Automatic break when contents of a memory location changes or is read

Question

The old DEC Tru64 UNIX debugger had a feature (called "watchpoints to monitor variables") that would watch a memory location (or range of addresses) for read or write activity and when it detected such activity would break the program so you could investigate why. See for details:

http://h30097.www3.hp.com/docs/base_doc/DOCUMENTATION/V50_HTML/ARH9QATE/DOCU_009.HTM

Is there any way to do this sort of thing in the VisualStudio debugger? Or is there an add-on or some other tool that can do this under Windows?

Answer 1

Yes, data breakpoints can detect writes. Don't know if it's possible to check for read, though. I don't believe x86 has native support for that.

Answer 2

Yeah, you can do this in visual studio. You can create a "New Data Breakpoint" under the debug menu while you're broken in a running program. You then specify the address to watch and the number of bytes.

This only works for changing the value. I don't know how to watch for read access. However it's a very common question to want to know where a value got changed. I find that I don't want to know who reads a value as often.

Answer 3

Visual Studio allows to set breakpoints on memory location only 4 bytes length (on 32-bit Windows version). To catch memory access (read or write) you could use the following class:

struct protect_mem_t {
    protect_mem_t( void* addr, size_t size ) : addr(addr), size(size), is_protected(FALSE) { 
     protect(); 
    }
    ~protect_mem_t() { release(); }
    BOOL protect() { 
     if ( !is_protected ) {
      // To catch only read access you should change PAGE_NOACCESS to PAGE_READONLY
      is_protected = VirtualProtect( addr, size, PAGE_NOACCESS, &old_protect );
     }
     return is_protected;
    }
    BOOL release() { 
     if ( is_protected ) 
      is_protected = !VirtualProtect( addr, size, old_protect, &old_protect );
     return !is_protected;
    }

protected:
    void*   addr;
    size_t  size;
    BOOL    is_protected;
    DWORD   old_protect;
};

It changes access mode on selected memory pages. Page size is equal to 4096 bytes on 32-bit systems. Exception will be thrown on every access to protected memory. This class is limited in use to only large memory areas, but I hope it can be helpful.

It could be used in the following way:

// some_array should be aligned on PAGE_SIZE boundaries
protect_mem_t guard( &some_array, PAGE_SIZE );

Answer 4

You can use WINDBG and set a ba breakpoint on the desired address