Watching memory
The API provides a way to get the value of the instruction pointer the
moment after a memory address is read, written or executed.
To choose the address you want to watch, you must call
proctal_watch_address_set.
Here's how you would set to watch the address 81AC27.
proctal_watch_address_set(proctal, (void *) 0x81AC27);
To choose whether you want to watch for instructions that read, write
or execute you can call proctal_watch_read_set,
proctal_watch_write_set or
proctal_watch_execute_set, respectively.
Here's how you would watch for instructions that read and write but do
not execute:
proctal_watch_read_set(proctal, 1);
proctal_watch_write_set(proctal, 1);
proctal_watch_execute_set(proctal, 0);
To start watching, you need to call proctal_watch_start.
proctal_watch_start(proctal);
Check the Error handling page to learn how to deal with
an error.
To check if the memory address was accessed in the mean time, you need
to call proctal_watch_next.
for (;;) {
void *address;
int result = proctal_watch_next(proctal, &address);
if (proctal_error(proctal)) {
// Error handling.
break;
}
if (result) {
// Use address.
}
}
If a memory access was detected, it will return 1 and write out the
address.
If no memory access was detected, it will return 0. On failure it will
also return 0.
The address of the instruction that is returned may be the instruction that comes after the actual instruction that accessed the given memory location.
To stop watching, you need to call proctal_watch_stop.
proctal_watch_stop(proctal);