Low level breakpoint conditions

Low level breakpoint conditions can be used to speed up the debugger. They are evaluated like this:
  - in case of remote debugging, the condition is evaluated on the remote
    computer. The following actions are bypassed:
      - sending of the breakpoint event to the local computer
      - switching from debthread to the main thread
      - updating internal IDA structures and caches
      - updating the screen
  - in case of local debugging, the condition is evaluated at low level.
    The following actions are bypassed:
      - switching from debthread to the main thread
      - updating internal IDA structures and caches
      - updating the screen
In both cases, there is a significant speed up. This improvement imposes some limitations on the breakpoint condition:
  - only IDC expressions can be used for low level conditions
  - only functions marked as 'thread-safe' may be called
  - only entire registers can be accessed (e.g. EAX is ok but AL is not)
Essentially this means that the only available functions are:
  - read/write process registers
  - read/write process memory
  - file i/o
  - auxiliary string and object functions
  - msg() function (for debugging the breakpoint conditions)
Low level breakpoint conditions are available only for Win32, WinCE, Linux, Mac, Android debuggers.
Index | Previous topic | Next topic