Questions tagged [breakpoint]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
9
votes
6answers
11k views

Radare2 (noob question) can't set breakpoint?

I was following this video at the end it shows how to do basic stuff with Radare2 (r2). When I try to set a break point with: db 0x004005bd Where 0x004005bd is the first address of the main function ...
7
votes
1answer
2k views

OllyDbg: How to set a conditional breakpoint for a value anywhere in the stack?

I know how to set conditional breakpoints on a register, but how can I have a breakpoint trigger if a specific value (say, 0x12345678) appears anywhere in the active call stack frame?
6
votes
1answer
6k views

Detecting hardware breakpoints

Since software breakpoints, unlike hardware breakpoints , do change the code, it's relatively easy to write a program that performs a checksum on itself as an anti-debugger technique. Is it possible ...
5
votes
1answer
677 views

function call trace with radare2 or break on all function call

I want to script with python using r2pipe. Is there a way that when debugging I can break on each call function, thus I can get the parameter? What's more, I won't jump into system library. Or is ...
4
votes
2answers
3k views

How to stop debugger right after the execution?

I'm using /bin/true as my sample binary (without available main method): $ lldb /bin/true (lldb) target create "/bin/true" Current executable set to '/bin/true' (x86_64). (lldb) break main invalid ...
4
votes
2answers
6k views

How to break when specific text is found

In this line of code: mov eax,dword ptr [eax+8]; eax+8 contains a long string of text, I want to find out where it originally came from. In either OllyDbg or x32dbg, how can I break when ...
4
votes
1answer
285 views

Memory Read Access Breakpoint Question

I have implemented a Memory Read Access hardware breakpoint in C code. It works perfect and provides me the next instruction after a memory is read. I am using BeaEngine to disassemble the ...
4
votes
2answers
2k views

Hooking functions in a VMProtect'ed executable

I'm trying to solve the Sharif CTF 2016 HI2.exe challenge. This challenge requires a specific (impossible to reach) environment (64 processors, 128GB RAM, ...) to display the flag. As the executable ...
4
votes
0answers
266 views

Using GDB to trace guest OS inside a hypervisor, the whole running on Qemu - kvm

I use Gdb to trace the execution (breakpoint, single stepping, ...) of a hypervisor OS in Qemu and it works fine so far. qemu-system-x86_64 -enable-kvm -display sdl -cpu host -serial my: stdio -m ...
3
votes
1answer
151 views

Debug point not hit with radare2

I am doing this reverse engenering challenge. I executed theses commands to analyse the main function : radare2.exe ch15.exe aaa s main pdf This is the output of the pdf command : [0x004017b8]> ...
3
votes
1answer
1k views

Is it possible to hook CPU instructions without severe performance impact?

I have been working on some unpackers, and I noticed that at their end, they mostly use this: mov edx, [ebp+oep] call edx ; now, you're at the OEP of the original binary Or this: mov ecx, [ebp+oep] ...
3
votes
1answer
6k views

Immunity Debugger - Memory Breakpoint

Is there a way to stop execution each time some memory address is accessed?
3
votes
2answers
951 views

Why hook a function rather than set a breakpoint

I know hooking is usually used as a technique when one would rather use external (or injected) code to manipulate an executable, vs breakpoints which are usually set by a debugging framework in an ...
3
votes
1answer
4k views

Breakpoint on io file read

I am investigating an application, which is encrypting it's files and stores them into disk. Of course i know where the files are and their corresponding filenames. In order to find out how the ...
2
votes
2answers
1k views

How to set a Mouse Click BreakPoint in OllyDbg?

In the debugger program OllyDbg, How do I set a breakpoint when the left mouse button is pressed? It doesn't matter what it clicks on, so upon mouse click, the breakpoint stops the debugger.
2
votes
2answers
1k views

Can I set more than 4 memory access breakpoints in WinDbg?

I can set a DWORD memory read/write access breakpoint in WinDbg with the following command: ba r 4 0x0307F42C But is there a way to set more than 4 of those?
2
votes
1answer
767 views

Set Breakpoint at Entry point fails (GDB)

I'm currently practicing some RE w/ GDB and am having issues simply stopping the run/start on the first/second instruction. I am new to GDB/RE and have a limited knowledge of some of GDB's inner ...
2
votes
1answer
151 views

Is there any way to export breakpoint with IDA Pro?

As the title describes, I'd like to export breakpoints in IDA Pro and load from another project. Is there such feature?
2
votes
1answer
481 views

lldb - breakpoint not reached when attach do process (but executing when set before app running)

I am trying to set breakpoint to existing processes, but when i am trying to do it breakpoint is not reached, but when i am running app directly in lldb and set breakpoint before it runs all ...
2
votes
1answer
389 views

Ida break point on address changed

How can I set break point when the value on specific address is changed while I debug it with ida
2
votes
1answer
265 views

How does the processor distinguishes processes wrt HW bps?

When setting a hardware breakpoint (DR0...), this stores an address (as far as I can see, it looks like a virtual address). Because addresses are shared between processes (at least in 32 bits this can ...
2
votes
1answer
504 views

What is the difference between binary instrumentation and software breakpoints?

Don't be confused by a title of a question. Here is an explanation. Let's take Intel Pin. They claim that The best way to think about Pin is as a "just in time" (JIT) compiler. The input to ...
2
votes
1answer
3k views

Why doesn't the breakpoint get hit in gdb?

I was following the writeup of the challenge tehran. If I set a breakpoint 0x804bade, it never gets hit for the following input. begin() { fillout(0x8048000, 16384, 7); puts("%144c%n", 42, ...
2
votes
1answer
220 views

Analyze a created thread after main thread

during an analysis, I had the following situation: The main thread allocates some space, the base address is 002E0000. Then it put opcodes (of the new thread) to that place. So, 002E0000 was the ...
2
votes
1answer
423 views

Why lldb seems to not stop at breakpoints?

While reverse engineering an iPhone app remotely, I set up breakpoints to some function's adresses. These adresses comes from the disassembled binary analysed with Hopper, and it seems like they must ...
2
votes
2answers
8k views

OllyDbg: How to set conditional breakpoint on a register value?

I want to set a breakpoint when the register EAX references a specific Unicode string, e.g. "Enter". In Ollydbg there is usually right beside the EAX value a string that says "ASCII: Enter ". I read ...
2
votes
4answers
2k views

Locate address of function in DLL

I need to locate the address of a function in a DLL at runtime which isn't exported. The DLL in question is vbe7.dll related to Visual Basic (and macros). The function is ___vbaInStr, can be found in ...
2
votes
1answer
233 views

Anti-debug clearing hardware breakpoints

An application I am debugging somehow manages to clear my hardware breakpoints. I am using TitanHide and x64dbg. I am observing the following behaviour: When placing the first hw breakpoint, it is ...
2
votes
0answers
91 views

Ignore some locations in Windbg Conditional breakpoints

I'm trying to set a conditional hardware breakpoint on Windows Kernel-Mode in Windbg by using the following syntax : ba w1 ffff802312345678 "j(@rip==ffff802387654321 || @rip==ffff802387654330) 'gc';''...
1
vote
2answers
687 views

Generate software breakpoint other than int3

Is it possible to generate a software breakpoint other than int3 to be catched by the debugger, like a division by zero for example? If so, I was wondering why debuggers don't support generating ...
1
vote
2answers
296 views

Ollydbg: How to set a conditinal breakpoint for a register gets special value

I read this question about "set conditional break point on a register value" ; but its about setting a bp on special address! I want to set a bp when for example ECX == 12345678 , i can do this on ...
1
vote
1answer
172 views

rip adress not visible with dr command

I just finished this challenge. This is the content of main function : [0x08048a86]> pdf / (fcn) main 417 | main (int argc, char **argv, char **envp); | ; var int local_16h @ ebp-0x16 |...
1
vote
1answer
1k views

Understand hardware breakPoint option in ida

When I set a hardware breakpoint I see the following dialog: I understand that Read/Write is meant to break into the debugger when the address that I choose for the breakpoint is read or written. I ...
1
vote
1answer
3k views

How to stop IDA debugger when a register is set to a particular value?

I use the following script to set IDA in trace mode and make it stop as soon as EAX register is set to a given value : #include <idc.idc> static main() { auto r_eip, code, eax; ...
1
vote
1answer
166 views

How to let SIGTRAP get caught by sighandler in GDB?

I have a program that I am trying to reverse, which contains an int3 (0xCC) which emits a SIGTRAP signal, which is then handled by a sighandler defined in sigaction. The handler performs calculations ...
1
vote
1answer
166 views

How can I navigate to the Disassembly address location?

I'm using x32dbg and I've set a hardware memory breakpoint. It triggers successfully for a specified module and the debugger pauses and a message on the bottom says: Hardware breakpoint (byte, read/...
1
vote
2answers
2k views

How to debug a DLL written in .NET/C#?

I want to reverse engineer an application written in C#. I would like to set a breakpoint at a function and observe the input passed to it during the normal course of the application's functioning.
1
vote
1answer
292 views

Is there watchpoints in radare2?

Is there any way to put breakpoints in radare2 that trigger when an address is read/write? In GDB those are call watchpoints ('rwatch' or 'awatch") I got this from radare2 [0xB7F08810]> !dr? ...
1
vote
1answer
768 views

x64dbg how to set conditional breakpoint on WinAPI function

I am trying to solve a GUI based crackme. https://crackmes.one/crackme/5c68758633c5d4776a837cc4 so that I learn security. I want to set a conditional Break point on user32.CallWindowProcA. Microsoft ...
1
vote
1answer
267 views

GUARD_PAGE memory breakpoints with gdb?

I came across a question the other day on reddit: How can we use PAGE_GUARD-based memory breakpoints in GDB (not hardware breakpoints)? Ollydbg, x64dbg and IDA PRO all support these types of ...
1
vote
1answer
951 views

How int3 looks like in C

This is assembly code that can catch debugger with int 3 : MOV ECX, ExceptionHandler MOV DWORD PTR FS:[0], ExceptionHandler INT3 ///there is debugger!!! ExceptionHandler: ////no ...
1
vote
1answer
3k views

Impossible to execute a program with radare2 : TO DO continue

I am trying to crack a crackme. I already catch the flag because I seen the string variable which represants flag. I would like to catch the flag on an other way, I want to set a breakpoint when there ...
1
vote
1answer
611 views

Overriding the second argument with conditional breakpoints

With conditional breakpoints I'm able to alter the return value of a function. For example, when setting a breakpoint on the return instruction, the following IDC expression ensures that the function ...
1
vote
1answer
2k views

Ollydbg:how to let Olly remember a breakpoint for next run

I'm a Olly newbie... whenever I set a breakpoint at an address and found I need to restart the target program, the previously set breakpoints are all removed. Is there anyway to let Olly to remember ...
1
vote
1answer
420 views

False positives with conditional breakpoint in OllyDBG

I'm trying to remove a nag screen. Its window style is 16C80000, which should translate to WS_VISIBLE | WS_CLIPCHILDREN | WS_CLIPSIBLINGS | WS_CAPTION | WS_SYSMENU. So, in the call to CreateWindowExW()...
1
vote
2answers
43 views

Debug registers (DRx) keep getting trampled when using with SetThreadContext

I'm trying to set hardware breakpoints from code by using Get/SetThreadContext and modifying DR0..3, DR7, but it only works if I do it repeatedly. Most of the time when I use Get after having used Set ...
1
vote
1answer
69 views

Set gdb breakpoint by address with gdb python

into GDB python I tried gdb.Breakpoint('0xaaaa') I got error Function 0xaaaa is not defided . Breakpoint 5(0xaaaa) pending and the program not break at this address. Why is that?
1
vote
1answer
266 views

Calling/debugging calls to DLL via ollydbg or x64dbg

I have used dependency walker on a DLL of an old game from 2001. I have found a function which I want to be able to analyze. I see the name of the function and the entry point (at the end). How do I ...
1
vote
1answer
344 views

x64dbg, breakpoint on write in memory with specific value

In x64dbg, we can set hardware breakpoint on write in memory dump but can we add more codition? Ex. Set breakpoin on write of value of 2F.
1
vote
1answer
218 views

Windbg: “gu” command inside of a breakpoint causes warning

I'm trying to leverage "gu" command in a conditional breakpoint or as a "CommandString" in a regular breakpoint. For example let's consider break on a malloc() function when we want to see in logs ...