bp
bp [Address (hex)] [pid ProcessId (hex)] [tid ThreadId (hex)] [core CoreId (hex)]
pid xx
to your command or tid yy
or core zz
; thus, the command will be executed if the process id is equal to xx
or the thread id is equal to yy
or the core is equal to zz
. If you don't specify these options, then by default, you receive breakpoints on all conditions. See the Remarks section for more information about pid.RIP
of the triggered breakpoint).nt!ExAllocatePoolWithTag
, nt!ExAllocatePoolWithTag+5
,[email protected]+5
, fffff801639b1035
, fffff801639b103a
, and fffff801639b103f
, you can use the following commands.Address
to your target virtual address that you want to put a breakpoint on it, and fill Pid
to your special process id, and/or Tid
to your special thread id, and/or Core
to your special core.DEBUGGEE_BP_APPLY_TO_ALL_PROCESSES
, DEBUGGEE_BP_APPLY_TO_ALL_THREADS
, DEBUGGEE_BP_APPLY_TO_ALL_CORES
.DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_BP
as RequestedAction
and DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGER_TO_DEBUGGEE_EXECUTE_ON_VMX_ROOT
as PacketType
.Result
is filled by the kernel.Result
is DEBUGEER_OPERATION_WAS_SUCCESSFULL
, then the operation was successful. Otherwise, the returned result is an error.pid xx
does not mean that we will change the layout to a new process, it means that the address should be available in the current process layout but will be triggered only on the process with process id equal to xx
, you can use the '.process' command to switch to a new process if you want to put a breakpoint on the layout of another process.