views:

1104

answers:

2

I want to put a conditional breakpoint in windbg.

For example lets say LoadLibrary API.

How can I put breakpoint such that it should it whenever user32.dll get loaded.

> x kernel32!LoadLibraryW

It will give some address [XXXX]

Now I can put breakpoint as

> bu [XXXX]

but this will hit for all calls to LoadLibraryW.

Any suggestions.

A: 

I am a little confused by the text and header in your question. But assuming you want to set a conditional breakpoint you should take a look at the documentation cause it goes into plenty of detail on that subject.

Brian Rasmussen
A: 
Well I was just giving example of user32.dll, it could be any dll. I want to break at loading of a particular dll , but windbg loads all dlls so fast that I am not able to find out the who is loading that dll.
Alien01
just make debugger halt at its initial breakpoint (do not use -g command line option) and set module break condition like shown above, substituting user32 with a dll name of your choice or do not specify any names to make it break on load of every module (courtesy of debugger.chm).
I found another way.We can do a string comparison.If string is user32.dll the break .we can set conditional breakpoint like >bu XXXXXX ";as /mu ${/v:MyAlias} poi(@esp+0x4*1); .if ( $spat( \"${MyAlias}\", \"*User32*\" ) != 0 ) {;.echo *** LoadLibrary CALLED *** ;.printf \"%mu\\n\", dwo (ESP + 0x04*1);.echo } .else { g }"
Alien01