WinDbg - count breakpoint hits when certain values are on the stack - windbg

Question

I'm not talking about the call stack.
I want to count how many times a certain function is called when at the address hold by ESP there is a certain value. Before you tell me to check the return address, I'm not interested in that - the return address is at ESP+4 in this case, [ESP] holding a value that is popped before the function will return. Details unimportant.
I can count function calls with the following syntax:
bp MyFunction "r #$t0 = #$t0 + 1; r #$t0; gc"
I can display the double word at [ESP] by adding
dd $csp L1
to the above command.
The problem is that there are quite a lot of calls and I'm only interested in certain calls and tracking them down manually after each break point is annoying and time consuming.
I'm still getting used with WinDbg's syntax. How should the condition look in my .if statement?
I tried some crazy things like
.if( (dd $csp L1) == 2 )
But that is obviously wrong.
I also though about setting the breakpoint somewhere in the function after the value at [ESP] is moved in a local variable (something like bp MyFunction+eip_after_assignment), but that is a bit too late. I think I can work with that, but it will make things simpler if I could just check [ESP] at the beginning.

Answer 1

0:000> lsa .
2: int dummy=0;
3: void useless(int in) {
4: dummy=in;
5: }
> 6: void main(void) {
7: for(int i=0;i<0xffffffff;i++)
8: useless(i);
9: }
0:000> uf countfunc!useless
countfunc!useless [c:\countfunc.cpp # 3]:
3 00401000 55 push ebp
3 00401001 8bec mov ebp,esp
4 00401003 8b4508 mov eax,dword ptr [ebp+8]
4 00401006 a320bb4000 mov dword ptr [countfunc!dummy (0040bb20)],eax
5 0040100b 5d pop ebp
5 0040100c c3 ret
0:000> bl
0:000> bp 0040100b ".if ( poi(#$csp+8) != 1337 ) {gc}"
0:000> .bpcmds
bp0 0x0040100b ".if ( poi(#$csp+8) != 1337 ) {gc}";
0:000> g
> eax=00001337 ebx=7ffdf000 ecx=00001337 edx=0040c340 esi=00000000
> edi=0098f6ee eip=0040100b esp=0013ff68 ebp=0013ff68 iopl=0 nv
> up ei pl nz ac po cy cs=001b ss=0023 ds=0023 es=0023 fs=003b
> gs=0000 efl=00000213 countfunc!useless+0xb: 0040100b 5d
> pop ebp
0:000> ?? in
int 0n4919
0:000> dv
in = 0n4919
0:000> ? 0n4919/1
Evaluate expression: 4919 = 00001337
a bit more complex conditional break on same code conditional breaks do take a lot of time debugging time sensitive code can be quiet challenging
0:000> r $t0 = 0; bp 0040100b ".if ( poi(#$csp+8) != #$t0*1337 ) {gc} .else { .echotime ;? poi(#$csp+8) ; r$t0 = #$t0+1 ;gc }"
0:000> .bpcmds
bp0 0x0040100b ".if ( poi(#$csp+8) != #$t0*1337 ) {gc} .else { .echotime ;? poi(#$csp+8) ; r$t0 = #$t0+1 ;gc }";
0:000> .echotime
Debugger (not debuggee) time: Tue Sep 30 12:12:15.890 2014
0:000> g
Debugger (not debuggee) time: Tue Sep 30 12:12:24.062 2014
Evaluate expression: 0 = 00000000
Debugger (not debuggee) time: Tue Sep 30 12:12:32.578 2014
Evaluate expression: 4919 = 00001337
Debugger (not debuggee) time: Tue Sep 30 12:12:41.093 2014
Evaluate expression: 9838 = 0000266e
Debugger (not debuggee) time: Tue Sep 30 12:12:49.609 2014
Evaluate expression: 14757 = 000039a5
Debugger (not debuggee) time: Tue Sep 30 12:12:58.156 2014
Evaluate expression: 19676 = 00004cdc
Debugger (not debuggee) time: Tue Sep 30 12:13:06.687 2014
Evaluate expression: 24595 = 00006013
Debugger (not debuggee) time: Tue Sep 30 12:13:15.218 2014
Evaluate expression: 29514 = 0000734a
Debugger (not debuggee) time: Tue Sep 30 12:13:23.765 2014
Evaluate expression: 34433 = 00008681
Debugger (not debuggee) time: Tue Sep 30 12:13:32.828 2014
Evaluate expression: 39352 = 000099b8
Debugger (not debuggee) time: Tue Sep 30 12:13:40.906 2014
Evaluate expression: 44271 = 0000acef
this simple code may take 86 days to complete if it continued like this it seems it takes ~8.5 seconds to process 4919 function calls in windbg