Questions tagged [breakpoint]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
9 votes
6 answers
14k views

Radare2 (noob question) can't set breakpoint?

I was following this video at the end it shows how to do basic stuff with Radare2 (r2). When I try to set a break point with: db 0x004005bd Where 0x004005bd is the first address of the main function ...
7 votes
1 answer
6k views

Detecting hardware breakpoints

Since software breakpoints, unlike hardware breakpoints , do change the code, it's relatively easy to write a program that performs a checksum on itself as an anti-debugger technique. Is it possible ...
  • 367
7 votes
1 answer
2k views

OllyDbg: How to set a conditional breakpoint for a value anywhere in the stack?

I know how to set conditional breakpoints on a register, but how can I have a breakpoint trigger if a specific value (say, 0x12345678) appears anywhere in the active call stack frame?
5 votes
1 answer
7k views

Immunity Debugger - Memory Breakpoint

Is there a way to stop execution each time some memory address is accessed?
  • 151
5 votes
1 answer
1k views

function call trace with radare2 or break on all function call

I want to script with python using r2pipe. Is there a way that when debugging I can break on each call function, thus I can get the parameter? What's more, I won't jump into system library. Or is ...
4 votes
2 answers
3k views

How to stop debugger right after the execution?

I'm using /bin/true as my sample binary (without available main method): $ lldb /bin/true (lldb) target create "/bin/true" Current executable set to '/bin/true' (x86_64). (lldb) break main invalid ...
  • 445
4 votes
2 answers
7k views

How to break when specific text is found

In this line of code: mov eax,dword ptr [eax+8]; eax+8 contains a long string of text, I want to find out where it originally came from. In either OllyDbg or x32dbg, how can I break when ...
4 votes
1 answer
305 views

Memory Read Access Breakpoint Question

I have implemented a Memory Read Access hardware breakpoint in C code. It works perfect and provides me the next instruction after a memory is read. I am using BeaEngine to disassemble the ...
  • 299
4 votes
2 answers
2k views

Hooking functions in a VMProtect'ed executable

I'm trying to solve the Sharif CTF 2016 HI2.exe challenge. This challenge requires a specific (impossible to reach) environment (64 processors, 128GB RAM, ...) to display the flag. As the executable ...
4 votes
0 answers
312 views

Using GDB to trace guest OS inside a hypervisor, the whole running on Qemu - kvm

I use Gdb to trace the execution (breakpoint, single stepping, ...) of a hypervisor OS in Qemu and it works fine so far. qemu-system-x86_64 -enable-kvm -display sdl -cpu host -serial my: stdio -m ...
  • 141
3 votes
1 answer
9k views

How to print the value of register with Radare 2

I am trying to solve this ELF - Ptrace challenge. I use Radare 2. This is the commands I execute to print the assembly code. radare2 ch3.bin [0x080482f0]> aaa [[anal.jmptbl] Missing cjmp bb in ...
  • 221
3 votes
1 answer
53 views

How to use software watchpoints in LLDB?

After trying to use watch command, LLDB said the device had 0 available hardware watchpoints. In GDB you can use set can-use-hw-watchpoints 0 How do you disable hardware watchpoints in LLDB?
  • 144
3 votes
1 answer
176 views

Debug point not hit with radare2

I am doing this reverse engenering challenge. I executed theses commands to analyse the main function : radare2.exe ch15.exe aaa s main pdf This is the output of the pdf command : [0x004017b8]> ...
  • 221
3 votes
1 answer
1k views

Is it possible to hook CPU instructions without severe performance impact?

I have been working on some unpackers, and I noticed that at their end, they mostly use this: mov edx, [ebp+oep] call edx ; now, you're at the OEP of the original binary Or this: mov ecx, [ebp+oep] ...
user avatar
3 votes
2 answers
1k views

Why hook a function rather than set a breakpoint

I know hooking is usually used as a technique when one would rather use external (or injected) code to manipulate an executable, vs breakpoints which are usually set by a debugging framework in an ...
3 votes
1 answer
5k views

Breakpoint on io file read

I am investigating an application, which is encrypting it's files and stores them into disk. Of course i know where the files are and their corresponding filenames. In order to find out how the ...
  • 175
2 votes
2 answers
1k views

Can I set more than 4 memory access breakpoints in WinDbg?

I can set a DWORD memory read/write access breakpoint in WinDbg with the following command: ba r 4 0x0307F42C But is there a way to set more than 4 of those?
  • 1,337
2 votes
2 answers
2k views

How to set a Mouse Click BreakPoint in OllyDbg?

In the debugger program OllyDbg, How do I set a breakpoint when the left mouse button is pressed? It doesn't matter what it clicks on, so upon mouse click, the breakpoint stops the debugger.
2 votes
1 answer
844 views

Set Breakpoint at Entry point fails (GDB)

I'm currently practicing some RE w/ GDB and am having issues simply stopping the run/start on the first/second instruction. I am new to GDB/RE and have a limited knowledge of some of GDB's inner ...
2 votes
1 answer
273 views

What is Hardware Breakpoint and when we need to use it?

In part 5 of the lena151 RE tutorial I saw the Hardware BP. The explanation he gave was very difficult for me to understand. Can anyone explain what is a hardware breakpoint and when we need to use it?...
  • 79
2 votes
1 answer
215 views

Is there any way to export breakpoint with IDA Pro?

As the title describes, I'd like to export breakpoints in IDA Pro and load from another project. Is there such feature?
  • 121
2 votes
1 answer
434 views

How to navigate Disassembly view to the current instruction location?

I'm using x32dbg and I've set a hardware memory breakpoint. It triggers successfully for a specified module and the debugger pauses and a message on the bottom says: Hardware breakpoint (byte, read/...
  • 123
2 votes
1 answer
520 views

lldb - breakpoint not reached when attach do process (but executing when set before app running)

I am trying to set breakpoint to existing processes, but when i am trying to do it breakpoint is not reached, but when i am running app directly in lldb and set breakpoint before it runs all ...
2 votes
1 answer
832 views

x64dbg, breakpoint on write in memory with specific value

In x64dbg, we can set hardware breakpoint on write in memory dump but can we add more codition? Ex. Set breakpoin on write of value of 2F.
  • 21
2 votes
1 answer
376 views

Windbg: "gu" command inside of a breakpoint causes warning

I'm trying to leverage "gu" command in a conditional breakpoint or as a "CommandString" in a regular breakpoint. For example let's consider break on a malloc() function when we want to see in logs ...
  • 111
2 votes
1 answer
507 views

Ida break point on address changed

How can I set break point when the value on specific address is changed while I debug it with ida
  • 513
2 votes
1 answer
323 views

How does the processor distinguishes processes wrt HW bps?

When setting a hardware breakpoint (DR0...), this stores an address (as far as I can see, it looks like a virtual address). Because addresses are shared between processes (at least in 32 bits this can ...
2 votes
1 answer
594 views

What is the difference between binary instrumentation and software breakpoints?

Don't be confused by a title of a question. Here is an explanation. Let's take Intel Pin. They claim that The best way to think about Pin is as a "just in time" (JIT) compiler. The input to ...
  • 124
2 votes
1 answer
3k views

Why doesn't the breakpoint get hit in gdb?

I was following the writeup of the challenge tehran. If I set a breakpoint 0x804bade, it never gets hit for the following input. begin() { fillout(0x8048000, 16384, 7); puts("%144c%n", 42, ...
  • 1,281
2 votes
1 answer
225 views

Analyze a created thread after main thread

during an analysis, I had the following situation: The main thread allocates some space, the base address is 002E0000. Then it put opcodes (of the new thread) to that place. So, 002E0000 was the ...
  • 1,491
2 votes
1 answer
497 views

Why lldb seems to not stop at breakpoints?

While reverse engineering an iPhone app remotely, I set up breakpoints to some function's adresses. These adresses comes from the disassembled binary analysed with Hopper, and it seems like they must ...
2 votes
2 answers
9k views

OllyDbg: How to set conditional breakpoint on a register value?

I want to set a breakpoint when the register EAX references a specific Unicode string, e.g. "Enter". In Ollydbg there is usually right beside the EAX value a string that says "ASCII: Enter ". I read ...
  • 23
2 votes
4 answers
2k views

Locate address of function in DLL

I need to locate the address of a function in a DLL at runtime which isn't exported. The DLL in question is vbe7.dll related to Visual Basic (and macros). The function is ___vbaInStr, can be found in ...
2 votes
1 answer
415 views

Anti-debug clearing hardware breakpoints

An application I am debugging somehow manages to clear my hardware breakpoints. I am using TitanHide and x64dbg. I am observing the following behaviour: When placing the first hw breakpoint, it is ...
2 votes
0 answers
103 views

Ignore some locations in Windbg Conditional breakpoints

I'm trying to set a conditional hardware breakpoint on Windows Kernel-Mode in Windbg by using the following syntax : ba w1 ffff802312345678 "j(@rip==ffff802387654321 || @rip==ffff802387654330) 'gc';''...
1 vote
2 answers
869 views

Generate software breakpoint other than int3

Is it possible to generate a software breakpoint other than int3 to be catched by the debugger, like a division by zero for example? If so, I was wondering why debuggers don't support generating ...
  • 113
1 vote
2 answers
4k views

How to debug a DLL written in .NET/C#?

I want to reverse engineer an application written in C#. I would like to set a breakpoint at a function and observe the input passed to it during the normal course of the application's functioning.
1 vote
2 answers
594 views

Ollydbg: How to set a conditinal breakpoint for a register gets special value

I read this question about "set conditional break point on a register value" ; but its about setting a bp on special address! I want to set a bp when for example ECX == 12345678 , i can do this on ...
1 vote
1 answer
184 views

rip adress not visible with dr command

I just finished this challenge. This is the content of main function : [0x08048a86]> pdf / (fcn) main 417 | main (int argc, char **argv, char **envp); | ; var int local_16h @ ebp-0x16 |...
  • 221
1 vote
1 answer
2k views

Understand hardware breakPoint option in ida

When I set a hardware breakpoint I see the following dialog: I understand that Read/Write is meant to break into the debugger when the address that I choose for the breakpoint is read or written. I ...
1 vote
1 answer
3k views

How to stop IDA debugger when a register is set to a particular value?

I use the following script to set IDA in trace mode and make it stop as soon as EAX register is set to a given value : #include <idc.idc> static main() { auto r_eip, code, eax; ...
  • 341
1 vote
1 answer
84 views

breakpoint already hit 1 time

I'm following Erickson 2008 Hacking the art of exploitation. The program is very simple. #include <stdio.h> #include <string.h> int main() { char str_a[20]; strcpy(str_a, "Hello, ...
1 vote
1 answer
839 views

How to let SIGTRAP get caught by sighandler in GDB?

I have a program that I am trying to reverse, which contains an int3 (0xCC) which emits a SIGTRAP signal, which is then handled by a sighandler defined in sigaction. The handler performs calculations ...
1 vote
1 answer
405 views

Is there watchpoints in radare2?

Is there any way to put breakpoints in radare2 that trigger when an address is read/write? In GDB those are call watchpoints ('rwatch' or 'awatch") I got this from radare2 [0xB7F08810]> !dr? ...
  • 476
1 vote
1 answer
1k views

x64dbg how to set conditional breakpoint on WinAPI function

I am trying to solve a GUI based crackme. https://crackmes.one/crackme/5c68758633c5d4776a837cc4 so that I learn security. I want to set a conditional Break point on user32.CallWindowProcA. Microsoft ...
  • 123
1 vote
1 answer
392 views

GUARD_PAGE memory breakpoints with gdb?

I came across a question the other day on reddit: How can we use PAGE_GUARD-based memory breakpoints in GDB (not hardware breakpoints)? Ollydbg, x64dbg and IDA PRO all support these types of ...
1 vote
1 answer
1k views

How int3 looks like in C

This is assembly code that can catch debugger with int 3 : MOV ECX, ExceptionHandler MOV DWORD PTR FS:[0], ExceptionHandler INT3 ///there is debugger!!! ExceptionHandler: ////no ...
1 vote
1 answer
4k views

Impossible to execute a program with radare2 : TO DO continue

I am trying to crack a crackme. I already catch the flag because I seen the string variable which represants flag. I would like to catch the flag on an other way, I want to set a breakpoint when there ...
user avatar
1 vote
1 answer
677 views

Overriding the second argument with conditional breakpoints

With conditional breakpoints I'm able to alter the return value of a function. For example, when setting a breakpoint on the return instruction, the following IDC expression ensures that the function ...
  • 111
1 vote
1 answer
2k views

Ollydbg:how to let Olly remember a breakpoint for next run

I'm a Olly newbie... whenever I set a breakpoint at an address and found I need to restart the target program, the previously set breakpoints are all removed. Is there anyway to let Olly to remember ...
  • 243