20.6.4 Watchpoints

Watchpoints are evaluated expressions that makes the '!contwp' command stop stepping when they match. You can setup multiple expressions and logical operations and groupping checking for memory or register values.

e cmd.wp = pd 3 @ eip
e dbg.wptrace = false

The 'dbg.wptrace' is used to make the watchpoints stop or not the execution when a watchpoint expression matches. The 'cmd.wp' will be executed every time a watchpoint is matched.

[0xB7F45A60]> !wp %eip = 0xB7F45A8B
0: %eip = 0xB7F45A8B
[0xB7F45A60]> !contwp
watchpoint 0 matches at 0xb7f45a8b
[0xB7F45A60]> pd 1 @ 0xB7F45A8B
               0xB7F45A8B        eip: 01d0              eax += edx       
[0xB7F45A60]> !wp %eax = 0x6fffffff
1: %eax = 0x6fffffff
[0xB7F45A60]> !contwp
watchpoint 1 matches at 0xb7f45abe
[0xB7F45A60]> pd 1 @ 0xb7f45abe
          |    0xB7F45ABE        eip: 29d0              eax -= edx       
[0xB7F45A60]> !reg eax
0x6fffffff
[0xB7F45A60]>