Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [breakpoint]

The tag has no usage guidance.

-1
votes
0answers
49 views

How int3 looks like in C

This is assembly code that can catch debugger with int 3 : MOV ECX, ExceptionHandler MOV DWORD PTR FS:[0], ExceptionHandler INT3 ///there is debugger!!! ExceptionHandler: ////no ...
0
votes
1answer
42 views

rip adress not visible with dr command

I just finished this challenge. This is the content of main function : [0x08048a86]> pdf / (fcn) main 417 | main (int argc, char **argv, char **envp); | ; var int local_16h @ ebp-0x16 |...
2
votes
1answer
45 views

Debug point not hit with radare2

I am doing this reverse engenering challenge. I executed theses commands to analyse the main function : radare2.exe ch15.exe aaa s main pdf This is the output of the pdf command : [0x004017b8]> ...
1
vote
1answer
98 views

Impossible to execute a program with radare2 : TO DO continue

I am trying to crack a crackme. I already catch the flag because I seen the string variable which represants flag. I would like to catch the flag on an other way, I want to set a breakpoint when there ...
2
votes
1answer
91 views

Is there any way to export breakpoint with IDA Pro?

As the title describes, I'd like to export breakpoints in IDA Pro and load from another project. Is there such feature?
1
vote
1answer
145 views

Understand hardware breakPoint option in ida

When I set a hardware breakpoint I see the following dialog: I understand that Read/Write is meant to break into the debugger when the address that I choose for the breakpoint is read or written. I ...
2
votes
2answers
150 views

How to set a Mouse Click BreakPoint in OllyDbg?

In the debugger program OllyDbg, How do I set a breakpoint when the left mouse button is pressed? It doesn't matter what it clicks on, so upon mouse click, the breakpoint stops the debugger.
1
vote
1answer
69 views

How to set hardware breakpoint by value?

I want to set in IDA breakpoint when a specific value is written on the stack. I know how to set hardware breakpoint, but I can set it only by address.
1
vote
1answer
90 views

Why doesn't IDA break on the WriteFile function?

I searched all places in IDA that call the imported WriteFile function and put a breakpoint on them. But while debugging I saw with ProcMon that my exe wrote to the file but even though it did not ...
0
votes
0answers
129 views

How to debug 1 step after click on button?

I am debugging an executable file with IDA and put a breakpoint at the place that I see 2 buttons. I want to know which function is executed when I click on one of the buttons and witch one is ...
0
votes
1answer
63 views

How to breakpoint atached process with ida when move on

In IDA pro, there is an option to attach to a process using the WinDbg backend. When I want is to see the process' control flow when the IDA attaches to it. The only way (that I know) to see the ...
0
votes
2answers
117 views

How to breakpoint exe tcp packet

I am debugging an executable in windows with IDA. My exe sends a TCP packet and I want to see which function it uses to send the packets. I looked on the import tab and haven't found any function ...
2
votes
0answers
45 views

Ignore some locations in Windbg Conditional breakpoints

I'm trying to set a conditional hardware breakpoint on Windows Kernel-Mode in Windbg by using the following syntax : ba w1 ffff802312345678 "j(@rip==ffff802387654321 || @rip==ffff802387654330) 'gc';''...
2
votes
1answer
81 views

Ida break point on address changed

How can I set break point when the value on specific address is changed while I debug it with ida
2
votes
2answers
253 views

Can I set more than 4 memory access breakpoints in WinDbg?

I can set a DWORD memory read/write access breakpoint in WinDbg with the following command: ba r 4 0x0307F42C But is there a way to set more than 4 of those?
1
vote
0answers
53 views

Prevent windbg from context switching when stepping into assembly instructions

When I'm using Windbg (in kernel mode) to step into assembly, I would encounter context switching once in a while - which is annoying. So, for example, I placed a breakpoint for a process - let's ...
1
vote
0answers
103 views

Failed to set breakpoint (Anti-debug protection)

Sorry for my bad English in advance. There is a program that has some protection. The problem is I can not set hardware and software breakpoints in x64dbg (to be more precise - not everywhere), cuz ...
1
vote
1answer
373 views

How to list breakpoints in radare2?

in gdb to list active breakpoints is info b how to do the same in radare2? is there any similar command in radare2 or something else?
1
vote
1answer
238 views

Is it possible to set breakpoints relatively to the memory block in x64dbg or a similar debugger?

Some of my breakpoints perfectly survive multiple restarts. But many interesting parts of the code I am debugging have different locations in memory after a restart. It seems the reason is, that the ...
1
vote
0answers
73 views

windbg stopped after I set up a breakpoint, keeping busing

I'm studying reverse engineering, I wrote the following code to see how it is to pass struct variables in the disassembly. struct s { int a; int b; int c; }; struct s get_some_values(int ...
1
vote
1answer
430 views

Simple Debugger and Hardware BreakPoints in x64 Windows 10

I have coded a very simple Debugger for x64, I am using currently Win10. I am trying to set some Hardware Breakpoints to be trapped by my Debugger Loop as follows: inline void SETBITS(DWORD64 *dw, ...
1
vote
1answer
216 views

Overriding the second argument with conditional breakpoints

With conditional breakpoints I'm able to alter the return value of a function. For example, when setting a breakpoint on the return instruction, the following IDC expression ensures that the function ...
4
votes
1answer
2k views

Detecting hardware breakpoints

Since software breakpoints, unlike hardware breakpoints , do change the code, it's relatively easy to write a program that performs a checksum on itself as an anti-debugger technique. Is it possible ...
3
votes
1answer
221 views

Why lldb seems to not stop at breakpoints?

While reverse engineering an iPhone app remotely, I set up breakpoints to some function's adresses. These adresses comes from the disassembled binary analysed with Hopper, and it seems like they must ...
4
votes
2answers
2k views

How to break when specific text is found

In this line of code: mov eax,dword ptr [eax+8]; eax+8 contains a long string of text, I want to find out where it originally came from. In either OllyDbg or x32dbg, how can I break when ...
3
votes
1answer
128 views

How does the processor distinguishes processes wrt HW bps?

When setting a hardware breakpoint (DR0...), this stores an address (as far as I can see, it looks like a virtual address). Because addresses are shared between processes (at least in 32 bits this can ...
1
vote
1answer
192 views

What is the difference between binary instrumentation and software breakpoints?

Don't be confused by a title of a question. Here is an explanation. Let's take Intel Pin. They claim that The best way to think about Pin is as a "just in time" (JIT) compiler. The input to ...
3
votes
1answer
509 views

Why doesn't the breakpoint get hit in gdb?

I was following the writeup of the challenge tehran. If I set a breakpoint 0x804bade, it never gets hit for the following input. begin() { fillout(0x8048000, 16384, 7); puts("%144c%n", 42, ...
0
votes
1answer
248 views

Why can't gdb find symbol which IDA can?

I was reversing this binary. While I tried to set a breakpoint in gdb on main function, it couldn't find its definition. Loading up the same binary in IDA shows up main method in the Function pane. ...
6
votes
1answer
988 views

OllyDbg: How to set a conditional breakpoint for a value anywhere in the stack?

I know how to set conditional breakpoints on a register, but how can I have a breakpoint trigger if a specific value (say, 0x12345678) appears anywhere in the active call stack frame?
2
votes
1answer
2k views

Immunity Debugger - Memory Breakpoint

Is there a way to stop execution each time some memory address is accessed?
1
vote
2answers
5k views

OllyDbg: How to set conditional breakpoint on a register value?

I want to set a breakpoint when the register EAX references a specific Unicode string, e.g. "Enter". In Ollydbg there is usually right beside the EAX value a string that says "ASCII: Enter ". I read ...
0
votes
1answer
508 views

OllyDbg condition based on Windows Message for button click

I am attempting to set a breakpoint after a user clicks a button on a Windows GUI program. I load the program into OllyDbg, type in ctrl+g to search for a function, I then use the GetMessageW ...
3
votes
4answers
819 views

Locate address of function in DLL

I need to locate the address of a function in a DLL at runtime which isn't exported. The DLL in question is vbe7.dll related to Visual Basic (and macros). The function is ___vbaInStr, can be found in ...
7
votes
4answers
4k views

Radare2 (noob question) can't set breakpoint?

I was following this video: https://www.youtube.com/watch?v=3NTXFUxcKPc at the end it show how to do basic stuff with Radare2. When i try to set a break point with: db 0x004005bd where '0x004005bd' ...
3
votes
1answer
586 views

Is it possible to hook CPU instructions without severe performance impact?

I have been working on some unpackers, and I noticed that at their end, they mostly use this: mov edx, [ebp+oep] call edx ; now, you're at the OEP of the original binary Or this: mov ecx, [ebp+oep] ...
0
votes
1answer
343 views

OllyDbg can't set permanent breakpoint

I am relatively new to the world of RE. So, I am playing with a program, which relies on multiple dlls. I am using 32 bit OllyDbg 2.01, and can’t put permanent breakpoints in one dll, others are fine, ...
1
vote
0answers
84 views

Patch is detected yet hardware access breakpoint isn't hit

I wonder how is that possible. I found debugger detection in TLS Callback function - there is conditional jump after some check. When I step over it with debugger and modify ZF flag to bypass ...
4
votes
2answers
1k views

Hooking functions in a VMProtect'ed executable

I'm trying to solve the Sharif CTF 2016 HI2.exe challenge. This challenge requires a specific (impossible to reach) environment (64 processors, 128GB RAM, ...) to display the flag. As the executable ...
1
vote
0answers
184 views

Ignore Path and Extension in OllyDBG 2?

I have an exe on my desktop that i began debugging a while ago, so i have a lot of notes/breakpoints stored in the udd file. I now need to move that exe to a different directory but Olly sees it as a ...
0
votes
0answers
337 views

Debugger stack overflow

I'm having weird issue with debugging. No matter which software I use: IDA or even Cheat Engine, the debugger crashes on resuming from breakpoint with error: 7716DF76: A new guard page for the stack ...
1
vote
1answer
1k views

Access violation error only when stepping after breakpoint in Immunity

Following a tutorial at http://www.fuzzysecurity.com/tutorials/expDev/2.html, regarding buffer overflows. I am able to execute the shellcode successfully. Used 'jmp esp' instead of 'pop esp; retn' as ...
5
votes
1answer
195 views

Memory Read Access Breakpoint Question

I have implemented a Memory Read Access hardware breakpoint in C code. It works perfect and provides me the next instruction after a memory is read. I am using BeaEngine to disassemble the ...
1
vote
1answer
461 views

Memory activity tracking

I am quite new to reverse engineering (but have some experience with OllyDbg). What I want to do, is to attach to Windows executable file or library (mostly PE32, but x64 would be a great benefit) and ...
1
vote
1answer
1k views

Ollydbg:how to let Olly remember a breakpoint for next run

I'm a Olly newbie... whenever I set a breakpoint at an address and found I need to restart the target program, the previously set breakpoints are all removed. Is there anyway to let Olly to remember ...
1
vote
0answers
73 views

Why program opened with OllyDbg 2 isn't paused at start? [duplicate]

There is one thing that I still can’t understand about Olly. I have a sample (an .SCR file) which I’m trying to analyze. When I open it with Olly 1.10, the file is loaded and its execution is paused ...
0
votes
1answer
214 views

Breaking on specific API

I wish to set a breakpoint on a call to a specific windows API function, e.g.- RegQueryValueExA() It is resolved at runtime in unknown stage of malware execution, and I wish to initiate manual ...
1
vote
1answer
1k views

How to stop IDA debugger when a register is set to a particular value?

I use the following script to set IDA in trace mode and make it stop as soon as EAX register is set to a given value : #include <idc.idc> static main() { auto r_eip, code, eax; ...
1
vote
1answer
518 views

Set Breakpoint at Entry point fails (GDB)

I'm currently practicing some RE w/ GDB and am having issues simply stopping the run/start on the first/second instruction. I am new to GDB/RE and have a limited knowledge of some of GDB's inner ...
3
votes
2answers
401 views

Why hook a function rather than set a breakpoint

I know hooking is usually used as a technique when one would rather use external (or injected) code to manipulate an executable, vs breakpoints which are usually set by a debugging framework in an ...