3

I recently heard about the esp trick: some packers push all registers on the stack, and when unpacking is done, they are restored. Placing a hardware breakpoint on esp we can stop there and get the original entry point.

Why is it necessary to use a hardware breakpoint? This site argues that because software breakpoints modify the code. But why is that a problem here?

Every example I met uses Ollydbg. How can I set such a breakpoint in gdb?

1 Answer 1

5

Placing a hardware breakpoint on esp we can stop there and get the original entry point.

Why is it necessary to use a hardware breakpoint?

The value of ESP is an address on the stack. The data at that memory address may get read or written, but won't get executed¹ since it's not code. Software breakpoints are only useful on code that gets executed, and since the data at that memory address won't get executed, a software breakpoint won't be helpful.

¹ There are exceptions to this, but it's out of context for your question.

How can I set such a breakpoint in gdb?

In gdb, you can set a hardware breakpoint on the memory address pointed to by ESP by setting a watchpoint, which is documented here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.