bp
bp [Address (hex)] [pid ProcessId (hex)] [tid ThreadId (hex)] [core CoreId (hex)]
pid xx to your command or tid yy or core zz; thus, the command will be executed if the process id is equal to xx or the thread id is equal to yy or the core is equal to zz . If you don't specify these options, then by default, you receive breakpoints on all conditions. See the Remarks section for more information about pid.RIP of the triggered breakpoint).nt!ExAllocatePoolWithTag, nt!ExAllocatePoolWithTag+5,[email protected]+5, fffff801639b1035, fffff801639b103a, and fffff801639b103f, you can use the following commands.Address to your target virtual address that you want to put a breakpoint on it, and fill Pid to your special process id, and/or Tid to your special thread id, and/or Core to your special core.DEBUGGEE_BP_APPLY_TO_ALL_PROCESSES, DEBUGGEE_BP_APPLY_TO_ALL_THREADS, DEBUGGEE_BP_APPLY_TO_ALL_CORES.DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_BP as RequestedAction and DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGER_TO_DEBUGGEE_EXECUTE_ON_VMX_ROOT as PacketType.Result is filled by the kernel.Result is DEBUGEER_OPERATION_WAS_SUCCESSFULL, then the operation was successful. Otherwise, the returned result is an error.pid xx does not mean that we will change the layout to a new process, it means that the address should be available in the current process layout but will be triggered only on the process with process id equal to xx, you can use the '.process' command to switch to a new process if you want to put a breakpoint on the layout of another process.