Auto crash when changing or reading the contents of a memory cell

Question

The old DEC Tru64 UNIX debugger had a function (called "watchpoints for monitoring variables") that would monitor the location (or address range) of the memory for read or write activity, and when it detects such activity, it would break the program so that you can research why. See details

http://h30097.www3.hp.com/docs/base_doc/DOCUMENTATION/V50_HTML/ARH9QATE/DOCU_009.HTM

Is there a way to do this in the VisualStudio debugger? Or is there an add-on or some other tool that can do this under Windows?

Answer 1

Yes, you can do it in a visual studio. You can create a “new data breakpoint” in the debug menu when you are violated in a running program. Then you specify the address to view and the number of bytes.

This only works to change the value. I do not know how to watch read access. However, the question often arises whether one needs to know where the value has changed. I believe that I do not want to know who reads the meaning so often.

Answer 2

Visual Studio allows you to set breakpoints in a memory cell only 4 bytes long (on a 32-bit version of Windows). To catch memory access (read or write), you can use the following class:

struct protect_mem_t { protect_mem_t( void* addr, size_t size ) : addr(addr), size(size), is_protected(FALSE) { protect(); } ~protect_mem_t() { release(); } BOOL protect() { if ( !is_protected ) { // To catch only read access you should change PAGE_NOACCESS to PAGE_READONLY is_protected = VirtualProtect( addr, size, PAGE_NOACCESS, &old_protect ); } return is_protected; } BOOL release() { if ( is_protected ) is_protected = !VirtualProtect( addr, size, old_protect, &old_protect ); return !is_protected; } protected: void* addr; size_t size; BOOL is_protected; DWORD old_protect; }; 

It changes the access mode on the selected memory pages. The page size is 4096 bytes on 32-bit systems. The exception will depend on each access to protected memory. This class is limited to use only for large areas of memory, but I hope this can be useful.

It can be used as follows:

 // some_array should be aligned on PAGE_SIZE boundaries protect_mem_t guard( &some_array, PAGE_SIZE ); 

Answer 3

You can use WINDBG and set a breakpoint ba at the desired address

Answer 4

Yes, data breakpoints can detect records. However, I do not know if it is possible to check the reading. I do not believe x86 has built-in support for this.

Answer 5

I recommend the hwbreak project . It even allows you to set a data breakpoint when a location is read.

I modified it to create only one stream and reuse this stream for all data breakpoints, but it was just for efficiency.