1

Can't get a conditional breakpoint to fire in Windbg. I tried:

bp xxxxxxxx "j (@ebp+0C==115) ''; 'gc' "

bp xxxxxxxx "j (ebp+0C==115) ''; 'gc' "

bp xxxxxxxx "j (poi(ebp+0C)==115) ''; 'gc' "

bp xxxxxxxx "j (poi(@ebp+0C)==115) ''; 'gc' "

bp xxxxxxxx "j (poi(@ebp+0xC)==115) ''; 'gc' "

bp xxxxxxxx "j (@ebp+0xC==115) ''; 'gc' "

bp xxxxxxxx "j (@ebp+0x0C==115) ''; 'gc' "

bp xxxxxxxx "j (poi(@ebp+0x0C)==115) ''; 'gc' "

bp xxxxxxxx "j (ebp+0x0C==115) ''; 'gc' "

bp xxxxxxxx "j (poi(ebp+0x0C)==115) ''; 'gc' "

bp xxxxxxxx "j (poi(ebp+c)==115) ''; 'gc' "

bp xxxxxxxx "j (ebp+c==115) ''; 'gc' "

bp xxxxxxxx "j (ebp+0x0c==115) ''; 'gc' "

bp xxxxxxxx "j poi(ebp+0x0c)==115 ''; 'gc' "

The 115 value is in hex.

Another thing I need is to have two conditions. Like:

bp xxxxxxxx "j ((poi(ebp+0x0c)==115)&&(poi(ebp+12)==7)) ''; 'gc' "

Nothing works! Thanks in adv

4
  • Are you intending 115 in to be in hex, or decimal? By default the MASM number base is 16, which you can change with n. I know you suggest "115" to be in hex, but in your last expr, you dereference an unaligned pointer at 0x12 past %ebp. Btw, you can specify decimal numbers with the "0n" prefix (as opposed to "0x" for hex). It's a good habit to use a prefix whenever you specify _all_ of your numbers. This way you can prevent a symbol lookup in case you mistype a hex number that's full of alpha-digits. Same deal with registers, by prefixing them with "@". Commented Mar 13 at 14:30
  • With regards to combining numerical expressions, the && isn't a numeric expression, but you probably realize that "==" returns a 0 or 1 (you can test your expressions with ? expr). So, if you just use a binary & between both comparisons, you can get the entire expr to return 1, which'd result in j executing the first command. Wrt your list, at least one of those should work. It might help to clarify whether you're trying to deref a pointer at @ebp+0xc and check its value for 0x115, or check that @ebp+0xc == 0x115. You can also use .if (...) {} if quoting is messing you up. Commented Mar 13 at 14:40
  • Thanks for reply Rizvi-Santago. I've already resolved the problem. It didn't trigger because of another reason. And the && never worked but the AND operator did!
    – Uddie
    Commented Mar 13 at 23:23
  • Uddie, please post that as an answer. Commented May 6 at 6:57

1 Answer 1

0

The breakpoint would trigger but would not actually stop executing because you are continuing the execution using the 'gc' command right after it.

if you want to just break conditionally the syntax is as follows (as mentioned here):

bp /w "(Condition)" Address

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.