2

My issue is all about setting the breakpoint on x64 Windbg. For x86 to combine IDA and Windbg analysis nothing is required. Just copy and paste the IDA address value and it works just fine. For instance, in x86 I have sub_401000, so, the corresponding breakpoint is set by bp 401000
In x64 I have address sub_140001000, so, I'm trying to set as follows bp 140001000 and get no result at all. Application won't reach my breakpoint. That's why, I've just set bp 1401172F1 that reaches the address of interest for sure.

But now I've faced with error

Unable to insert breakpoint 0 at 00000001`401172f1, Win32 error 0n998
The breakpoint was set with BP.  If you want breakpoints
to track module load/unload state you must use BU.
bp0 at 00000001`401172f1 failed
WaitForEvent failed

All these answers make sense, but setting breakpoint for this rva leads to error for some reason. Maybe I should try something else?

0:000> lmi
start             end                 module name            
00000000`77570000 00000000`77719000   ntdll      (pdb symbols)          C:\Windows\SYSTEM32\ntdll.dll
00000000`77740000 00000000`77743000   normaliz   (deferred)             
00000001`3fd90000 00000001`402e0000   module_of_interest   (no symbols)
  • 1
    Your application is probably relocated to a different address due to ASLR... – newgre Apr 4 '14 at 22:41
2

The error is due to the specified address belonging to an unmapped page. Normally, you would follow the advice in the debugger and use 'bu', which monitors new memory maps and adds the breakpoint when that page is mapped (soft breakpoints write opcodes to the memory location).

In this case, it appears that you are trying to break on the main executable, which should be loaded before you are given interactive access in the debugger. It's likely that ASLR has relocated your main image. You can use the 'lm' command or access the loaded modules dialog through the toolbar to observe the base address of the module you are interested in.

The preferred base address from the PE header is what IDA uses when loading the image. Subtract the base address shown in IDA (140001000) from your target address (00000001401172f1) to get the RVA (1162f1), and add that to the base address indicated by the module list in Windbg.

2

confirm if addres is accessible and correct

u 0x1```401172f1 
or
db 0x1`401172f1 `

then set a bp 0x1 ``401172f1

preferably sign/zero extend the address using backticks when you are not using a symbol to set breakpoints

deferred breakpoints (Bu breakpoints) are more versatile than bp breakpoints as they are tied to symbol and not to specific address and thus are not influenced by aslr / loading / unloading of images

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.