007fff`9f214740 " .if( poi(@rcx+@rdx) != 0x20) {gc}"

0:000> bl 0 e 00007fff`9f214740 0001 (0001) msvcrt!memcpy+0x40 ".if( poi(@rcx+@rdx) != 0x20) {gc}"
0:000> g

Microsoft (R) Windows Debugger Version 10.0.17763.132 AMD64

msvcrt!memcpy+0x40:
00007fff`9f214740 8a0411          mov     al,byte ptr [rcx+rdx] ds:000001d6`1ebc6ac1=20

0:000> .lastevent
Last event: 724.1718: Hit breakpoint 0
  debugger time: Wed Jun 16 00:25:26.965 2021 
  
0:000> g
msvcrt!memcpy+0x40:
00007fff`9f214740 8a0411          mov     al,byte ptr [rcx+rdx] ds:000001d6`20407c4a=20

0:000> .lastevent
Last event: 724.1718: Hit breakpoint 0
  debugger time: Wed Jun 16 00:25:45.283 2021 
0:000>

在 WinDbg 中，如何设置条件断点来检查寄存器后面的地址中包含的特定值？

In WinDbg, how do I set a conditional breakpoint for checking a particular value contained in an address behind a register?

windbg