x86: Possible to debug-break when a particular pointer-to-string is pushed on the stack?

Question

Hi,

I am debugging a third-party DLL for which I don't have the source code. This DLL maintains a pool of strings. I want to trap the earliest occurrence at which one of these strings is passed into a function...any function at all...

In other words, I want to detect when a pointer-to-a-null-terminated-string having a certain format is pushed onto the stack...by anybody, and I want to execute a Debug Break when that occurs.

I know you can set a "break-on-access" breakpoint which will trigger when the CPU reads/writes/executes a particular address. What I want is similar to this: for each string pushed onto the stack, I want to test it against a certain format, and if it matches, execute the break.

Using WinDbg, OllyDb, VS2008, whatever..any ideas?

Thanks!

Answer 1

With WinDBG, check out this article

Answer 2

I'd say that this is impossible with your requirements:

I want to detect when a pointer-to-a-null-terminated-string having a certain format

As the previous answer said you'll be able to match your string to anything once your breakpoints hits

I want to trap the earliest occurrence at which one of these strings is passed into a function...any function at all... What I want is similar to this: for each string pushed onto the stack, I want to test it against a certain format, and if it matches, execute the break.

So what you want is need is to detect when any function is called with a specific pointer parameter on the stack - this is the "impossible" part. In theory there are multiple ways to do this but they are to slow and to complicated... And what if the function gets a pointer to a pointer that has the value you're tracking, or an array that contains that pointer...

What is it you're trying to achieve? Why would you need the place the string is first passed into a function? The use of the string is what is most often important and as you know you can break on that with a simple memory access breakpoint (if the string is ever copied add another breakpoint).

I'd recommend you taking another approach, use a disassembler and do some more static analysis with a bit of debugging to get to what you need...