Windbg conditional breakpoint issue

Can't get a conditional breakpoint to fire in Windbg. I tried:

``````bp xxxxxxxx "j (@ebp+0C==115) ''; 'gc' "

bp xxxxxxxx "j (ebp+0C==115) ''; 'gc' "

bp xxxxxxxx "j (poi(ebp+0C)==115) ''; 'gc' "

bp xxxxxxxx "j (poi(@ebp+0C)==115) ''; 'gc' "

bp xxxxxxxx "j (poi(@ebp+0xC)==115) ''; 'gc' "

bp xxxxxxxx "j (@ebp+0xC==115) ''; 'gc' "

bp xxxxxxxx "j (@ebp+0x0C==115) ''; 'gc' "

bp xxxxxxxx "j (poi(@ebp+0x0C)==115) ''; 'gc' "

bp xxxxxxxx "j (ebp+0x0C==115) ''; 'gc' "

bp xxxxxxxx "j (poi(ebp+0x0C)==115) ''; 'gc' "

bp xxxxxxxx "j (poi(ebp+c)==115) ''; 'gc' "

bp xxxxxxxx "j (ebp+c==115) ''; 'gc' "

bp xxxxxxxx "j (ebp+0x0c==115) ''; 'gc' "

bp xxxxxxxx "j poi(ebp+0x0c)==115 ''; 'gc' "
``````

The 115 value is in hex.

Another thing I need is to have two conditions. Like:

``````bp xxxxxxxx "j ((poi(ebp+0x0c)==115)&&(poi(ebp+12)==7)) ''; 'gc' "
``````

• Are you intending 115 in to be in hex, or decimal? By default the MASM number base is 16, which you can change with `n`. I know you suggest "115" to be in hex, but in your last expr, you dereference an unaligned pointer at 0x12 past `%ebp`. Btw, you can specify decimal numbers with the "0n" prefix (as opposed to "0x" for hex). It's a good habit to use a prefix whenever you specify _all_ of your numbers. This way you can prevent a symbol lookup in case you mistype a hex number that's full of alpha-digits. Same deal with registers, by prefixing them with "@". Commented Mar 13 at 14:30
• With regards to combining numerical expressions, the `&&` isn't a numeric expression, but you probably realize that "==" returns a 0 or 1 (you can test your expressions with `? expr`). So, if you just use a binary `&` between both comparisons, you can get the entire expr to return 1, which'd result in `j` executing the first command. Wrt your list, at least one of those should work. It might help to clarify whether you're trying to deref a pointer at `@ebp+0xc` and check its value for 0x115, or check that `@ebp+0xc == 0x115`. You can also use `.if (...) {}` if quoting is messing you up. Commented Mar 13 at 14:40