3

Is there a way to set memory breakpoint on Access on IDA in Win32 debugger... like we do in Olly from the memory window ?

I tried to do that with the example "UnPackMe_NoNamePacker.d.out.exe" in 20th tutorial in lena series, but it's never triggered. Actually, after setting the memory bp on "text" seg., the app won't run ! Here is the file: https://tuts4you.com/download.php?view.141

Improve this question

1 Answer 1

Reset to default
4

IDA doesn't do the kind of memory breakpoints that Olly implements. Olly implements memory breakpoints by changing the page protection, catching the exception, and then examining some extra data to see if it's one of its own memory "breakpoints". IDA only allows you to do regular software breakpoints (CC), and hardware breakpoints(DR0-DR3).

That being said, if you'd like to break on a memory access using IDA's debugger, you'll have to use a regular hardware breakpoint. You simply click the DWORD in memory you'd like to break on, and then click Debugger -> Breakpoints -> Add Breakpoint. IDA will automatically populate the address of the DWORD in the "Location" field, and then you can set whatever other options you wish.

If you want to set a breakpoint on an entire section similar to what you'd do from the Memory Map view in Olly, do the following:

  1. In debugger mode, click View -> open Subviews -> Program Segmentation.
  2. Right-click on ".text" or whatever other segment you need.
  3. Click "Break on Access"

This will set a hardware breakpoint that will trigger on read and write. For this particular sample, that causes a problem since the packer obviously needs to read and write that section to unpack. So once you set the breakpoint, press Ctrl-Alt-B, and edit that breakpoint to only trigger on execute. Btw, you can also do this from the regular disassembly view as well by clicking Window -> Program Segmentation.

I'm not quite sure why your program won't run. I stepped through to the "IsDebuggerPresent" check, modified the zero flag(Addr: 0x46BB1F), set the aforementioned hardware breakpoint, and the program ran and unpacked just fine. It does take a few seconds to unpack though, at least on my box. Double check your breakpoint settings, and verify that the following options are checked: "enabled", "hardware", "break", "execute", and that the address location is 0x401000. If you did this from the segmentation window, then the size should be 0x4A000. (It really doesn't need to be this big).

Here's some more information on breakpoints if you're interested.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.