0

Is there a way to break code execution when a register contains a particular value with x64dbg? I'm not talking about setting a conditional breakpoint at a specific location, but about watching the registers permanently and breaking as soon as the value is found. Ideally, I'd like to check the registers for string references, if possible.

If such functionality doesn't exist, I'd be willing to try and implement it myself, if you could point me in the right direction, maybe.

1

Going by the similar question for OllyDbg, it seems you should be able to achieve it by using Conditional Tracing.

The doc also mentions:

You can start a conditional tracing by “Trace over until condition”/”Trace into until condition” commands in the Debug menu.

| improve this answer | |
  • Thank you, I thought about that myself and tried to use it. However, when I start the trace, the debuggee becomes unresponsive until the trace is over. I need to interact with the ui while the trace is running, though. Any ideas? – Johannes Stricker Nov 22 '19 at 9:58
  • 1
    Tracing is very slow as it needs to stop at every instruction to check the condition. Try to limit it to the smallest piece of code you can. – Igor Skochinsky Nov 22 '19 at 10:15
  • I'll try to see if I can get anywhere with that, thank you. I suppose there isn't any other way then? Could something like that "easily" be added to x64dbg or would it be similarly slow to tracing? – Johannes Stricker Nov 23 '19 at 11:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.