2

I can set a DWORD memory read/write access breakpoint in WinDbg with the following command:

ba r 4 0x0307F42C

But is there a way to set more than 4 of those?

  • ba is a processor breakpoint (hardware breakpoints). use bp instead. For more breakpoints in radare2, read here. – Megabeets Jun 23 '18 at 11:18
  • @Megabeets: I'm not sure if I'm using that bp correctly. Say, I have a DWORD in memory that I want to track. I call bp 03DBF450. I then do bl and receive 1 e 03dbf450 0001 (0001) 0:**** but then if I run the debuggee I get an exception from IDA pro: 779A2228: The instruction at 0x779A2228 referenced memory at 0x14. The memory could not be written -> 00000014 (exc.code c0000005, tid 5928) and the debuggee crashes. This doesn't happen if I don't use bp command. – c00000fd Jun 23 '18 at 19:25
5

Those are called hardware breakpoints and are related to debug registers in the CPU. There are usually 6 of them but only DR0-DR3 used to specify an address for hardware breakpoints.

  • OK. It makes sense. So what do I use instead to set the 5th breakpoint on memory access? – c00000fd Jun 23 '18 at 19:26
  • Nothing. You can have only 4 breakpoints on memory access. – Paweł Łukasik Jun 23 '18 at 21:03
  • Hmm. Thanks. Is it a limitation in WinDbg or is it pretty much how all debuggers operate? – c00000fd Jun 24 '18 at 0:24
  • 2
    @c00000fd: the limitation, to my knowledge, is a limitation of the ISA rather than the software. – 0xC0000022L Jun 24 '18 at 20:36
  • 3
    instruction set architecture ( intel att x86 x64 itanium 32 bit 64 bit mips sparc p4 p3 8086 80386 etc etc ) – blabb Jun 25 '18 at 3:13
1

Although windbg does not support memory breakpoints, memory breakpoints are another common approach to place breakpoints based on memory access instead of code execution.

Although most debuggers implement that internally, memory breakpoints work by setting the PAGE_GUARD bit for all pages in the memory breakpoint address range, and then filtering any exceptions caught for the specific ranges within the pages, and then resetting the page guard.

You can do something similar by placing a page guard yourself using windbg, however that's a lot of effort.

It is important to note that memory breakpoints are detectable with little effort and may dramatically slow execution (even further down than debugging), when debugging a piece of software with anti-debugging protection make sure you pay attention.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.