Windbg Break Points

Question

I need to set a break point when a specific module address space is being overwritten? I need to specify this by module name not address space

Answer 1

i cant understand what your usecase is assuming you have some code like this running and you want to break when some thing is written to some space you can use ba (hardware assisted breakpoint )

code for demo it writes randomly the @ sign in a space of 0x2000 bytes

#include <stdio.h>
#include <stdlib.h>
#include <time.h>
char randritebuff[0x2000];
int main (void) {
    srand( (unsigned int)time(nullptr));
    for(;;) {
    int writeaddr = ((rand() % 0x1fff)+1);
    randritebuff[writeaddr] = 0x40;
    }
}

assuming you are interested in seeing only when it writes at the 1337th
byte from the start of buffer

you can employ a breakpoint with module names as well as symbols for the buffer if they are available in windbg like this

00eb102e c682d198ef0040  mov byte ptr randrite!randritebuff+0x1 (00ef98d1)[edx],40h ds:0023:00efacd9=00

0:000> ba w1 randrite!randritebuff+0x1337  <<<<<<<<<<<<<<<<<<<<<< 
0:000> bl
     0 e Disable Clear  00efac07 w 1 0001 (0001)  0:**** randrite!randritebuff+0x1337

0:000> ? randrite!randritebuff
Evaluate expression: 15702224 = 00ef98d0

0:000> ? 00ef98d0+1337
Evaluate expression: 15707143 = 00efac07

0:000> g
Breakpoint 0 hit
eax=00000003 ebx=7ffdf000 ecx=00007333 edx=00001336 << 
a hardware breakpoint break with eip @ + 1  (00eb102e + sizeof(c682d198ef0040))

00eb1035 << ebef            jmp     randrite!main+0x16 (00eb1026)

a screenshot below