Condition breakpoint not working?

WINDBG
1

I’m trying to break on the WM_PAINT message in the MSG::message parameter
return in the call to GetMessageW

Breaking on the function entry and entering ‘dd poi(esp+4)+4’ displays the
message fine.
I’m adding it to my windbg bp condition as follows :

bp USER32!GetMessageW “j(poi(esp+4)+4 = 0xF) ‘’; ’ gc’”

however it doesn’t seem to break.

If I enter enter :

bp USER32!GetMessageW “j(poi(esp+4)+4 = 0xF) ‘.echo "Breakpoint hit,
condition poi(esp+4)+4 = 0xF"’; ‘.echo "Breakpoint not hit"; dd
poi(esp+4)+4; gc’”

I can see all the messages steaming past, including the one I want, but no
break.

Can someone advise me as to what is wrong here.
I’m using the masm expression.

Thanks.

2

I think you’re missing a poi:

bp USER32!GetMessageW “j(poi(poi(esp+4)+4) = 0xF) ‘’; ’ gc’”

Also I prefer the .if/.else syntax to the j syntax, it’s clearer in my
opinion:

bp USER32!GetMessageW “.if (poi((poi(@esp+4)+4)) == 0xF) {.echo Break!}
.else {dd (poi(@esp+4)+4) l1;g}”

-scott

–
Scott Noone
Consulting Associate
OSR Open Systems Resources, Inc.
http://www.osronline.com

“Ged” wrote in message news:xxxxx@windbg…
> I’m trying to break on the WM_PAINT message in the MSG::message parameter
> return in the call to GetMessageW
>
> Breaking on the function entry and entering ‘dd poi(esp+4)+4’ displays the
> message fine.
> I’m adding it to my windbg bp condition as follows :
>
> bp USER32!GetMessageW “j(poi(esp+4)+4 = 0xF) ‘’; ’ gc’”
>
> however it doesn’t seem to break.
>
> If I enter enter :
>
> bp USER32!GetMessageW “j(poi(esp+4)+4 = 0xF) ‘.echo "Breakpoint hit,
> condition poi(esp+4)+4 = 0xF"’; ‘.echo "Breakpoint not hit"; dd
> poi(esp+4)+4; gc’”
>
> I can see all the messages steaming past, including the one I want, but no
> break.
>
> Can someone advise me as to what is wrong here.
> I’m using the masm expression.
>
> Thanks.
>
>
>
>
>

3

Ahh great, that was indeed the problem.
Thanks for your reply Scott.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Scott Noone
Sent: 20 October 2010 19:28
To: Kernel Debugging Interest List
Subject: Re:[windbg] Condition breakpoint not working?

I think you’re missing a poi:

bp USER32!GetMessageW “j(poi(poi(esp+4)+4) = 0xF) ‘’; ’ gc’”

Also I prefer the .if/.else syntax to the j syntax, it’s clearer in my
opinion:

bp USER32!GetMessageW “.if (poi((poi(@esp+4)+4)) == 0xF) {.echo Break!}
.else {dd (poi(@esp+4)+4) l1;g}”

-scott

–
Scott Noone
Consulting Associate
OSR Open Systems Resources, Inc.
http://www.osronline.com

“Ged” wrote in message news:xxxxx@windbg…
> I’m trying to break on the WM_PAINT message in the MSG::message parameter
> return in the call to GetMessageW
>
> Breaking on the function entry and entering ‘dd poi(esp+4)+4’ displays the
> message fine.
> I’m adding it to my windbg bp condition as follows :
>
> bp USER32!GetMessageW “j(poi(esp+4)+4 = 0xF) ‘’; ’ gc’”
>
> however it doesn’t seem to break.
>
> If I enter enter :
>
> bp USER32!GetMessageW “j(poi(esp+4)+4 = 0xF) ‘.echo "Breakpoint hit,
> condition poi(esp+4)+4 = 0xF"’; ‘.echo "Breakpoint not hit"; dd
> poi(esp+4)+4; gc’”
>
> I can see all the messages steaming past, including the one I want, but no
> break.
>
> Can someone advise me as to what is wrong here.
> I’m using the masm expression.
>
> Thanks.
>
>
>
>
>

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer