I am new to reverse engineering and I was trying to debug why a 3rd party application was crashing when I m injecting my DLL in it. (There are some cases where it didn't crash)

So I was able to figure out from a set of instructions/subroutine where the application was throwing an error. There is was able to figure out that it was probably getting a null pointer for some TLS value.

Here is my question w.r.t to this problem I want to break/notify my debugger whenever a value is getting changed at that given TLS slot.

I'll add the ASM to make better sense, This is the disassembly of kernel32!TlsGetValue. I want to watch the TLS slots for the given thread. To put it in simple words I want to add watcher for GS:[0x1480]

Does anyone have any idea how to do it x64dbg?

enter image description here

  • What about hardware breakpoint on memory write?
    – morsisko
    Aug 28 '20 at 12:30
  • How will I write the command for that? Because this address is thread-specific? GS:[0x1480] will have different address for multiple runs / multiple threads Aug 28 '20 at 12:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.