How do I break in a Win32 API function based on the function's parameters?

Question

I'm debugging a mixed .Net / native application with VS2010, and I'm trying to determine if / when a particular BSTR gets freed. Based on this question: Debug Break on Win32 Api functions I've figured out how to set a breakpoint in SysFreeString, but it gets called A LOT. I'd like to set a condition to have it only break when the particular string I'm interested in gets freed.

It looks like the address of the string gets pushed onto the stack, but I can't figure out how to dereference the stack registers to figure out if it's my string or not. I tried putting something like [esp] == 0x001ADCAC (where 0x001ADCAC is the address of the string I'm interested in) in the breakpoint condition, but that did not work.

Answer 1

Figured it out! I put the following into the condition for the breakpoint:

DW esp+4 == 0x001ADCAC

and it worked. DW is the debugger's equivalent to "dword ptr". All of the "Assembly language expressions" are listed here: http://msdn.microsoft.com/en-us/library/56638b75.aspx

This would have worked as well:

*(unsigned long*)(esp+4) == 0x001ADCAC