How to set a conditional breakpoint on register's value in windbg? - windbg

Question

I wonder if there is a way in windbg to set a breakpoint in all over the code when one of the register get a specific value or point to specific value.
to be more specific, somewhere in the code return "Err". I want to set a breakpoint that whenever EAX or other registers point to somthing like "Err", stop the code.
also I must say that there is no way to find "Err" in disassemblers.

Answer 1

a break point is always tied to an address be it software breakpoint or hardware breakpoint
if you use a memory breakpoint it would be triggered on a page boundary (page_gaurd_violation)
other than that you have to single step
you can try windbgs wt (watch and trace command with a depth argument )
combined with a generic break-point address if You want to watch only eax (the return value of any call )
an example below
os windows 7 sp1 32 bit
windbg version 10.0.16299.15
debuggee calc.exe
generic breakpoint calc!WinMain
command used wt -l 8 -or
before windbg breaks it would have traced around 7500 calls in this depth
>wc -l foo.txt & head foo.txt
7679 foo.txt
0:000> bp calc!WinMain
0:000> wt -l 8 -or
3 0 [ 0] ntdll!LdrpDoDebuggerBreak
11 0 [ 1] ntdll!_SEH_epilog4 eax = 0
4 11 [ 0] ntdll!LdrpDoDebuggerBreak eax = 0
>> No match on ret
4 11 [ 0] ntdll!LdrpDoDebuggerBreak
12 0 [ 0] ntdll!LdrpInitializeProcess
*** ERROR: Module load completed but symbols could not be
1 0 [ 1] ntdll!NtQueryInformationProcess
and you know eax has 88 and you want to check for it you can employ some grep magic like this
>grep -i "eax = .*88" foo.txt
21 0 [ 7] msvcrt!_SEH_prolog4 eax = ef388
21 0 [ 8] KERNELBASE!_SEH_prolog4 eax = ee788
14 0 [ 8] ntdll!RtlpAllocateDebugInfo eax = 2c7b88
21 0 [ 7] ntdll!_SEH_prolog4 eax = ef388
44 0 [ 8] ntdll!RtlAllocateHeap eax = 2c88c0
57 0 [ 8] ntdll!RtlDebugAllocateHeap eax = 2c88c0
3 0 [ 8] ntdll!RtlpAllocateHeap eax = 2c88c0
15 0 [ 8] ntdll!RtlAllocateHeap eax = 2c88c0
6 0 [ 7] ole32!CPageAllocator::CPageAllocator eax = 76b88814
6 0 [ 7] ole32!CPageAllocator::CPageAllocator eax = 76b87688
6 0 [ 7] ole32!CPageAllocator::CPageAllocator eax = 76b86788
3 0 [ 6] ole32!`dynamic initializer for 'arDcomInterfaces'' eax = 76a87988
32 0 [ 8] ole32!_onexit eax = 76a7e88b
31 96 [ 7] ole32!ComVerifierSettings::ComVerifierSettings eax = 76b88aef
104 0 [ 8] ntdll!RtlDebugAllocateHeap eax = 2ca880
11 0 [ 8] ntdll!_SEH_epilog4 eax = 2ca880
33 136 [ 7] ntdll!RtlpAllocateHeap eax = 2ca880
44 169 [ 6] ntdll!RtlAllocateHeap eax = 2ca880
14 0 [ 5] WINMM!WPP_INIT_CONTROL_ARRAY eax = 68d68f88
7 0 [ 8] WINMM!soundPlay eax = ffffffff`f7d0ed88
7 0 [ 8] WINMM!soundPlay eax = ffffffff`fbf886bb
13 0 [ 8] KERNELBASE!GetTickCount eax = 346883
7 0 [ 8] WINMM!soundPlay eax = ffffffff`ff48a886
7 0 [ 8] WINMM!soundPlay eax = 3010388
once you narrow down set specific breaks based on the sample data gathered
here is a specific scenerio you know the error code is 0xc0000034 and you know you dont want NtOpenKey which returns that value but some other api
you can employ some thing like this notic there is only one avast hook which return the error which you can latch on
>grep -i "eax =.*c.*34" foo.txt | grep -v -iE "ntopen|query|Image"
18 0 [ 8] KERNELBASE!BaseGetProcessDllPath eax = 2c634c
51 0 [ 8] KERNELBASE!BasepGetCachedPath eax = 2c634c
18 80 [ 7] KERNELBASE!BaseGetProcessDllPath eax = 2c634c
99 0 [ 8] aswhookx eax = ffffffff`c0000034