I'm trying to set a conditional hardware breakpoint on Windows Kernel-Mode in Windbg by using the following syntax :

ba w1 ffff802312345678 "j(@rip==ffff802387654321 || @rip==ffff802387654330) 'gc';''"

I used the above command in order to ignore every access to my target location (ffff802312345678) from ffff802387654321 or ffff802387654330, so everytime access from somewhere else is taken, then I would be notified.

But the problem is, it still breaks on ffff802387654321 or ffff802387654330 among the other locations.

I also read it's official documents about "Conditional Breakpoints and Register Sign Extension" and also test something like this:

ba w1 ffff802312345678 "j((@rip & 0xffffffffffffffff)=ffff802387654321 || (@rip & 0xffffffffffffffff)=ffff802387654330) 'gc';''"

But it still won't work.

So my question is:

  • What's wrong with the above command and how can I achieve the desired result ?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.