Visual Studio能否监视内存地址读取？

[韩雷]

我们都知道，调试时候，可以打开内存窗口来监视某个地址的内存值，还能在指定地址加断点监视：只要该地址内存被修改，就能触发断点。
但是，我现在希望做到的是：
当某个地址的内存被读取，触发断点。
请问Visual 有这功能吗？

[韩雷]

我想到一个方法：
把某个地址的内存‘锁上’，其他任何代码想读取这个地址就会崩溃。然后根据崩溃信息去查找到底谁读取了这个地址的内存。

[韩雷]

引用 4 楼 boylafong 的回复:

搜索这个指针哪里用了不就行了吗

赋值的地方太多了，各种线程各种用

[boylafong]

你这样做，崩溃的地方只是第一次赋值的地方而已啊(用的时候为空必崩)； 不过如果这是你要的结果也无所谓

[韩雷]

引用 5 楼 zhao4zhong1 的回复:

WinDbg自带楼主需要的功能： Debugging Tools for Windows ba (Break on Access) The ba command sets a data breakpoint. This breakpoint is triggered when the specified memory is accessed. Syntax User-Mode [~Thread] ba[ID] Access Size [Options] [Address [Passes]] ["CommandString"] Kernel-Mode ba[ID] Access Size [Options] [Address [Passes]] ["CommandString"] Parameters Thread Specifies the thread that the breakpoint applies to. For more information about syntax, see Thread Syntax. You can specify threads only in user mode. ID Specifies an optional number that identifies the breakpoint. If you do not specify ID, the first available breakpoint number is used. You cannot add space between ba and the ID number. Each processor supports only a limited number of data breakpoints, but there is no restriction on the value of the ID number. If you enclose ID in square brackets ([]), ID can include any expression. For more information about the syntax, see Numerical Expression Syntax. Access Specifies the type of access that satisfies the breakpoint. This parameter can be one of the following values.Option Action e (execute) Breaks into the debugger when the CPU retrieves an instruction from the specified address. r (read/write) Breaks into the debugger when the CPU reads or writes at the specified address. w (write) Breaks into the debugger when the CPU writes at the specified address. i (i/o) (Microsoft Windows XP and later versions, kernel mode only, x86-based systems only) Breaks into the debugger when the I/O port at the specified Address is accessed. You cannot add space between Access and Size. Note On Windows Server 2003 with Service Pack 1 (SP1), on an Itanium-based computer that uses WOW64 to emulate x86, data breakpoints do not work with the execute option but they do work with the read and write options.

太感谢了。但现在有个问题，我要调试的进程是个子进程，被另一个主进程启动的。请问该如何用winDbg调试子进程？我试了半天没成功

[韩雷]

引用 5 楼 zhao4zhong1 的回复:

WinDbg自带楼主需要的功能： Debugging Tools for Windows ba (Break on Access) The ba command sets a data breakpoint. This breakpoint is triggered when the specified memory is accessed. Syntax User-Mode [~Thread] ba[ID] Access Size [Options] [Address [Passes]] ["CommandString"] Kernel-Mode ba[ID] Access Size [Options] [Address [Passes]] ["CommandString"] Parameters Thread Specifies the thread that the breakpoint applies to. For more information about syntax, see Thread Syntax. You can specify threads only in user mode. ID Specifies an optional number that identifies the breakpoint. If you do not specify ID, the first available breakpoint number is used. You cannot add space between ba and the ID number. Each processor supports only a limited number of data breakpoints, but there is no restriction on the value of the ID number. If you enclose ID in square brackets ([]), ID can include any expression. For more information about the syntax, see Numerical Expression Syntax. Access Specifies the type of access that satisfies the breakpoint. This parameter can be one of the following values.Option Action e (execute) Breaks into the debugger when the CPU retrieves an instruction from the specified address. r (read/write) Breaks into the debugger when the CPU reads or writes at the specified address. w (write) Breaks into the debugger when the CPU writes at the specified address. i (i/o) (Microsoft Windows XP and later versions, kernel mode only, x86-based systems only) Breaks into the debugger when the I/O port at the specified Address is accessed. You cannot add space between Access and Size. Note On Windows Server 2003 with Service Pack 1 (SP1), on an Itanium-based computer that uses WOW64 to emulate x86, data breakpoints do not work with the execute option but they do work with the read and write options.

我好想找到方法了，正在试。。。。

[zgl7903]

恭喜LZ

[boylafong]

搜索这个指针哪里用了不就行了吗

[Sandrer]

建一个类, 类里面存放你想要知道被调用的类

class CTest
{
public:
    CTest() { m_val = 0; } // 类初始化赋值
    ~CTest() {}

    // 这个函数就是返回变量值, 顺便打印出在哪个函数哪个文件被使用
    int GetValue(const char *func, const char *file, int line)
    {
        printf("used at [%s] in [%s(%d)]\n", func, file, line);
        return m_val;
    }

protected:
    int m_val; // 我就当它是你要找的变量了
};

// 实例化类
CTest m_test;

// 关键的地方, xxxx 替换成你原来变量的名字
#define xxxx m_test.GetValue(__FUNCTION__, __FILE__, __LINE__)

经过上面的操作, 每次调用 xxxx 的时候, 就会输出一行被调用的信息了
理论上是可行的, 你可以试试

[赵4老师]

WinDbg自带楼主需要的功能：

Debugging Tools for Windows
ba (Break on Access)
The ba command sets a data breakpoint. This breakpoint is triggered when the specified memory is accessed.




Syntax
User-Mode

[~Thread] ba[ID] Access Size [Options] [Address [Passes]] ["CommandString"]



Kernel-Mode

ba[ID] Access Size [Options] [Address [Passes]] ["CommandString"]


Parameters
Thread
Specifies the thread that the breakpoint applies to. For more information about syntax, see Thread Syntax. You can specify threads only in user mode.
ID
Specifies an optional number that identifies the breakpoint. If you do not specify ID, the first available breakpoint number is used. You cannot add space between ba and the ID number. Each processor supports only a limited number of data breakpoints, but there is no restriction on the value of the ID number. If you enclose ID in square brackets ([]), ID can include any expression. For more information about the syntax, see Numerical Expression Syntax.
Access
Specifies the type of access that satisfies the breakpoint. This parameter can be one of the following values.Option Action
e (execute) Breaks into the debugger when the CPU retrieves an instruction from the specified address.
r (read/write) Breaks into the debugger when the CPU reads or writes at the specified address.
w (write) Breaks into the debugger when the CPU writes at the specified address.
i (i/o) (Microsoft Windows XP and later versions, kernel mode only, x86-based systems only) Breaks into the debugger when the I/O port at the specified Address is accessed.


You cannot add space between Access and Size.

Note On Windows Server 2003 with Service Pack 1 (SP1), on an Itanium-based computer that uses WOW64 to emulate x86, data breakpoints do not work with the execute option but they do work with the read and write options.

[韩雷]

引用 10 楼 Sandrer 的回复:

建一个类, 类里面存放你想要知道被调用的类

class CTest
{
public:
    CTest() { m_val = 0; } // 类初始化赋值
    ~CTest() {}

    // 这个函数就是返回变量值, 顺便打印出在哪个函数哪个文件被使用
    int GetValue(const char *func, const char *file, int line)
    {
        printf("used at [%s] in [%s(%d)]\n", func, file, line);
        return m_val;
    }

protected:
    int m_val; // 我就当它是你要找的变量了
};

// 实例化类
CTest m_test;

// 关键的地方, xxxx 替换成你原来变量的名字
#define xxxx m_test.GetValue(__FUNCTION__, __FILE__, __LINE__)

经过上面的操作, 每次调用 xxxx 的时候, 就会输出一行被调用的信息了
理论上是可行的, 你可以试试

好的，我试试

[韩雷]

引用 5 楼 zhao4zhong1 的回复:

WinDbg自带楼主需要的功能： Debugging Tools for Windows ba (Break on Access) The ba command sets a data breakpoint. This breakpoint is triggered when the specified memory is accessed. Syntax User-Mode [~Thread] ba[ID] Access Size [Options] [Address [Passes]] ["CommandString"] Kernel-Mode ba[ID] Access Size [Options] [Address [Passes]] ["CommandString"] Parameters Thread Specifies the thread that the breakpoint applies to. For more information about syntax, see Thread Syntax. You can specify threads only in user mode. ID Specifies an optional number that identifies the breakpoint. If you do not specify ID, the first available breakpoint number is used. You cannot add space between ba and the ID number. Each processor supports only a limited number of data breakpoints, but there is no restriction on the value of the ID number. If you enclose ID in square brackets ([]), ID can include any expression. For more information about the syntax, see Numerical Expression Syntax. Access Specifies the type of access that satisfies the breakpoint. This parameter can be one of the following values.Option Action e (execute) Breaks into the debugger when the CPU retrieves an instruction from the specified address. r (read/write) Breaks into the debugger when the CPU reads or writes at the specified address. w (write) Breaks into the debugger when the CPU writes at the specified address. i (i/o) (Microsoft Windows XP and later versions, kernel mode only, x86-based systems only) Breaks into the debugger when the I/O port at the specified Address is accessed. You cannot add space between Access and Size. Note On Windows Server 2003 with Service Pack 1 (SP1), on an Itanium-based computer that uses WOW64 to emulate x86, data breakpoints do not work with the execute option but they do work with the read and write options.

我用Windbg ba命令，ba r1 1234ffff 当0x1234ffff 这个地址的内存被读取时，触发断点。 但是，触发断点后，我如何知道是哪个源文件的哪行代码在读取0x1234ffff这个地址呢？ 多谢帮忙！ https://bbs.csdn.net/topics/392446045 这是我新开的帖子

[韩雷]

引用 5 楼 zhao4zhong1 的回复:

WinDbg自带楼主需要的功能： Debugging Tools for Windows ba (Break on Access) The ba command sets a data breakpoint. This breakpoint is triggered when the specified memory is accessed. Syntax User-Mode [~Thread] ba[ID] Access Size [Options] [Address [Passes]] ["CommandString"] Kernel-Mode ba[ID] Access Size [Options] [Address [Passes]] ["CommandString"] Parameters Thread Specifies the thread that the breakpoint applies to. For more information about syntax, see Thread Syntax. You can specify threads only in user mode. ID Specifies an optional number that identifies the breakpoint. If you do not specify ID, the first available breakpoint number is used. You cannot add space between ba and the ID number. Each processor supports only a limited number of data breakpoints, but there is no restriction on the value of the ID number. If you enclose ID in square brackets ([]), ID can include any expression. For more information about the syntax, see Numerical Expression Syntax. Access Specifies the type of access that satisfies the breakpoint. This parameter can be one of the following values.Option Action e (execute) Breaks into the debugger when the CPU retrieves an instruction from the specified address. r (read/write) Breaks into the debugger when the CPU reads or writes at the specified address. w (write) Breaks into the debugger when the CPU writes at the specified address. i (i/o) (Microsoft Windows XP and later versions, kernel mode only, x86-based systems only) Breaks into the debugger when the I/O port at the specified Address is accessed. You cannot add space between Access and Size. Note On Windows Server 2003 with Service Pack 1 (SP1), on an Itanium-based computer that uses WOW64 to emulate x86, data breakpoints do not work with the execute option but they do work with the read and write options.

谢谢，我解决了。用windbg的调用堆栈

[赵4老师]