Windbg question

[Eibro]

I'm trying to set a conditional breakpoint on LoadLibraryA, where esp+4 is a string. Windbg documentation leads me to believe you can do this:

bp LoadLibraryA "j ($spat(poi(esp+4), "IX86*")) ''; 'g' "

But i'm getting a syntax error. I want break on LoadLibraryA if (char*)(esp+4) == "IX86*", is this possible?

[Stwong]

You're trying
bp LoadLibraryA "j ($spat(poi(esp+4), "IX86*")) ''; 'g' "
?

Try it with escaped ""'s inside the commandstring, may work better.

bp LoadLibraryA "j ($spat(poi(esp+4), \"IX86*\")) ''; 'g' "

Onto the next issue: You have 5 ""'s in that line.

bp LoadLibraryA "j ($spat(poi(esp+4), \"IX86*\")) '; 'g' "

The above may work a little better.

[Skywing]

Try this:

bp kernel32!LoadLibraryA "j dwo(esp+4) == 36385849 'k' ; 'g' "

Assuming you are using MASM syntax, of course.

[Stwong]

That may work even better.  I was just looking at what might cause a syntax error, forgot to mention that I had no idea what the conditions for the J were meant to be.