0

How can I set a conditional breakpoint based on the argument of a function?

I am trying to break on the windows function LoadLibraryExW: https://docs.microsoft.com/en-us/windows/desktop/api/libloaderapi/nf-libloaderapi-loadlibraryexw

I want to break on this function only when the first argument (lpLibFileName) is equal to L"Test.dll". When I break on the function I can see that L"Test.dll" is esp+4.

I've tried a few different variations without success. They either break on every LoadLibraryExW calls or none. Variations like:

Break Condiditon: [esp+4]==L"Test.dll"
Break Condition: esp+4==L"Test.dll"
etc..

What is the proper way of setting a conditional breakpoint based on function arguments? Or register offsets?

  • In this specific case you can just set a DLL breakpoint for “Test.dll” – mrexodia Jan 18 at 15:15
  • Thanks for that. Will keep this open as I'm still interested in the answer – user3238415 Jan 18 at 21:14
0

As commented by @mrexodia you can set a DLL breakpoint

Typ Address  Module/La State   Disassembly H Summa
DLL                               
    76850000 gdi32.dll Enabled  0 all()

Go to breakpoint window (alt+b) -> Right Click Add Dll BreakPoint

Type test.dll

This will break when test.dll is loaded

String compare as such isn't yet implemented. A bug report exists from 2017 and a workaround exists which states using a third party plugin
which you can check out.

Or simply split the string into bytes and compare the bytes like

Type     Address  Module/Label/Exception     State   Disassembly H Summary                                                                                         
Software                                                           
         76ACE8A5 <kernel32.dll.CreateFileW> Enabled mov edi,edi 5 breakif((1:[[esp+4]+0xc] == 66) &&  (1:[[esp+4]+0xe] == 69)), log("brk hit   { 1:[[esp+4]+c] }")

enter image description here

x64dbg has broken when file testmefive.txt was opened for source code below with above byte compare method

#include <stdio.h>

int main(void)
{
    char *filenames[] = {
        "testmeone.txt",
        "testmetwo.txt",
        "testmethree.txt",
        "testmefour.txt",
        "testmefive.txt"};
    for (int i = 0; i < 5; i++)
    {
        FILE *fp = NULL;
        errno_t err = fopen_s(&fp, filenames[i], "r");
        if (err == 0 && fp != 0)
        {
            char buff[0x50] = {0};
            fread_s(buff, 0x50, 1, 0x50, fp);
            printf("%s\n", buff);
            fclose(fp);
        }
    }
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.