2

In part 5 of the lena151 RE tutorial I saw the Hardware BP. The explanation he gave was very difficult for me to understand.

Can anyone explain what is a hardware breakpoint and when we need to use it?

4

The short answer:

From the user point of view, software breakpoints are only for instructions, and you may set them as many as you want, while hardware breakpoints are universal, but you may use only a few of them (typically 4) at the same time.

TL,DR;

The hardware breakpoints are implemented by a special logic circuit integrated directly in the CPU, connected to

  • the address bus on the one side, and
  • the special debug registers on the other one.

enter image description here

To set a hardware breakpoint, you fill the debug registers (generally indirectly by your debugger) with this information:

  • the (starting) address,
  • the length (byte, word, or double-word),
  • the access mode to watch for (read, read/write, or instruction execution),
  • the local/global mode (not used for the decision whether the code execution have to break).

You may do it only for small number of addresses, it's hardware dependent, the common number is 2 to 6 (e.g. for x86 you may set 4 hardware breakpoints: addresses are written to the debug registers DB0 to DB3, while other info — for all addresses individually as appropriate bit flags — to the DB7 register).

The circuit watches every access to the memory (RAM or ROM) and compares address, length, and access mode with values in the debug registers. If they correspond, the circuit sends the Halt signal and the debugger interrupts the execution of the debugged program.


So the differences between hardware breakpoints (HB) and software ones (SB) are:

  1. In the number of them:

    • you may set as many SBs as you wish, but
    • only very small number of HBs (typically 4).
  2. In usability:

    • SB is set to a particular instruction (there is no way to set them for memory access), while
    • HB is set to address ranges and for the desired access mode.
  3. In the applicable type of memory:

    • SB writes into memory (the INT 3 instruction in the place of the first byte of the watched instruction), so it is not capable to set a breakpoint for instruction in read-only memory (ROM), while
    • HB don't write anything into memory, so it has not such a limitation.
  4. In the speed (hardware is always faster than software, so HB is faster than SB).

For example, if you know the address of some string in memory and you are interested when it will be read, SB doesn't help you, but HW does.


Some references:

1
  • In actual practice of applying dynamic analysis on code with a debugger, the difference that really is significant is that software breakpoints can be overwritten (and modify contents of program memory). This is especially important if you are dealing with self -modifying code or code that writes to the executable sections of memory (ie unpackers) For example if you know OEP is at address X and you want to run till you hit that address from EP, you need to use a hw breakpoint because the unpacking stub will overwrite your int3 breakpoint at oep. Other more complex nuances as well.
    – Jeremy
    Jul 26 at 11:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.