1

I need to set a break point when a specific module address space is being overwritten? I need to specify this by module name not address space

  • 2
    Hi and welcome to RE.SE. By writing address space you mean a vast range of addresses? Given you have a limited number of debug registers, this may be hard to accomplish outside of some kind of binary instrumentation or even emulation framework. – 0xC0000022L Oct 29 '18 at 14:40
1

i cant understand what your usecase is assuming you have some code like this running and you want to break when some thing is written to some space you can use ba (hardware assisted breakpoint )

code for demo it writes randomly the @ sign in a space of 0x2000 bytes

#include <stdio.h>
#include <stdlib.h>
#include <time.h>
char randritebuff[0x2000];
int main (void) {
    srand( (unsigned int)time(nullptr));
    for(;;) {
    int writeaddr = ((rand() % 0x1fff)+1);
    randritebuff[writeaddr] = 0x40;
    }
}

assuming you are interested in seeing only when it writes at the 1337th
byte from the start of buffer

you can employ a breakpoint with module names as well as symbols for the buffer if they are available in windbg like this

00eb102e c682d198ef0040  mov byte ptr randrite!randritebuff+0x1 (00ef98d1)[edx],40h ds:0023:00efacd9=00

0:000> ba w1 randrite!randritebuff+0x1337  <<<<<<<<<<<<<<<<<<<<<< 
0:000> bl
     0 e Disable Clear  00efac07 w 1 0001 (0001)  0:**** randrite!randritebuff+0x1337

0:000> ? randrite!randritebuff
Evaluate expression: 15702224 = 00ef98d0

0:000> ? 00ef98d0+1337
Evaluate expression: 15707143 = 00efac07

0:000> g
Breakpoint 0 hit
eax=00000003 ebx=7ffdf000 ecx=00007333 edx=00001336 << 
a hardware breakpoint break with eip @ + 1  (00eb102e + sizeof(c682d198ef0040))

00eb1035 << ebef            jmp     randrite!main+0x16 (00eb1026)

a screenshot below enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.