Summary
During TTD analysis, one of the most common questions is "where was this
register last written?" WinDbg exposes this directly:
!tt br <reg> — travel to the previous/next position where a register changes valuedx @$curthread.TTD.PrevRegisterWrite("<reg>" [, <value>]) and the matching
NextRegisterWrite(...) — return the position/value and can be seeked to
Today this requires dropping into the debugger console and typing the DDM
expression by hand. It'd be a nice workflow win to expose it as a first-class
action in the debugger UI.
Proposed UX
- Right-click a register in the Registers view → Go to previous write /
Go to next write, which seeks the TTD position.
- Expose an equivalent in the debugger Python API (a helper wrapping
PrevRegisterWrite/NextRegisterWrite + seek) so it's scriptable from BN.
Backend note
The primitive already exists in dbgeng — register-change navigation landed in
TTD ~1.11.x (April 2025 WinDbg release), via both !tt br and the
Prev/NextRegisterWrite DDM methods, hanging off @$curthread (per-thread).
So this is primarily plumbing a UI/API action to an existing capability.
Caveat worth documenting
These key on the register changing value, not on every architectural write —
a write of the same value the register already held won't be found. Worth
noting in the tooltip/docstring so it doesn't surprise anyone doing data-flow
work.
Summary
During TTD analysis, one of the most common questions is "where was this
register last written?" WinDbg exposes this directly:
!tt br <reg>— travel to the previous/next position where a register changes valuedx @$curthread.TTD.PrevRegisterWrite("<reg>" [, <value>])and the matchingNextRegisterWrite(...)— return the position/value and can be seeked toToday this requires dropping into the debugger console and typing the DDM
expression by hand. It'd be a nice workflow win to expose it as a first-class
action in the debugger UI.
Proposed UX
Go to next write, which seeks the TTD position.
PrevRegisterWrite/NextRegisterWrite+ seek) so it's scriptable from BN.Backend note
The primitive already exists in dbgeng — register-change navigation landed in
TTD ~1.11.x (April 2025 WinDbg release), via both
!tt brand thePrev/NextRegisterWriteDDM methods, hanging off@$curthread(per-thread).So this is primarily plumbing a UI/API action to an existing capability.
Caveat worth documenting
These key on the register changing value, not on every architectural write —
a write of the same value the register already held won't be found. Worth
noting in the tooltip/docstring so it doesn't surprise anyone doing data-flow
work.