### Example: Format String from Memory Source: https://help.x64dbg.com/en/latest/introduction/Formatting.html Demonstrates formatting a UTF-16 string located at a calculated memory address. ```text password: {utf16@4*ecx+0x402000} ``` -------------------------------- ### Example: Format Instruction Mnemonic Source: https://help.x64dbg.com/en/latest/introduction/Formatting.html Demonstrates formatting the mnemonic of the currently selected instruction. ```text mnemonic: {dis.mnemonic(dis.sel())} ``` -------------------------------- ### Example: Format Byte Swapped Hex Source: https://help.x64dbg.com/en/latest/introduction/Formatting.html Demonstrates formatting a register value after applying byte swapping. ```text {x:bswap(rax)} ``` -------------------------------- ### Example: Format Memory Bytes Source: https://help.x64dbg.com/en/latest/introduction/Formatting.html Demonstrates formatting a single byte from memory at a calculated offset from ebp. ```text function type: {mem;1@[ebp]+0xa} ``` -------------------------------- ### Example: Format Register Value Source: https://help.x64dbg.com/en/latest/introduction/Formatting.html Demonstrates formatting a register's value as hexadecimal. ```text rax: {rax} ``` -------------------------------- ### Example: Format Return Address Source: https://help.x64dbg.com/en/latest/introduction/Formatting.html Demonstrates formatting the return address using the address info type. ```text return address:{a:[rsp]} ``` -------------------------------- ### GUI Interaction Functions Source: https://help.x64dbg.com/en/latest/introduction/Expression-functions.html Functions to get selected addresses from different GUI views. ```APIDOC ## GUI Interaction ### `disasm.sel()` / `dis.sel()` Get the selected address in the disassembly view. ### `dump.sel()` Get the selected address in the dump view. ### `stack.sel()` Get the selected address in the stack view. ``` -------------------------------- ### GetHardwareBreakpointHitCount Source: https://help.x64dbg.com/en/latest/commands/conditional-breakpoint-control/GetHardwareBreakpointHitCount.html Gets the hit counter of a hardware breakpoint. ```APIDOC ## GetHardwareBreakpointHitCount Gets the hit counter of a hardware breakpoint. ### Arguments - `arg1` (address) - The address of the breakpoint. ### Result - `$result` (integer) - The current value of the hit counter will be set to this variable. ``` -------------------------------- ### Argument Functions Source: https://help.x64dbg.com/en/latest/introduction/Expression-functions.html Functions to get and set function arguments by index, assuming the return address is on the stack. ```APIDOC ## Arguments Functions ### `arg(index)`, `arg.get(index)` Gets the argument at `index` (zero-based). ### `arg.set(index, value)` Sets the argument at `index` (zero-based) to `value`. ``` -------------------------------- ### Integer Constant Assignment Source: https://help.x64dbg.com/en/latest/commands/index.html Demonstrates how integer constants are represented in hexadecimal. In this example, the variable $i will be assigned the value 256 (0x100). ```assembly mov $i, 100 ``` -------------------------------- ### Function Information Functions Source: https://help.x64dbg.com/en/latest/introduction/Expression-functions.html Functions to retrieve the start and end addresses of the function that a given address belongs to. ```APIDOC ## Function Information Functions ### `func.start()` Return start of the function `addr` is part of, zero otherwise. ### `func.end()` Return end of the function `addr` is part of, zero otherwise. ``` -------------------------------- ### Reference Functions Source: https://help.x64dbg.com/en/latest/introduction/Expression-functions.html Functions to get information about the current reference view, such as the total count and the address at a specific index. ```APIDOC ## References Functions ### `ref.count()` Number of entries in the current reference view. ### `ref.addr(index)` Get the address of the reference at `index`. Zero on failure. ``` -------------------------------- ### Syscall Functions Source: https://help.x64dbg.com/en/latest/introduction/Expression-functions.html Functions to get the name of a syscall by its number or the number of a syscall by its name. ```APIDOC ## Syscalls Functions ### `syscall.name(number)` Returns the name of the syscall of `number` as a string. ### `syscall.id(name)` Returns the syscall number of a `name`. ``` -------------------------------- ### Setting a bpgoto Breakpoint Source: https://help.x64dbg.com/en/latest/commands/breakpoint-control/bpgoto.html Use these commands to configure a breakpoint to jump to a new address when hit. 'arg1' is the breakpoint address and 'arg2' is the target address. ```text SetBreakpointCondition arg1, 0 SetBreakpointCommand arg1, "CIP=arg2" SetBreakpointCommandCondition arg1, 1 SetBreakpointFastResume arg1, 0 ``` -------------------------------- ### Access Module Entry Points - x64dbg Source: https://help.x64dbg.com/en/latest/introduction/Values.html Access module entry points using 'module:entry', 'module:oep', or 'module:ep'. If exports with these names exist, their addresses are returned. ```assembly module:entry module:oep module:ep ``` -------------------------------- ### Print EXCEPTION_DEBUG_INFO Source: https://help.x64dbg.com/en/latest/commands/analysis/exinfo.html Use the 'exinfo' command to display the contents of the EXCEPTION_DEBUG_INFO structure associated with the most recent exception. This command has no arguments and does not set any result variables. ```text exinfo ``` -------------------------------- ### Format Pointer Source: https://help.x64dbg.com/en/latest/introduction/Formatting.html Use 'p' to format an expression as a zero-prefixed pointer. ```text p: 0000000410007683 ``` -------------------------------- ### General Purpose Functions Source: https://help.x64dbg.com/en/latest/introduction/Expression-functions.html Provides utility functions for byte swapping, conditional logic, timers, and debugger focus checks. ```x64dbg expression bswap(value) ``` ```x64dbg expression ternary(condition, val1, val2) ``` ```x64dbg expression GetTickCount() ``` ```x64dbg expression rdtsc() ``` ```x64dbg expression isdebuggerfocused() ``` ```x64dbg expression isdebuggeefocused() ``` -------------------------------- ### GUI Selection Functions Source: https://help.x64dbg.com/en/latest/introduction/Expression-functions.html Retrieves the currently selected address from various GUI views within x64dbg. ```x64dbg expression disasm.sel() ``` ```x64dbg expression dis.sel() ``` ```x64dbg expression dump.sel() ``` ```x64dbg expression stack.sel() ``` -------------------------------- ### Format Module Name Source: https://help.x64dbg.com/en/latest/introduction/Formatting.html Use '{modname@address}' to print the name of the module containing the specified address. ```text {modname@address} ``` -------------------------------- ### Format Byte Swap Source: https://help.x64dbg.com/en/latest/introduction/Formatting.html Use '{bswap[;size]@value}' to byte-swap a value. The size defaults to the pointer size. ```text {bswap;4@rax} ``` -------------------------------- ### REGDUMP Structure Definition Source: https://help.x64dbg.com/en/latest/developers/tracefile.html Defines the structure used to dump registers and related context information. This structure is used when saving all registers at the start of a trace. ```c typedef struct { REGISTERCONTEXT regcontext; FLAGS flags; X87FPUREGISTER x87FPURegisters[8]; unsigned long long mmx[8]; MXCSRFIELDS MxCsrFields; X87STATUSWORDFIELDS x87StatusWordFields; X87CONTROLWORDFIELDS x87ControlWordFields; LASTERROR lastError; //LASTSTATUS lastStatus; //This field is not supported and not included in trace file. } REGDUMP; ``` -------------------------------- ### Break on Specific Thread ID Source: https://help.x64dbg.com/en/latest/introduction/ConditionalBreakpoint.html Pause execution only when the breakpoint is hit by a specific thread, identified by its ID (e.g., 1C0). Use 'tid()' to get the current thread ID. ```x64dbg tid()==1C0 ``` -------------------------------- ### EnableHardwareBreakpoint Source: https://help.x64dbg.com/en/latest/commands/breakpoint-control/EnableHardwareBreakpoint.html Enables a hardware breakpoint at a specified address. If no address is provided, it attempts to enable as many hardware breakpoints as possible. ```APIDOC ## EnableHardwareBreakpoint/bphe/bphwe ### Description Enable a previously disabled hardware breakpoint. ### Arguments `[arg1]` Address of the hardware breakpoint to enable. If this argument is not specified, as many as possible hardware breakpoints will be enabled. ### Result This command does not set any result variables. ``` -------------------------------- ### String Searching and Comparison Functions Source: https://help.x64dbg.com/en/latest/introduction/Expression-functions.html Provides functions for finding substrings and comparing strings, with case-sensitive and case-insensitive options. ```x64dbg expression strstr(str1, str2) ``` ```x64dbg expression stristr(str1, str2) ``` ```x64dbg expression streq(str1, str2) ``` ```x64dbg expression strieq(str1, str2) ``` -------------------------------- ### Format Label Source: https://help.x64dbg.com/en/latest/introduction/Formatting.html Use '{label@address}' to print the auto-generated label at a given address. ```text {label@address} ``` -------------------------------- ### Format Address Info Source: https://help.x64dbg.com/en/latest/introduction/Formatting.html Use 'a' to format an expression as address information, including module and offset. ```text a: 00401010 ``` -------------------------------- ### Format Disassembly Source: https://help.x64dbg.com/en/latest/introduction/Formatting.html Use '{disasm@address}' to print the disassembly instruction at a given address. This is equivalent to '{i:address}'. ```text {disasm@address} ``` -------------------------------- ### Access Module Data - x64dbg Source: https://help.x64dbg.com/en/latest/introduction/Values.html Access loaded module bases using 'module', 'module:0', 'module:base', 'module:imagebase', or 'module:header'. RVAs are accessed with 'module + rva' or 'module:$rva'. File offsets to VA are converted using 'module:#offset'. An empty module name uses the current module. ```assembly // File offset 0x400 ntdll.dll:#400 :#400 // RVA 0x1000 ntdll.dll:$1000 // RVA 0x1000 :$1000 ``` -------------------------------- ### SetHardwareBreakpointLog/bphwlog Source: https://help.x64dbg.com/en/latest/commands/conditional-breakpoint-control/SetHardwareBreakpointLog.html Sets log text when a hardware breakpoint is hit. If no log condition is specified, it logs regardless of the break condition. Otherwise, it logs only when the logging condition is satisfied. ```APIDOC ## SetHardwareBreakpointLog/bphwlog ### Description Sets log text when a hardware breakpoint is hit. When log condition is not specified, it will always be logged regardless of the break condition, otherwise it will be logged when the logging condition is satisfied. ### Arguments - `arg1` (address) - The address of the breakpoint. - `[arg2]` (string) - The log format string (see introduction/formatting). ### Result This command does not set any result variables. ``` -------------------------------- ### Module Information Functions Source: https://help.x64dbg.com/en/latest/introduction/Expression-functions.html Retrieves various properties of modules loaded in the debugged process, such as base address, size, hash, and entry point. ```x64dbg expression mod.party(addr) ``` ```x64dbg expression mod.base(addr) ``` ```x64dbg expression mod.size(addr) ``` ```x64dbg expression mod.hash(addr) ``` ```x64dbg expression mod.entry(addr) ``` ```x64dbg expression mod.system(addr) ``` ```x64dbg expression mod.user(addr) ``` ```x64dbg expression mod.main() ``` ```x64dbg expression mod.rva(addr) ``` ```x64dbg expression mod.offset(addr) ``` ```x64dbg expression mod.isexport(addr) ``` ```x64dbg expression mod.fromname(str) ``` -------------------------------- ### Format Memory Bytes Source: https://help.x64dbg.com/en/latest/introduction/Formatting.html Use '{mem;size@address}' to print a specified number of bytes from a memory address in hex. ```text {mem;1@[ebp]+0xa} ``` -------------------------------- ### Format Instruction Text Source: https://help.x64dbg.com/en/latest/introduction/Formatting.html Use 'i' to format an expression as disassembly instruction text. ```text i: jmp 0x77ac3c87 ``` -------------------------------- ### Format UTF-8 String Source: https://help.x64dbg.com/en/latest/introduction/Formatting.html Use '{utf8[;length]@address}' to print a UTF-8 string from a memory address, with an optional length. ```text {utf8@address} ``` ```text {utf8[;length]@address} ``` -------------------------------- ### Format ASCII String Source: https://help.x64dbg.com/en/latest/introduction/Formatting.html Use '{ascii[;length]@address}' to print an ASCII string from a memory address, with an optional length. ```text {ascii[;length]@address} ``` -------------------------------- ### Format UTF-16 String Source: https://help.x64dbg.com/en/latest/introduction/Formatting.html Use '{utf16[;length]@address}' to print a UTF-16 string from a memory address, with an optional length in words. ```text {utf16[;length]@address} ``` -------------------------------- ### Format String Pointer Source: https://help.x64dbg.com/en/latest/introduction/Formatting.html Use 's' to format an expression as a string pointer. Note: '{utf8@address}' is recommended instead. ```text s: "this is a string" ``` -------------------------------- ### Format Comment Source: https://help.x64dbg.com/en/latest/introduction/Formatting.html Use '{comment@address}' to print the auto-generated comment at a given address. ```text {comment@address} ``` -------------------------------- ### Set USER Variables Source: https://help.x64dbg.com/en/latest/introduction/Variables.html Use these commands to set USER variables. The value is automatically interpreted as hexadecimal. ```assembly mov myvar, 1234 mov $myvar, 1234 myvar = 1234 $myvar = 1234 ``` -------------------------------- ### Process Information Functions Source: https://help.x64dbg.com/en/latest/introduction/Expression-functions.html Functions to retrieve process and thread information. ```APIDOC ## Process Information ### `peb()` Get PEB address. ### `teb()` Get TEB address. ### `tid()` Get the current thread ID. ### `kusd()`, `KUSD()`, `KUSER_SHARED_DATA()` Get the address of `KUSER_SHARED_DATA` (`0x7FFE0000`). ``` -------------------------------- ### Format Windows Error Code Source: https://help.x64dbg.com/en/latest/introduction/Formatting.html Use '{winerror@code}' to display the name and description of a Windows error code. ```text {winerror@code} ``` -------------------------------- ### Format ANSI String Source: https://help.x64dbg.com/en/latest/introduction/Formatting.html Use '{ansi[;length]@address}' to print an ANSI string from a memory address, with an optional length. ```text {ansi[;length]@address} ``` -------------------------------- ### Log Command Formatting Source: https://help.x64dbg.com/en/latest/introduction/Formatting.html When using the 'log' command, enclose the format string in quotes to prevent ambiguity with the semicolon separator. ```text log "{mem;8@rax}" ``` -------------------------------- ### Break on First Argument Value Source: https://help.x64dbg.com/en/latest/introduction/ConditionalBreakpoint.html This breakpoint will trigger only if the first argument passed to the function is equal to 1. Use 'arg.get(index)' to access arguments. ```x64dbg arg.get(0)==1 ``` -------------------------------- ### Module Functions Source: https://help.x64dbg.com/en/latest/introduction/Expression-functions.html Functions to retrieve information about loaded modules. ```APIDOC ## Modules ### `mod.party(addr)` Get the party number of the module `addr`. `0` is user module, `1` is system module. ### `mod.base(addr)` Get the base address of the module `addr`. ### `mod.size(addr)` Get the size of the module `addr`. ### `mod.hash(addr)` Get the hash of the module `addr`. ### `mod.entry(addr)` Get the entry address of the module `addr`. ### `mod.system(addr)` True if the module at `addr` is a system module. False: module is a user module. ### `mod.user(addr)` True if the module at `addr` is a user module. False: module is NOT a user module. ### `mod.main()` Returns the base of the main module (debuggee). If this is a DLL it will return `0` until loaded. ### `mod.rva(addr)` Get the RVA of `addr`. If `addr` is not inside a module it will return `0`. ### `mod.offset(addr)` Get the file offset of `addr`. If `addr` is not inside a module it will return `0`. ### `mod.isexport(addr)` True if `addr` is an exported function from a module. ### `mod.fromname(str)` Gets the module base for `str`. `0` if the module is not found. Example: `mod.fromname("ntdll.dll")`. ``` -------------------------------- ### Never Break Conditional Breakpoint Source: https://help.x64dbg.com/en/latest/introduction/ConditionalBreakpoint.html Use a break condition of '0' to execute commands or log data without pausing the debuggee. This is useful for monitoring specific events. ```x64dbg 0 ``` -------------------------------- ### Format Windows Error Name Source: https://help.x64dbg.com/en/latest/introduction/Formatting.html Use '{winerrorname@code}' to display only the name of a Windows error code. ```text {winerrorname@code} ``` -------------------------------- ### Plugin Custom Formatting Source: https://help.x64dbg.com/en/latest/introduction/Formatting.html Plugins can register custom string formatting functions using the syntax '{type;arg1;arg2;...;argN@expression}'. ```text {type;arg1;arg2;argN@expression} ``` -------------------------------- ### SetHardwareBreakpointCondition/bphwcond Source: https://help.x64dbg.com/en/latest/commands/conditional-breakpoint-control/SetHardwareBreakpointCondition.html Sets the hardware breakpoint condition. The condition is evaluated each time the breakpoint is hit. The debugger stops only if the condition is not 0. ```APIDOC ## SetHardwareBreakpointCondition/bphwcond ### Description Sets the hardware breakpoint condition. When this condition is set, it is evaluated every time the breakpoint hits and the debugger would stop only if condition is not 0. ### Arguments * `arg1` (address) - The address of the breakpoint. * `[arg2]` (expression) - The condition expression. ### Result This command does not set any result variables. ``` -------------------------------- ### Memory Inspection Functions Source: https://help.x64dbg.com/en/latest/introduction/Expression-functions.html Checks the validity, properties, and executable status of memory addresses. ```x64dbg expression mem.valid(addr) ``` ```x64dbg expression mem.base(addr) ``` ```x64dbg expression mem.size(addr) ``` ```x64dbg expression mem.iscode(addr) ``` ```x64dbg expression mem.decodepointer(ptr) ``` -------------------------------- ### Format Hexadecimal Source: https://help.x64dbg.com/en/latest/introduction/Formatting.html Use 'x' to format an expression as a hexadecimal value. This is the default for integer types. ```text x: 3C28A ``` -------------------------------- ### Format Unsigned Decimal Source: https://help.x64dbg.com/en/latest/introduction/Formatting.html Use 'u' to format an expression as an unsigned decimal integer. ```text u: 57329171 ``` -------------------------------- ### Resolve DLL Exports - x64dbg Source: https://help.x64dbg.com/en/latest/introduction/Values.html Use 'module.dll:api' or 'module:api' to resolve API addresses. Ordinals can be resolved with 'module:ordinal'. An empty module name uses the current module. A '?' instead of ':' prevents forwarding. ```assembly ntdll.dll:ZwContinue ntdll:memcmp ntdll.memcmp // same as above ntdll:1D // Ordinal 0x1D :myexport // Export 'myexport' in the current module ``` ```assembly kernel32:EnterCriticalSection // resolves to ntdll:RtlEnterCriticalSection kernel32?EnterCriticalSection // resolves to the export in kernel32 ``` -------------------------------- ### SetMemoryBreakpointLog/bpmlog Source: https://help.x64dbg.com/en/latest/commands/conditional-breakpoint-control/SetMemoryBreakpointLog.html Sets log text when a memory breakpoint is hit. If no log condition is specified, it logs unconditionally. Otherwise, it logs only when the logging condition is met. ```APIDOC ## SetMemoryBreakpointLog/bpmlog ### Description Sets log text when a memory breakpoint is hit. When log condition is not specified, it will always be logged regardless of the break condition, otherwise it will be logged when the logging condition is satisfied. ### Arguments - `arg1` (address) - The address of the breakpoint. - `[arg2]` (string) - The log format string (see introduction/formatting). ### Result This command does not set any result variables. ``` -------------------------------- ### SetHardwareBreakpointLogCondition Source: https://help.x64dbg.com/en/latest/commands/conditional-breakpoint-control/SetHardwareBreakpointLogCondition.html Sets the logging condition for a hardware breakpoint. If no logging condition is provided, log text will always be recorded. Otherwise, it will be logged only when the specified logging condition is met. ```APIDOC ## SetHardwareBreakpointLogCondition/bphwlogcondition ### Description Sets the logging condition of a hardware breakpoint. When log condition is not specified, log text always be logged regardless of the break condition, otherwise it will be logged when the logging condition is satisfied. ### Arguments - **arg1** (address) - The address of the breakpoint. - **[arg2]** (condition) - The logging condition (default condition when not specified). ### Result This command does not set any result variables. ``` -------------------------------- ### String Length Function Source: https://help.x64dbg.com/en/latest/introduction/Expression-functions.html Calculates the length of a given string. ```x64dbg expression strlen(str) ``` -------------------------------- ### Process Information Functions Source: https://help.x64dbg.com/en/latest/introduction/Expression-functions.html Retrieves addresses and identifiers related to the debugged process and its threads. ```x64dbg expression peb() ``` ```x64dbg expression teb() ``` ```x64dbg expression tid() ``` ```x64dbg expression kusd() ``` ```x64dbg expression KUSD() ``` ```x64dbg expression KUSER_SHARED_DATA() ``` -------------------------------- ### Disassembly Functions Source: https://help.x64dbg.com/en/latest/introduction/Expression-functions.html Functions to query information about instructions at a given address, such as length, type, operands, and disassembly text. ```APIDOC ## Disassembly Functions ### `dis.len(addr)` Get the length of the instruction at `addr`. ### `dis.iscond(addr)` True if the instruction at `addr` is a conditional branch. ### `dis.isbranch(addr)` True if the instruction at `addr` is a branch (jcc/call). ### `dis.isret(addr)` True if the instruction at `addr` is a `ret`. ### `dis.iscall(addr)` True if the instruction at `addr` is a `call`. ### `dis.ismem(addr)` True if the instruction at `addr` has a memory operand. ### `dis.isnop(addr)` True if the instruction at `addr` is equivalent to a NOP. ### `dis.isunusual(addr)` True if the instruction at `addr` is unusual. ### `dis.branchdest(addr)` Branch destination of the instruction at `addr` (what it follows if you press enter on it). ### `dis.branchexec(addr)` True if the branch at `addr` is going to execute. ### `dis.imm(addr)` Immediate value of the instruction at `addr`. ### `dis.brtrue(addr)` Branch destination of the instruction at `addr`. ### `dis.brfalse(addr)` Address of the next instruction if the instruction at `addr` is a conditional branch. ### `dis.next(addr)` Address of the next instruction from `addr`. ### `dis.prev(addr)` Address of the previous instruction from `addr`. ### `dis.iscallsystem(addr)` True if the instruction at `addr` goes to a system module. ### `dis.mnemonic(addr)` Returns the mnemonic `str` for `addr`. Example: `str.streq(dis.mnemonic(cip), "cpuid")`. ### `dis.text(addr)` Returns the instruction text as a string `addr`. Can be used for conditions, for example: `strstr(dis.text(rip), "rbx")`. **Note** : the instruction text might not exactly match the formatting in the GUI. ### `dis.match(addr, str)` True if the instruction at `addr` matches the regex in `str`. Example: `dis.match(rip, "test.+, 0x1")`. You can use `dis.text` to see what you can match on. ``` -------------------------------- ### Format Signed Decimal Source: https://help.x64dbg.com/en/latest/introduction/Formatting.html Use 'd' to format an expression as a signed decimal integer. ```text d: -3 ``` -------------------------------- ### String Reading Functions Source: https://help.x64dbg.com/en/latest/introduction/Expression-functions.html Reads null-terminated strings from memory addresses. Specify a count to truncate the string. Use .strict variants to cause a failure if the address cannot be read. ```x64dbg expression utf8(addr[, count]) ``` ```x64dbg expression utf16(addr[, count]) ``` ```x64dbg expression ansi(addr[, count]) ``` -------------------------------- ### String Functions Source: https://help.x64dbg.com/en/latest/introduction/Expression-functions.html Functions for reading and manipulating strings from memory addresses. ```APIDOC ## String Functions ### `utf8(addr[, count])` Reads a null-terminated UTF-8 string from `addr` and returns the string value. When a `count` is specified the string will be truncated. ### `utf16(addr[, count])` Reads a null-terminated UTF-16 string from `addr` and returns the string value. When a `count` is specified the string will be truncated. ### `ansi(addr[, count])` Reads a null-terminated ANSI string from `addr` and returns the string value. When a `count` is specified the string will be truncated. ### `strstr(str1, str2)` Find a substring. Example: `strstr(utf8(addr), "abc")`. ### `stristr(str1, str2)` Find a substring (case insensitive). ### `streq(str1, str2)` Compare two strings. Example: `streq(utf8(addr), "abc")`. ### `strieq(str1, str2)` Compare two strings (case insensitive). ### `strlen(str)` Calculates the length of a string. **Note:** The functions `ansi`/`utf8`/`utf16` can be used as inputs for other functions that take `str` arguments. If the `addr` cannot be read an empty string is returned. If you want to fail you can use the `.strict` variants (for example `utf8.strict(rax)`). The expression `utf8(rax)` does not return a number, so it cannot be used as a trace condition for example. ```