Plugin template for x64dbg that allow the possibility to set breakpoints when a memory zone has a particular text.
Grab the latest release and copy to the x32dbg's plugin floder.
How it works?
The plugin creates the command setString, this command asociate the string with a number, later the number will identify the string in another commands
For our test we set the registers as follow:
We have "TestString" in the stack pointer
Now we have the expression function cndsteroids.ismystring() that receives a debugge's memory address, and returns true or false if has the text.
As you can see, the address has our string, so returns true:
This feature could be used in a bpcnd, to stop is a especific argument of a syscall, for example:
and the debugger pauses in
You can find unicode or ansi strings depends on the second argument of cndsteroids.ismystring ($ANSI or $UNICODE)
By the way, the strings are dinamicly allocated by the plugin, so if you want free it you have available the command delString that receives the identifier number of the string and deallocate it.