In VS2019 what Conditions can I use in Function Breakpoints in native code?

JamesBurgess 21

When I set a breakpoint on a kernel32 function it works but I'm wonder what I can type into Conditions expression box:

Specifically what I'd like to do would be to compare the string which I know is at the stack register plus 4 bytes (esp+4) since that'll be the file path name. Is that possible? If not what can I type in there for this kind of breakpoint?

Cheers,
-James

PS
I know I can do this in windbg, I'm looking to do this in VS2019

Accepted answer

Viorel 112.1K Reputation points

2021-02-26T20:12:01.827+00:00

For the specific part of your question, try entering this expression:

wcsicmp(*(wchar_t**)(esp+4), L"known path…") == 0
Please sign in to rate this answer.
JamesBurgess 21 Reputation points

2021-03-05T22:56:33.653+00:00

Thank you so much! This makes so much sense I don't know why I didn't try it :-). There's not much information in the docs for this.

In case someone comes looking for breakpoint on CreateFileW for a particular pathname, if you are on x64 Windows 10 the actual file name is not at esp+4 but rather in in rcx. So to break on a known path you need the following expression:

wcsicmp((wchar_t*)(rcx), L"known path") == 0

Regards,
James
Sign in to comment

In VS2019 what Conditions can I use in Function Breakpoints in native code?

0 additional answers