1

I want to set a conditional breakpoint on function argument at the entry of a function. Here is the value I want which is c0 a8 89 01. I want to break the function when that register holds this specific value

2: kd> db @rdx
ffffae86`ee4ec024  c0 a8 89 01 c0 a8 89 b4-00 35 e6 d2 00 3a 51 ae  .........5...:Q.
ffffae86`ee4ec034  d1 c9 81 83 00 01 00 00-00 00 00 00 05 5f 6c 64  ............._ld
ffffae86`ee4ec044  61 70 04 5f 74 63 70 03-70 64 63 06 5f 6d 73 64  ap._tcp.pdc._msd
ffffae86`ee4ec054  63 73 04 74 65 73 74 05-6c 6f 63 61 6c 00 00 06  cs.test.local...
ffffae86`ee4ec064  00 01 87 e4 5c 15 80 e4-22 d2 1e 15 d3 b6 13 67  ....\..."......g
ffffae86`ee4ec074  ed b1 02 ec 38 78 8f 7e-26 3e 34 d0 e6 db 55 20  ....8x.~&>4...U 
ffffae86`ee4ec084  14 fe a2 e2 1e a9 d5 25-6f 47 cd 17 a3 41 08 11  .......%oG...A..
ffffae86`ee4ec094  be b3 c7 20 ed e1 80 26-49 3e f7 90 43 0d 75 db  ... ...&I>..C.u.

The command I use is

bp module!function ".if(poi(@rdx)&0x0`ffffffff==0x0189a8c0){.echo target hash triggered;r rcx} .else{gc} "

But I found out that this bp is never triggered so I took a deep look

2: kd> ? poi(@rdx)&0x0`ffffffff
Evaluate expression: 25798848 = 00000000`0189a8c0

2: kd> ? poi(@rdx)&0x0`ffffffff==0x0189a8c0
Evaluate expression: 0 = 00000000`00000000

why is the condition 0? I know the condition is in MASM but I don't understand why this happened.

1 Answer 1

2

operator precdence 0xffffffff==somevalue will naturally be false or 0

0:000> ? poi(@rbx)
Evaluate expression: 8388357042652472396 = 74696e49`7072644c
0:000> ? poi(@rbx) & 0`ffffffff
Evaluate expression: 1886544972 = 00000000`7072644c
0:000> ? poi(@rbx) & 0`ffffffff == 7072644c
Evaluate expression: 0 = 00000000`00000000
0:000> ? (poi(@rbx) & 0`ffffffff) == 7072644c
Evaluate expression: 1 = 00000000`00000001
0:000>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.