Proctal

Documentation

Watching memory

The API provides a way to get the value of the instruction pointer the moment after a memory address is read, written or executed.
To choose the address you want to watch, you must call proctal_watch_address_set.
Here's how you would set to watch the address 81AC27.

proctal_watch_address_set(proctal, (void *) 0x81AC27);

To choose whether you want to watch for instructions that read, write or execute you can call proctal_watch_read_set, proctal_watch_write_set or proctal_watch_execute_set, respectively.
Here's how you would watch for instructions that read and write but do not execute:

proctal_watch_read_set(proctal, 1);
proctal_watch_write_set(proctal, 1);
proctal_watch_execute_set(proctal, 0);

To start watching, you need to call proctal_watch_start.

proctal_watch_start(proctal);

Check the Error handling page to learn how to deal with an error.
To check if the memory address was accessed in the mean time, you need to call proctal_watch_next.

for (;;) {
	void *address;
	int result = proctal_watch_next(proctal, &address);

	if (proctal_error(proctal)) {
		// Error handling.
		break;
	}

	if (result) {
		// Use address.
	}
}

If a memory access was detected, it will return 1 and write out the address.
If no memory access was detected, it will return 0. On failure it will also return 0.

The address of the instruction that is returned may be the instruction that comes after the actual instruction that accessed the given memory location.

To stop watching, you need to call proctal_watch_stop.

proctal_watch_stop(proctal);