I can set a
DWORD memory read/write access breakpoint in WinDbg with the following command:
ba r 4 0x0307F42C
But is there a way to set more than 4 of those?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
Those are called hardware breakpoints and are related to debug registers in the CPU. There are usually 6 of them but only DR0-DR3 used to specify an address for hardware breakpoints.
Although windbg does not support memory breakpoints, memory breakpoints are another common approach to place breakpoints based on memory access instead of code execution.
Although most debuggers implement that internally, memory breakpoints work by setting the
PAGE_GUARD bit for all pages in the memory breakpoint address range, and then filtering any exceptions caught for the specific ranges within the pages, and then resetting the page guard.
You can do something similar by placing a page guard yourself using windbg, however that's a lot of effort.
It is important to note that memory breakpoints are detectable with little effort and may dramatically slow execution (even further down than debugging), when debugging a piece of software with anti-debugging protection make sure you pay attention.