I can set a DWORD memory read/write access breakpoint in WinDbg with the following command:
ba r 4 0x0307F42C
But is there a way to set more than 4 of those?
2 Answers
Those are called hardware breakpoints and are related to debug registers in the CPU. There are usually 6 of them but only DR0-DR3 used to specify an address for hardware breakpoints.
answered Jun 23, 2018 at 10:30
-
OK. It makes sense. So what do I use instead to set the 5th breakpoint on memory access?– c00000fdCommented Jun 23, 2018 at 19:26
-
Nothing. You can have only 4 breakpoints on memory access. Commented Jun 23, 2018 at 21:03
-
Hmm. Thanks. Is it a limitation in WinDbg or is it pretty much how all debuggers operate?– c00000fdCommented Jun 24, 2018 at 0:24
-
2@c00000fd: the limitation, to my knowledge, is a limitation of the ISA rather than the software.– 0xC0000022L ♦Commented Jun 24, 2018 at 20:36
-
3instruction set architecture ( intel att x86 x64 itanium 32 bit 64 bit mips sparc p4 p3 8086 80386 etc etc )– blabbCommented Jun 25, 2018 at 3:13
Although windbg does not support memory breakpoints, memory breakpoints are another common approach to place breakpoints based on memory access instead of code execution.
Although most debuggers implement that internally, memory breakpoints work by setting the PAGE_GUARD bit for all pages in the memory breakpoint address range, and then filtering any exceptions caught for the specific ranges within the pages, and then resetting the page guard.
You can do something similar by placing a page guard yourself using windbg, however that's a lot of effort.
It is important to note that memory breakpoints are detectable with little effort and may dramatically slow execution (even further down than debugging), when debugging a piece of software with anti-debugging protection make sure you pay attention.
bais a processor breakpoint (hardware breakpoints). usebpinstead. For more breakpoints in radare2, read here.bpcorrectly. Say, I have a DWORD in memory that I want to track. I callbp 03DBF450. I then dobland receive1 e 03dbf450 0001 (0001) 0:****but then if I run the debuggee I get an exception from IDA pro:779A2228: The instruction at 0x779A2228 referenced memory at 0x14. The memory could not be written -> 00000014 (exc.code c0000005, tid 5928)and the debuggee crashes. This doesn't happen if I don't usebpcommand.