I'm looking for a means to log EIP of a process while it is within a certain memory range. I've dabbled a little bit in x64dbg's logging functionality, but was unsuccessful in getting a memory range conditional working.

Open to ideas.

1 Answer 1


I have one solution after mucking around for a while, I'm sure I can find something better, in the meantime however here you go.

Using the 'Memory Map' Tab you can create a memory breakpoint on code sections

Right click on a section->Memory Breakpoint->Execute->Restore

Then you can edit the breakpoint condition to be something like this (I am using a 64 bit process)

Editing memory execute breakpoints to log EIP/RIP

I just figured out how to reduce the range of this.

You can use Log Condition like this:

00007FF6D2F71000 < rip < 00007FF6D2F72000

which is symbolically

start_address < eip < end_address


start_address < rip < end_address

It works pretty well. I'll update if I find any better alternatives


https://x64dbg.readthedocs.io/en/latest/introduction/Expression-functions.html https://x64dbg.readthedocs.io/en/latest/introduction/Expressions.html

Read some of the docs for the cool stuff you can do

I managed to get it to log only call instructions, and print the address and instruction using

dis.iscall(rip) in Break Condition and

{rip}:{i:rip} in Log Expression

Thanks for asking this question, this is actually really useful stuff I never thought of before.

  • 1
    That's exactly what I wanted. Thanks for the help!
    – Mudsy
    Commented Nov 3, 2017 at 14:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.