3

What i'm trying to achieve is to use a conditional breakpoint, that never actually breaks but logs in x64dbg's console the value of r9 only when it changes, to prevent console cluttering. But i do not understand how to set the expression for the log condition. On a higher level the pseudo code of what i want to achieve could be:

static last_r9 = 0;
if(r9 != last_r9){
Log();
last_r9 = r9;
}

Is is even possible to achieve something like that?

Here's an screenshot just for reference:

enter image description here

EncoderX
  • 73
  • 5

2 Answers2

2

After many much trial and errors i finally managed to make it work. Here is a walkthrough:

Let's say you want to log (in the log window of x64dbg) the value of the rbx register at a specific address, but only if that value has changed since the last log.

Right click on an address and choose Breakpoint => Set Conditional Breakpoint.

We must now declare a variable (global i assume) that will be used to store the value of rbx, so type this in the command line at the bottom and press enter to validate (example name): var myCounter

enter image description here

Then fill up the pop up window like the screenshot:

  • Break Condition: 0 on cause we only want the log not the breakpoint.
  • log Text: ouputs some text + the value of rbx
  • Log Condition: only log if the value of rbx has changed
  • Command Text: using this just to update the value of myCounter for the next evaluation.
  • Command Condition: 1, (afaik but i could be wrong) the command text will only be executed if the log condition is true, so we'll update the value of myCounter only if myCounter has changed which is what we want.

enter image description here

Feel free to comment if there is a better way to achieve this as, the reason why i needed this "feature" was because when logging data i would sometimes get 1000 lines per second, so that's a way to counter that.

EncoderX
  • 73
  • 5
0

My best guess would be something along the lines of "r9 != r9" as break conditio.

asdfs99
  • 41
  • 3