Skip to main content
4 events
when toggle format what by license comment
Apr 13, 2020 at 14:36 answer added blabb timeline score: 3
Apr 13, 2020 at 11:03 comment added eXp One way of solving this is to put two breakpoints: one at the start and second in the end of the function. ``` bp msvcrt!malloc "r $t1=@rcx; gc;" r $t0=msvcrt!malloc+cc bp @$t0 ".printf \"malloc: %p %08x\\n\",@rax,@$t1; gc" ``` This works but it certainly looses it's elegance
Apr 13, 2020 at 10:57 comment added eXp UPD: Aforementioned example is working in windbg but not in windbg preview. It may be that "gu" is not intended to be used in this case :(
Apr 13, 2020 at 10:45 history asked eXp CC BY-SA 4.0