I found a breakpoint in OllyDbg that works for my purposes. But now I want to use WinDbg for scripting and when I try to set the same breakpoint, I get no breaks.
In OllyDbg, the following breakpoint gets me exactly what I want:
Address=75B0C4FA | Module=KERNELBA | Active=Always | Disassembly=CMP EAX,103
But when I try to set a breakpoint in WinDbg , it never comes back with anything:
bp 75b0c4fa
According to the MS Dev Center documentation for the bp
command, I should be able to reference addresses specifically, but in my searching, most people are using bp
to reference API calls, such as bp ReadFile
(which does break as expected).
My questions: is it possible to use the breakpoint (75B0C4FA) using WinDbg?
And if so, what am I missing in terms of adapting the address I have to make it work in Windbg?
Does it have to do with bp ReadFile
accessing the ReadFile API calls for the main process, while with my breakpoint, it is trying to put breaks into sub module?