I am trying to debug calls to CreateFileA from a DLL that I do not have source code to. I can set the breakpoint in the kernel32.dll with no problem, and I know that the value pointed to by (esp + 4) is the address of the filename. What I'd like to do is to put a watch on the memory address pointed to by (esp + 4), however I cannot determine the correct watch syntax to use (providing it is even possible). For example, I've tried various patterns to the following:
(char *)&(esp + 4) -- error: operand types bad for this operation
Obviously, I can always fall back on having two memory windows open and manually enter the addresses every time the debugger breaks, but I am going for efficiency here. :)
(char*)(esp+4)
.*(char**)(esp+4)