I'm working with RtlRunEncodeUnicodeString and have identified how charachters are encrypted and where they are store. (starting with 17bde8) Now I want to break when they are being accessed by the program. I thought about break on access (from memory map) but I think that pertains to the entire block of memory and I want to break when specific bytes are accessed.

Any ideas or suggestions? Be forwarned (as if it isn't obvious) I'm really green at this.

Thanks!!!

in the dump mark the bytes you need, and right click BREAKPOINT -MEMORY ON ACCESS and stop only when read, write of execute only the bytes tou mark.

Ricardo

also hardware break on read (byte word dword) should do the trick of breaking on specific memory

Awesome! Thanks guys.