If I have breakpoint on some win function, how to whitelist some address on which I don't want stopping?
Seems that it is needed to use conditions. How?
I use x64dbg, but if you only know a way in another debugger - it is also interesting.
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this communityIf I have breakpoint on some win function, how to whitelist some address on which I don't want stopping?
Seems that it is needed to use conditions. How?
I use x64dbg, but if you only know a way in another debugger - it is also interesting.
Yes you can do that. If you don't know how to set conditional breakpoints take a look here
The condition you need to set depends if you are debugging 32 (EIP register) or 64 (RIP register) bit program.
So for example let's say you don't want to stop at address 0xDEADBEEF for 32 bit program, you can set the break condition to EIP != DEADBEEF
. You can add multiple addresses like this: EIP != addy1 && EIP != addy2
and so on.