Examine data in windbg when a break on address (ba) breakpoint is hit

Question

I'd like to create a breakpoint such that it will create another one-time breakpoint that will 'dd' a certain memory address when that memory is written to.

So when the breakpoint is hit, I'd like to run a command like:

  ba w4 @ESP+4 /1 ''dd [memory address of this breakpoint]''

Since this breakpoint is being created by another breakpoint (and could potentially be called several times), I can't specify the breakpoint number. Otherwise I could use a pseudo register like '$bp3' to get the memory address of breakpoint #3

Would anyone have any thoughts on how to create a breakpoint command that can 'dd' the memory address of the breakpoint?

Thank you!

Answer 1

you can elaborate to make use of other general purpose pseudo-registers: t0..t19

bp your-address "r$t1=your-other-address; ba w4 @$t1 /1 \"dd @$t1;gc\""