Questions tagged [breakpoint]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
171 views

In x64dbg, how to set software breakpoint on specific memory address?

This is something I know how to do in Olly Debugger, and can't figure out how to do in x64dbg. In Olly Debugger, it's possible to set a hardware or software breakpoint, either on access or on write, ...
1
vote
2answers
41 views

Debug registers (DRx) keep getting trampled when using with SetThreadContext

I'm trying to set hardware breakpoints from code by using Get/SetThreadContext and modifying DR0..3, DR7, but it only works if I do it repeatedly. Most of the time when I use Get after having used Set ...
1
vote
1answer
59 views

Set gdb breakpoint by address with gdb python

into GDB python I tried gdb.Breakpoint('0xaaaa') I got error Function 0xaaaa is not defided . Breakpoint 5(0xaaaa) pending and the program not break at this address. Why is that?
1
vote
1answer
118 views

How to let SIGTRAP get caught by sighandler in GDB?

I have a program that I am trying to reverse, which contains an int3 (0xCC) which emits a SIGTRAP signal, which is then handled by a sighandler defined in sigaction. The handler performs calculations ...
0
votes
0answers
33 views

Conditional breakpoint on register containing string catch everything

I am trying to setup a conditional breakpoint to catch a specific string ("Sessions") that will be on ESI register but it catches everything: I also tried with dereferenced register [ESI] ==...
0
votes
0answers
54 views

Does virtualized code hit hardware breakpoints?

I am trying to dynamically analyze a VMProtected malicious executable. However I am not familiar with virtualization so I was wondering if hardware breakpoints are hit in virtualized pieces of code? I ...
0
votes
1answer
225 views

Calling/debugging calls to DLL via ollydbg or x64dbg

I have used dependency walker on a DLL of an old game from 2001. I have found a function which I want to be able to analyze. I see the name of the function and the entry point (at the end). How do I ...
0
votes
0answers
42 views

Is there an event log to check when WinDbg kernel debugger fails to attach on OS load?

I'm using the latest WinDbg (Preview) to do kernel debugging on a Windows 10 client (v 1909) via a network connection in a VM. And I'm wondering if there's a log that the kernel debugger maintains? I ...
0
votes
1answer
203 views

Can I force GDB breakpoints and disassemble?

Sorry English isn't my first language. I noticed something when setting breakpoints in GDB. It appears that they are ignored if symbols aren't loaded. I have found it weird how GDB behaves when there ...
0
votes
0answers
30 views

Is it posible to break at string when it being use by program?

Like the title, i need to break at an url string when it being used by program. I try memory break point but it will break at begin of the section. I use x64dbg.
1
vote
1answer
296 views

x64dbg, breakpoint on write in memory with specific value

In x64dbg, we can set hardware breakpoint on write in memory dump but can we add more codition? Ex. Set breakpoin on write of value of 2F.
0
votes
1answer
69 views

Trace back regularly used .data variable in IDA

I am reversing Cryptex.exe 1.0 from Eldad. There is unknown-data buffer address stored in edx which gets used as parameter for CryptHashData, which will hash 20 Bytes from there. Now I want to find ...
1
vote
1answer
205 views

Windbg: “gu” command inside of a breakpoint causes warning

I'm trying to leverage "gu" command in a conditional breakpoint or as a "CommandString" in a regular breakpoint. For example let's consider break on a malloc() function when we want to see in logs ...
2
votes
1answer
225 views

Anti-debug clearing hardware breakpoints

An application I am debugging somehow manages to clear my hardware breakpoints. I am using TitanHide and x64dbg. I am observing the following behaviour: When placing the first hw breakpoint, it is ...
0
votes
1answer
371 views

IDA Pro ignores condition in breakpoint

Look at the condition. It is supposed to break only when the R2 is 40, but it breaks in any call to this instruction. I'm using IDA Pro 7.2.181105, debugging with Remote GDB Debugger, an ARMv4T code. ...
0
votes
1answer
833 views

x64dbg: break when a register contains a value

Is there a way to break code execution when a register contains a particular value with x64dbg? I'm not talking about setting a conditional breakpoint at a specific location, but about watching the ...
1
vote
1answer
156 views

How can I navigate to the Disassembly address location?

I'm using x32dbg and I've set a hardware memory breakpoint. It triggers successfully for a specified module and the debugger pauses and a message on the bottom says: Hardware breakpoint (byte, read/...
1
vote
2answers
2k views

How to debug a DLL written in .NET/C#?

I want to reverse engineer an application written in C#. I would like to set a breakpoint at a function and observe the input passed to it during the normal course of the application's functioning.
1
vote
2answers
271 views

Ollydbg: How to set a conditinal breakpoint for a register gets special value

I read this question about "set conditional break point on a register value" ; but its about setting a bp on special address! I want to set a bp when for example ECX == 12345678 , i can do this on ...
1
vote
0answers
49 views

Breakpoints in InProc COM object .dll?

I have a very simple exe that just uses CoCreateInstance to load a COM dll. This dll contains 1 function. I know where it is, I know what it's called etc. I know where in the exe it calls it. But ...
1
vote
0answers
181 views

Process terminating when breakpoint reached

I want to set breakpoint on the recv function to replace the received packets. But, I can not put breakpoint on any instruction in the program, the process simply closes with code 4000001f. I also ...
1
vote
1answer
255 views

Setting a conditional kernel breakpoint in WinDbg grinds the debuggee OS to a halt

My setup: Debugger: Win10 Pro, WinDbg Preview v.1.0.1904.18001 Debuggee: Win7 Pro (running in a VM using VMWare Workstation) I'm trying to follow the SendMessage call from the user space: Into the ...
5
votes
1answer
647 views

function call trace with radare2 or break on all function call

I want to script with python using r2pipe. Is there a way that when debugging I can break on each call function, thus I can get the parameter? What's more, I won't jump into system library. Or is ...
1
vote
1answer
281 views

Is there watchpoints in radare2?

Is there any way to put breakpoints in radare2 that trigger when an address is read/write? In GDB those are call watchpoints ('rwatch' or 'awatch") I got this from radare2 [0xB7F08810]> !dr? ...
4
votes
0answers
264 views

Using GDB to trace guest OS inside a hypervisor, the whole running on Qemu - kvm

I use Gdb to trace the execution (breakpoint, single stepping, ...) of a hypervisor OS in Qemu and it works fine so far. qemu-system-x86_64 -enable-kvm -display sdl -cpu host -serial my: stdio -m ...
1
vote
1answer
740 views

x64dbg how to set conditional breakpoint on WinAPI function

I am trying to solve a GUI based crackme. https://crackmes.one/crackme/5c68758633c5d4776a837cc4 so that I learn security. I want to set a conditional Break point on user32.CallWindowProcA. Microsoft ...
1
vote
1answer
249 views

GUARD_PAGE memory breakpoints with gdb?

I came across a question the other day on reddit: How can we use PAGE_GUARD-based memory breakpoints in GDB (not hardware breakpoints)? Ollydbg, x64dbg and IDA PRO all support these types of ...
1
vote
2answers
669 views

Generate software breakpoint other than int3

Is it possible to generate a software breakpoint other than int3 to be catched by the debugger, like a division by zero for example? If so, I was wondering why debuggers don't support generating ...
0
votes
1answer
6k views

How to print the value of register with Radare 2

I am trying to solve this ELF - Ptrace challenge. I use Radare 2. This is the commands I execute to print the assembly code. radare2 ch3.bin [0x080482f0]> aaa [[anal.jmptbl] Missing cjmp bb in ...
0
votes
1answer
2k views

x64dbg - Conditional breakpoint based on function argument

How can I set a conditional breakpoint based on the argument of a function? I am trying to break on the windows function LoadLibraryExW: https://docs.microsoft.com/en-us/windows/desktop/api/...
1
vote
1answer
914 views

How int3 looks like in C

This is assembly code that can catch debugger with int 3 : MOV ECX, ExceptionHandler MOV DWORD PTR FS:[0], ExceptionHandler INT3 ///there is debugger!!! ExceptionHandler: ////no ...
1
vote
1answer
169 views

rip adress not visible with dr command

I just finished this challenge. This is the content of main function : [0x08048a86]> pdf / (fcn) main 417 | main (int argc, char **argv, char **envp); | ; var int local_16h @ ebp-0x16 |...
3
votes
1answer
146 views

Debug point not hit with radare2

I am doing this reverse engenering challenge. I executed theses commands to analyse the main function : radare2.exe ch15.exe aaa s main pdf This is the output of the pdf command : [0x004017b8]> ...
1
vote
1answer
3k views

Impossible to execute a program with radare2 : TO DO continue

I am trying to crack a crackme. I already catch the flag because I seen the string variable which represants flag. I would like to catch the flag on an other way, I want to set a breakpoint when there ...
2
votes
1answer
147 views

Is there any way to export breakpoint with IDA Pro?

As the title describes, I'd like to export breakpoints in IDA Pro and load from another project. Is there such feature?
1
vote
1answer
1k views

Understand hardware breakPoint option in ida

When I set a hardware breakpoint I see the following dialog: I understand that Read/Write is meant to break into the debugger when the address that I choose for the breakpoint is read or written. I ...
2
votes
2answers
1k views

How to set a Mouse Click BreakPoint in OllyDbg?

In the debugger program OllyDbg, How do I set a breakpoint when the left mouse button is pressed? It doesn't matter what it clicks on, so upon mouse click, the breakpoint stops the debugger.
1
vote
1answer
191 views

How to set hardware breakpoint by value?

I want to set in IDA breakpoint when a specific value is written on the stack. I know how to set hardware breakpoint, but I can set it only by address.
1
vote
1answer
246 views

Why doesn't IDA break on the WriteFile function?

I searched all places in IDA that call the imported WriteFile function and put a breakpoint on them. But while debugging I saw with ProcMon that my exe wrote to the file but even though it did not ...
0
votes
1answer
1k views

How to breakpoint atached process with ida when move on

In IDA pro, there is an option to attach to a process using the WinDbg backend. When I want is to see the process' control flow when the IDA attaches to it. The only way (that I know) to see the ...
0
votes
2answers
1k views

How to breakpoint exe tcp packet

I am debugging an executable in windows with IDA. My exe sends a TCP packet and I want to see which function it uses to send the packets. I looked on the import tab and haven't found any function ...
2
votes
0answers
91 views

Ignore some locations in Windbg Conditional breakpoints

I'm trying to set a conditional hardware breakpoint on Windows Kernel-Mode in Windbg by using the following syntax : ba w1 ffff802312345678 "j(@rip==ffff802387654321 || @rip==ffff802387654330) 'gc';''...
2
votes
1answer
380 views

Ida break point on address changed

How can I set break point when the value on specific address is changed while I debug it with ida
2
votes
2answers
1k views

Can I set more than 4 memory access breakpoints in WinDbg?

I can set a DWORD memory read/write access breakpoint in WinDbg with the following command: ba r 4 0x0307F42C But is there a way to set more than 4 of those?
1
vote
0answers
164 views

Prevent windbg from context switching when stepping into assembly instructions

When I'm using Windbg (in kernel mode) to step into assembly, I would encounter context switching once in a while - which is annoying. So, for example, I placed a breakpoint for a process - let's ...
1
vote
0answers
266 views

Failed to set breakpoint (Anti-debug protection)

Sorry for my bad English in advance. There is a program that has some protection. The problem is I can not set hardware and software breakpoints in x64dbg (to be more precise - not everywhere), cuz ...
1
vote
1answer
2k views

How to list breakpoints in radare2?

in gdb to list active breakpoints is info b how to do the same in radare2? is there any similar command in radare2 or something else?
1
vote
1answer
1k views

Is it possible to set breakpoints relatively to the memory block in x64dbg or a similar debugger?

Some of my breakpoints perfectly survive multiple restarts. But many interesting parts of the code I am debugging have different locations in memory after a restart. It seems the reason is, that the ...
1
vote
0answers
159 views

windbg stopped after I set up a breakpoint, keeping busing

I'm studying reverse engineering, I wrote the following code to see how it is to pass struct variables in the disassembly. struct s { int a; int b; int c; }; struct s get_some_values(int ...
1
vote
1answer
1k views

Simple Debugger and Hardware BreakPoints in x64 Windows 10

I have coded a very simple Debugger for x64, I am using currently Win10. I am trying to set some Hardware Breakpoints to be trapped by my Debugger Loop as follows: inline void SETBITS(DWORD64 *dw, ...