I'm using windbg to find the memory of a specific structure in windows. The way is to look at certain values stored in stack and registers in entry function. I notice that register ax holds that value when the program executes one instruction(So I have the address of that instruction). I assume that the value of ax is passed from the address of that structure and my job is to find the address of that instruction. The problem is that the assembly in IDA is very different from the assembly(use u command) in windbg. Thus, I'm unable to target the location from pseudocode in IDA and comparison between assembly in windbg and IDA.
assembly 0000 function start(set break point) ... ... some instructions without bp 010f instruction A(where ax already holds the value. set break point)
One very straight approach is to stop the machine when ax has the value I want. But there is no straight approach in windbg. Maybe like Thomas said there are other ways. So I try to use j and t command in windbg.
j(@ax=x) 'p';'r;r ax;r rip'
With above command with bp, I can set conditional break point in certain address. But this infeasible since there are too many instructions and windbg has bp limits.
In documentation ,t command can execute many instructions and display values of registers. Since ax is not displayed in r command, I can track rax instead. How should I write my command in this form?
t [r] [= StartAddress] [Count] ["Command"]
The StartAddress should be the entry function. But what about the count? I don't want to view thousands of output but it may not reach to instruction A if count is not big enough. How to solve this problem? Can I just use a big enough value and set bp at instruction A?
Update: I managed to print all the instructions that have been executed since the entry function with ta command. But still too many instructions for me. I can only save the output to some files and find the location by string operation with C.