What is Hardware Breakpoint and when we need to use it?

Question

In part 5 of the lena151 RE tutorial I saw the Hardware BP. The explanation he gave was very difficult for me to understand.

Can anyone explain what is a hardware breakpoint and when we need to use it?

Answer 1

The short answer:

From the user point of view, software breakpoints are only for instructions, and you may set them as many as you want, while hardware breakpoints are universal, but you may use only a few of them (typically 4) at the same time.

TL,DR;

The hardware breakpoints are implemented by a special logic circuit integrated directly in the CPU, connected to

• the address bus on the one side, and
• the special debug registers on the other one.

To set a hardware breakpoint, you fill the debug registers (generally indirectly by your debugger) with this information:

• the (starting) address,
• the length (byte, word, or double-word),
• the access mode to watch for (read, read/write, or instruction execution),
• the local/global mode (not used for the decision whether the code execution have to break).

You may do it only for small number of addresses, it's hardware dependent, the common number is 2 to 6 (e.g. for x86 you may set 4 hardware breakpoints: addresses are written to the debug registers DB0 to DB3, while other info — for all addresses individually as appropriate bit flags — to the DB7 register).

The circuit watches every access to the memory (RAM or ROM) and compares address, length, and access mode with values in the debug registers. If they correspond, the circuit sends the Halt signal and the debugger interrupts the execution of the debugged program.

---

So the differences between hardware breakpoints (HB) and software ones (SB) are:

1. In the number of them:

   • you may set as many SBs as you wish, but
   • only very small number of HBs (typically 4).

2. In usability:

   • SB is set to a particular instruction (there is no way to set them for memory access), while
   • HB is set to address ranges and for the desired access mode.

3. In the applicable type of memory:

   • SB writes into memory (the INT 3 instruction in the place of the first byte of the watched instruction), so it is not capable to set a breakpoint for instruction in read-only memory (ROM), while
   • HB don't write anything into memory, so it has not such a limitation.

4. In the speed (hardware is always faster than software, so HB is faster than SB).

For example, if you know the address of some string in memory and you are interested when it will be read, SB doesn't help you, but HW does.

---

Some references:

• Debug registers for x86
• Debug Registers on Intel x86 Processor Architecture (with or without VT-x)
• x86 architecture debug registers