If I have breakpoint on some win function, how to whitelist some address on which I don't want stopping?
Seems that it is needed to use conditions. How?
I use x64dbg, but if you only know a way in another debugger - it is also interesting.
1
-
1what do you mean by "address on which I don't want stopping"? could you add an example?– Igor Skochinsky ♦Jun 17, 2020 at 14:54
Add a comment
|
1 Answer
Yes you can do that. If you don't know how to set conditional breakpoints take a look here
The condition you need to set depends if you are debugging 32 (EIP register) or 64 (RIP register) bit program.
So for example let's say you don't want to stop at address 0xDEADBEEF for 32 bit program, you can set the break condition to EIP != DEADBEEF. You can add multiple addresses like this: EIP != addy1 && EIP != addy2 and so on.
-
Thanks. It works. Is there a good guide for conditions syntax to learn?– oleeddJun 17, 2020 at 15:15
-
You can take a look there: help.x64dbg.com/en/latest/introduction/… help.x64dbg.com/en/latest/introduction/Expressions.html help.x64dbg.com/en/latest/introduction/…– morsiskoJun 17, 2020 at 15:17