Questions tagged [breakpoint]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
1answer
2k views

Is it possible to set breakpoints relatively to the memory block in x64dbg or a similar debugger?

Some of my breakpoints perfectly survive multiple restarts. But many interesting parts of the code I am debugging have different locations in memory after a restart. It seems the reason is, that the ...
1
vote
0answers
170 views

windbg stopped after I set up a breakpoint, keeping busing

I'm studying reverse engineering, I wrote the following code to see how it is to pass struct variables in the disassembly. struct s { int a; int b; int c; }; struct s get_some_values(int ...
1
vote
1answer
1k views

Simple Debugger and Hardware BreakPoints in x64 Windows 10

I have coded a very simple Debugger for x64, I am using currently Win10. I am trying to set some Hardware Breakpoints to be trapped by my Debugger Loop as follows: inline void SETBITS(DWORD64 *dw, ...
1
vote
1answer
645 views

Overriding the second argument with conditional breakpoints

With conditional breakpoints I'm able to alter the return value of a function. For example, when setting a breakpoint on the return instruction, the following IDC expression ensures that the function ...
6
votes
1answer
6k views

Detecting hardware breakpoints

Since software breakpoints, unlike hardware breakpoints , do change the code, it's relatively easy to write a program that performs a checksum on itself as an anti-debugger technique. Is it possible ...
2
votes
1answer
458 views

Why lldb seems to not stop at breakpoints?

While reverse engineering an iPhone app remotely, I set up breakpoints to some function's adresses. These adresses comes from the disassembled binary analysed with Hopper, and it seems like they must ...
4
votes
2answers
6k views

How to break when specific text is found

In this line of code: mov eax,dword ptr [eax+8]; eax+8 contains a long string of text, I want to find out where it originally came from. In either OllyDbg or x32dbg, how can I break when ...
2
votes
1answer
296 views

How does the processor distinguishes processes wrt HW bps?

When setting a hardware breakpoint (DR0...), this stores an address (as far as I can see, it looks like a virtual address). Because addresses are shared between processes (at least in 32 bits this can ...
2
votes
1answer
538 views

What is the difference between binary instrumentation and software breakpoints?

Don't be confused by a title of a question. Here is an explanation. Let's take Intel Pin. They claim that The best way to think about Pin is as a "just in time" (JIT) compiler. The input to ...
2
votes
1answer
3k views

Why doesn't the breakpoint get hit in gdb?

I was following the writeup of the challenge tehran. If I set a breakpoint 0x804bade, it never gets hit for the following input. begin() { fillout(0x8048000, 16384, 7); puts("%144c%n", 42, ...
0
votes
1answer
543 views

Why can't gdb find symbol which IDA can?

I was reversing this binary. While I tried to set a breakpoint in gdb on main function, it couldn't find its definition. Loading up the same binary in IDA shows up main method in the Function pane. ...
7
votes
1answer
2k views

OllyDbg: How to set a conditional breakpoint for a value anywhere in the stack?

I know how to set conditional breakpoints on a register, but how can I have a breakpoint trigger if a specific value (say, 0x12345678) appears anywhere in the active call stack frame?
4
votes
1answer
6k views

Immunity Debugger - Memory Breakpoint

Is there a way to stop execution each time some memory address is accessed?
2
votes
2answers
9k views

OllyDbg: How to set conditional breakpoint on a register value?

I want to set a breakpoint when the register EAX references a specific Unicode string, e.g. "Enter". In Ollydbg there is usually right beside the EAX value a string that says "ASCII: Enter ". I read ...
0
votes
1answer
1k views

OllyDbg condition based on Windows Message for button click

I am attempting to set a breakpoint after a user clicks a button on a Windows GUI program. I load the program into OllyDbg, type in ctrl+g to search for a function, I then use the GetMessageW ...
2
votes
4answers
2k views

Locate address of function in DLL

I need to locate the address of a function in a DLL at runtime which isn't exported. The DLL in question is vbe7.dll related to Visual Basic (and macros). The function is ___vbaInStr, can be found in ...
9
votes
6answers
13k views

Radare2 (noob question) can't set breakpoint?

I was following this video at the end it shows how to do basic stuff with Radare2 (r2). When I try to set a break point with: db 0x004005bd Where 0x004005bd is the first address of the main function ...
3
votes
1answer
1k views

Is it possible to hook CPU instructions without severe performance impact?

I have been working on some unpackers, and I noticed that at their end, they mostly use this: mov edx, [ebp+oep] call edx ; now, you're at the OEP of the original binary Or this: mov ecx, [ebp+oep] ...
0
votes
1answer
574 views

OllyDbg can't set permanent breakpoint

I am relatively new to the world of RE. So, I am playing with a program, which relies on multiple dlls. I am using 32 bit OllyDbg 2.01, and can’t put permanent breakpoints in one dll, others are fine, ...
1
vote
0answers
120 views

Patch is detected yet hardware access breakpoint isn't hit

I wonder how is that possible. I found debugger detection in TLS Callback function - there is conditional jump after some check. When I step over it with debugger and modify ZF flag to bypass ...
4
votes
2answers
2k views

Hooking functions in a VMProtect'ed executable

I'm trying to solve the Sharif CTF 2016 HI2.exe challenge. This challenge requires a specific (impossible to reach) environment (64 processors, 128GB RAM, ...) to display the flag. As the executable ...
1
vote
0answers
757 views

Ignore Path and Extension in OllyDBG 2?

I have an exe on my desktop that i began debugging a while ago, so i have a lot of notes/breakpoints stored in the udd file. I now need to move that exe to a different directory but Olly sees it as a ...
1
vote
1answer
2k views

Access violation error only when stepping after breakpoint in Immunity

Following a tutorial at http://www.fuzzysecurity.com/tutorials/expDev/2.html, regarding buffer overflows. I am able to execute the shellcode successfully. Used 'jmp esp' instead of 'pop esp; retn' as ...
4
votes
1answer
296 views

Memory Read Access Breakpoint Question

I have implemented a Memory Read Access hardware breakpoint in C code. It works perfect and provides me the next instruction after a memory is read. I am using BeaEngine to disassemble the ...
1
vote
1answer
713 views

Memory activity tracking

I am quite new to reverse engineering (but have some experience with OllyDbg). What I want to do, is to attach to Windows executable file or library (mostly PE32, but x64 would be a great benefit) and ...
1
vote
1answer
2k views

Ollydbg:how to let Olly remember a breakpoint for next run

I'm a Olly newbie... whenever I set a breakpoint at an address and found I need to restart the target program, the previously set breakpoints are all removed. Is there anyway to let Olly to remember ...
1
vote
0answers
228 views

Why program opened with OllyDbg 2 isn't paused at start? [duplicate]

There is one thing that I still can’t understand about Olly. I have a sample (an .SCR file) which I’m trying to analyze. When I open it with Olly 1.10, the file is loaded and its execution is paused ...
0
votes
1answer
543 views

Breaking on specific API

I wish to set a breakpoint on a call to a specific windows API function, e.g.- RegQueryValueExA() It is resolved at runtime in unknown stage of malware execution, and I wish to initiate manual ...
1
vote
1answer
3k views

How to stop IDA debugger when a register is set to a particular value?

I use the following script to set IDA in trace mode and make it stop as soon as EAX register is set to a given value : #include <idc.idc> static main() { auto r_eip, code, eax; ...
2
votes
1answer
783 views

Set Breakpoint at Entry point fails (GDB)

I'm currently practicing some RE w/ GDB and am having issues simply stopping the run/start on the first/second instruction. I am new to GDB/RE and have a limited knowledge of some of GDB's inner ...
3
votes
2answers
1k views

Why hook a function rather than set a breakpoint

I know hooking is usually used as a technique when one would rather use external (or injected) code to manipulate an executable, vs breakpoints which are usually set by a debugging framework in an ...
4
votes
2answers
3k views

How to stop debugger right after the execution?

I'm using /bin/true as my sample binary (without available main method): $ lldb /bin/true (lldb) target create "/bin/true" Current executable set to '/bin/true' (x86_64). (lldb) break main invalid ...
2
votes
1answer
505 views

lldb - breakpoint not reached when attach do process (but executing when set before app running)

I am trying to set breakpoint to existing processes, but when i am trying to do it breakpoint is not reached, but when i am running app directly in lldb and set breakpoint before it runs all ...
1
vote
0answers
269 views

gdbserver doesn't trigger breakpoints

I'm debugging a vulnerable app on a remote host. I've set up gbserver on the host with: gdbserver host:1234 /my/target/app On my local host I've connected with: $ gdb /same/target/app gdb$ target ...
1
vote
1answer
1k views

Breakpoints on ARM

Recently I read that breakpoints on ARM are enforced by either using BKPT instructions or by using instructions that are defined as invalid. Which method does gdb use? Do you know of any online ...
3
votes
1answer
5k views

Breakpoint on io file read

I am investigating an application, which is encrypting it's files and stores them into disk. Of course i know where the files are and their corresponding filenames. In order to find out how the ...
1
vote
1answer
427 views

False positives with conditional breakpoint in OllyDBG

I'm trying to remove a nag screen. Its window style is 16C80000, which should translate to WS_VISIBLE | WS_CLIPCHILDREN | WS_CLIPSIBLINGS | WS_CAPTION | WS_SYSMENU. So, in the call to CreateWindowExW()...
2
votes
1answer
222 views

Analyze a created thread after main thread

during an analysis, I had the following situation: The main thread allocates some space, the base address is 002E0000. Then it put opcodes (of the new thread) to that place. So, 002E0000 was the ...

1
2