Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I recently heard about the esp trick: some packers push all registers on the stack, and when unpacking is done, they are restored. Placing a hardware breakpoint on esp we can stop there and get the original entry point.
Why is it necessary to use a hardware breakpoint? This site argues that because software breakpoints modify the code. But why is that a problem here?
Every example I met uses Ollydbg. How can I set such a breakpoint in gdb?
Placing a hardware breakpoint on esp we can stop there and get the original entry point.
Why is it necessary to use a hardware breakpoint?
The value of ESP is an address on the stack. The data at that memory address may get read or written, but won't get executed¹ since it's not code. Software breakpoints are only useful on code that gets executed, and since the data at that memory address won't get executed, a software breakpoint won't be helpful.
¹ There are exceptions to this, but it's out of context for your question.
How can I set such a breakpoint in gdb?
In gdb, you can set a hardware breakpoint on the memory address pointed to by ESP by setting a watchpoint, which is documented here.
