Skip to main content
11 votes
Accepted

How to print the value of register with Radare 2

Printing the registry values in radare2 is quite simple. All registers You can print all the General Purpose registers using dr: [0x55bea3305070]> dr rax = 0x55bea3305070 rbx = 0x00000000 rcx = ...
Megabeets's user avatar
  • 8,999
10 votes
Accepted

Detecting hardware breakpoints

This is a really good question since this topic isn't as popular as anti-debugging techniques to detect software breakpoints. Since you didn't mention the architecture we have to keep in mind that ...
Megabeets's user avatar
  • 8,999
8 votes

Radare2 (noob question) can't set breakpoint?

Run radare2 in debug mode. r2 -d
Weeruhputt Supsohmboon's user avatar
7 votes

How to break when specific text is found

You are searching for Conditional Breakpoints OllyDBG It's possible to set a conditional breakpoint in both OllyDbg 1.01 and 2.00 Conditional Breakpoint Displays dialog window asking user to ...
Megabeets's user avatar
  • 8,999
5 votes
Accepted

Can I set more than 4 memory access breakpoints in WinDbg?

Those are called hardware breakpoints and are related to debug registers in the CPU. There are usually 6 of them but only DR0-DR3 used to specify an address for hardware breakpoints.
Paweł Łukasik's user avatar
5 votes
Accepted

Memory Read Access Breakpoint Question

This is a tricky question. On x86 platform the maximum length of an instruction is 15 bytes. You can read 15 bytes backwards from the current EIP and pass it to Disasm function of BeaEngine. This ...
0xec's user avatar
  • 6,090
5 votes

OllyDbg: How to set a conditional breakpoint for a value anywhere in the stack?

Not for Ollydbg, but I wrote a plugin called StackContains for x64dbg that allows you to check if a value is present in the check during conditional tracing. This allows you to break as soon as the ...
mrexodia's user avatar
  • 1,652
4 votes

Immunity Debugger - Memory Breakpoint

Yes For a memory access breakpoint1, just right click the desired address > Breakpoint > Memory, on access: The same applies to values in the hex dump: 1: A breakpoint on access will break whenver ...
Martin's user avatar
  • 468
4 votes
Accepted

How to set a Mouse Click BreakPoint in OllyDbg?

All messages in a gui application passes through the Application Defined Callback WinProc whose prototype is LRESULT CALLBACK WindowProc( _In_ HWND hwnd, _In_ UINT uMsg, _In_ WPARAM wParam,...
blabb's user avatar
  • 16.4k
4 votes

Is there any way to export breakpoint with IDA Pro?

Open BreakPoint list with {Cntrl-Alt-B} then select all with {Cntrl-A}, then RightClick on selection, go to Groups->Selection->ExportBreakPointAsIDC... to load them in another project go to ...
орион орионВи's user avatar
4 votes

Can I force GDB breakpoints and disassemble?

gdb is primarily a Source Level Debugger to set a bp on an address instead of symbol use * (gdb) break main Breakpoint 1 at 0x100401094: file mingtest.cpp, line 4. (gdb) break *0x100401094 Note: ...
blabb's user avatar
  • 16.4k
4 votes
Accepted

What is Hardware Breakpoint and when we need to use it?

The short answer: From the user point of view, software breakpoints are only for instructions, and you may set them as many as you want, while hardware breakpoints are universal, but you may use only ...
MarianD's user avatar
  • 1,130
3 votes

Radare2 (noob question) can't set breakpoint?

You are probably using an obsolete version of radare2. Uninstall your current radare2 version then run: git clone https://github.com/radare/radare2 && cd radare2 && ./sys/install.sh ...
Maijin's user avatar
  • 880
3 votes

Is it possible to hook CPU instructions without severe performance impact?

Writing an hypervisor The best way to currently do this is by creating a micro-hypervisor, exploiting technologies originally created to support faster virtualization to monitor usermode as well as ...
NirIzr's user avatar
  • 11.8k
3 votes

How to breakpoint atached process with ida when move on

This happens due to way the Win32 debugging API implements process attaching. A new thread with DbgBreakPoint call is injected by the OS to ensure that the process gets stopped, since it could be in ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes

Understand hardware breakPoint option in ida

The options are explained in the help but I guess it could be a little laconic. The actions in Actions group are performed whenever the breakpoint is triggered (also expressed as hit or fired), and ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes
Accepted

Impossible to execute a program with radare2 : TO DO continue

Here's how you do it with debugging. $ r2 ch1.bin [0x080484f0]> aaa [x] Analyze all flags starting with sym. and entry0 (aa) [x] Analyze function calls (aac) [x] Analyze len bytes of instructions ...
sudhackar's user avatar
  • 2,709
3 votes
Accepted

Debug point not hit with radare2

Your breakpoint doesn't work as it is put in the part of the code that is not executed with the pass your provided. I'll try not to give too much hint so that you can still solve it by yourself. You ...
Paweł Łukasik's user avatar
3 votes
Accepted

rip adress not visible with dr command

rip = x64 eip = x86 dr shows eip in your case it is probably some demangled name (not sure why radare2 inserts the GLIBC part ) but if you strip the GLIBC part you can use iD Command to demangle ...
blabb's user avatar
  • 16.4k
3 votes

Generate software breakpoint other than int3

if you were on windows then you can try ollydbg v2
blabb's user avatar
  • 16.4k
3 votes
Accepted

Generate software breakpoint other than int3

A more flexible solution using x64dbg In addition to ollydbg2's built-in experimental support, it's relatively easy to achieve something similar in x64dbg, although some manual scripting is required. ...
NirIzr's user avatar
  • 11.8k
3 votes

How to debug a DLL written in .NET/C#?

I've used dnSpy in production for debugging as it can be put on a USB. It's perfectly capable of decompiling and debugging dll's. It has a pretty rich set of features. It's able to attach to ...
Jonathan Van Dam's user avatar
3 votes
Accepted

How to navigate Disassembly view to the current instruction location?

Normally the debugger should pause at the location where breakpoint is triggered, or you can use "jump to EIP" or similar command to navigate to the instruction being executed (which should be the one ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes
Accepted

How to let SIGTRAP get caught by sighandler in GDB?

I managed to find a solution. When the SIGTRAP emitted by the program causes a breakpoint in gdb, I use the command : signal SIGTRAP to send the signal to the program (and then to the handler), the ...
its-remmus's user avatar
3 votes
Accepted

How to use software watchpoints in LLDB?

As we know there are limitations to using watchpoints: there are a finite amount of watchpoints permitted per architecture (typically 4) and the “watched” size of memory usually caps out at 8 bytes. ...
Viktor's user avatar
  • 461
2 votes

OllyDbg condition based on Windows Message for button click

MSG Structure is as below typedef struct tagMSG { HWND hwnd; UINT message; WPARAM wParam; LPARAM lParam; DWORD time; POINT pt; } MSG; GetMessageAorW is as below BOOL WINAPI ...
blabb's user avatar
  • 16.4k
2 votes
Accepted

How does the processor distinguishes processes wrt HW bps?

The various bits in the DR7 (debug control) register determines the applicability of the hardware breakpoint in question. Such breakpoints can be local or global. Global breakpoint, as its name ...
0xec's user avatar
  • 6,090
2 votes
Accepted

What is the difference between binary instrumentation and software breakpoints?

Intel Pintool is not a JIT compiler. The explanation you quote just uses an analogy to JIT compilation, as there are logical similarities. IMHO this is not a well thought out analogy, and should be ...
NirIzr's user avatar
  • 11.8k
2 votes

Why doesn't the breakpoint get hit in gdb?

I found out the reason myself and it was truly enlightening! To insert a breakpoint, gcc replaces the bytes at the beginning of the breakpoint location with INT 3 instruction (0xCC byte) and records ...
sherlock's user avatar
  • 1,381
2 votes

Overriding the second argument with conditional breakpoints

You can use IDC functions to write to memory addresses. I recommend write_dbg_memory() function. write_dbg_memory(ESP+8, 0, size) https://www.hex-rays.com/products/ida/support/idapython_docs/ ...
EWD-0-'s user avatar
  • 119

Only top scored, non community-wiki answers of a minimum length are eligible