11
votes
Accepted
How to print the value of register with Radare 2
Printing the registry values in radare2 is quite simple.
All registers
You can print all the General Purpose registers using dr:
[0x55bea3305070]> dr
rax = 0x55bea3305070
rbx = 0x00000000
rcx = ...
- 8,919
9
votes
Accepted
Detecting hardware breakpoints
This is a really good question since this topic isn't as popular as anti-debugging techniques to detect software breakpoints. Since you didn't mention the architecture we have to keep in mind that ...
- 8,919
8
votes
Radare2 (noob question) can't set breakpoint?
Run radare2 in debug mode. r2 -d
7
votes
How to break when specific text is found
You are searching for Conditional Breakpoints
OllyDBG
It's possible to set a conditional breakpoint in both OllyDbg 1.01 and 2.00
Conditional Breakpoint
Displays dialog window asking user to ...
- 8,919
5
votes
Set Breakpoint at Entry point fails (GDB)
From http://www.delorie.com/gnu/docs/gdb/gdb_29.html:
GDB normally ignores breakpoints when it resumes execution, until at least one instruction has been executed. If it did not do this, you would ...
- 12.9k
5
votes
Accepted
Memory Read Access Breakpoint Question
This is a tricky question.
On x86 platform the maximum length of an instruction is 15 bytes.
You can read 15 bytes backwards from the current EIP and pass it to Disasm function of BeaEngine. This ...
- 6,040
5
votes
OllyDbg: How to set a conditional breakpoint for a value anywhere in the stack?
Not for Ollydbg, but I wrote a plugin called StackContains for x64dbg that allows you to check if a value is present in the check during conditional tracing. This allows you to break as soon as the ...
- 1,652
5
votes
Accepted
Can I set more than 4 memory access breakpoints in WinDbg?
Those are called hardware breakpoints and are related to debug registers in the CPU. There are usually 6 of them but only DR0-DR3 used to specify an address for hardware breakpoints.
- 4,912
4
votes
Immunity Debugger - Memory Breakpoint
Yes
For a memory access breakpoint1, just right click the desired address > Breakpoint > Memory, on access:
The same applies to values in the hex dump:
1: A breakpoint on access will break whenver ...
- 458
4
votes
Accepted
How to set a Mouse Click BreakPoint in OllyDbg?
All messages in a gui application passes through the Application Defined Callback WinProc whose prototype is
LRESULT CALLBACK WindowProc(
_In_ HWND hwnd,
_In_ UINT uMsg,
_In_ WPARAM wParam,...
- 16.3k
4
votes
Is there any way to export breakpoint with IDA Pro?
Open BreakPoint list with {Cntrl-Alt-B} then select all with {Cntrl-A}, then RightClick on selection, go to Groups->Selection->ExportBreakPointAsIDC...
to load them in another project go to ...
4
votes
Can I force GDB breakpoints and disassemble?
gdb is primarily a Source Level Debugger
to set a bp on an address instead of symbol use *
(gdb) break main
Breakpoint 1 at 0x100401094: file mingtest.cpp, line 4.
(gdb) break *0x100401094
Note: ...
- 16.3k
4
votes
Accepted
What is Hardware Breakpoint and when we need to use it?
The short answer:
From the user point of view, software breakpoints are only for instructions, and you may set them as many as you want, while hardware breakpoints are universal, but you may use only ...
- 1,120
3
votes
Accepted
How to stop IDA debugger when a register is set to a particular value?
You can use the following IDC script for the purpose. It would stop whenever register eax contains 0. The debugger must be running when the script is executed.
#include <idc.idc>
static main()
...
- 6,040
3
votes
lldb - breakpoint not reached when attach do process (but executing when set before app running)
The reason is due to address space layout randomization (ASLR). The dynamic loader will employ some randomization in the starting address (the slide) which you must account for. When you start the ...
- 1,331
3
votes
Radare2 (noob question) can't set breakpoint?
You are probably using an obsolete version of radare2.
Uninstall your current radare2 version then run:
git clone https://github.com/radare/radare2 && cd radare2 && ./sys/install.sh
...
- 880
3
votes
Is it possible to hook CPU instructions without severe performance impact?
Writing an hypervisor
The best way to currently do this is by creating a micro-hypervisor, exploiting technologies originally created to support faster virtualization to monitor usermode as well as ...
- 11.7k
3
votes
Understand hardware breakPoint option in ida
The options are explained in the help but I guess it could be a little laconic.
The actions in Actions group are performed whenever the breakpoint is triggered (also expressed as hit or fired), and ...
- 36.4k
3
votes
Accepted
Debug point not hit with radare2
Your breakpoint doesn't work as it is put in the part of the code that is not executed with the pass your provided. I'll try not to give too much hint so that you can still solve it by yourself.
You ...
- 4,912
3
votes
Accepted
rip adress not visible with dr command
rip = x64
eip = x86
dr shows eip in your case
it is probably some demangled name (not sure why radare2 inserts the GLIBC part )
but if you strip the GLIBC part you can use iD Command to demangle ...
- 16.3k
3
votes
Generate software breakpoint other than int3
if you were on windows then you can try ollydbg v2
- 16.3k
3
votes
Accepted
Generate software breakpoint other than int3
A more flexible solution using x64dbg
In addition to ollydbg2's built-in experimental support, it's relatively easy to achieve something similar in x64dbg, although some manual scripting is required. ...
- 11.7k
3
votes
How to debug a DLL written in .NET/C#?
I've used dnSpy in production for debugging as it can be put on a USB. It's perfectly capable of decompiling and debugging dll's.
It has a pretty rich set of features. It's able to attach to ...
- 131
3
votes
Accepted
How to navigate Disassembly view to the current instruction location?
Normally the debugger should pause at the location where breakpoint is triggered, or you can use "jump to EIP" or similar command to navigate to the instruction being executed (which should be the one ...
- 36.4k
3
votes
Accepted
How to let SIGTRAP get caught by sighandler in GDB?
I managed to find a solution.
When the SIGTRAP emitted by the program causes a breakpoint in gdb, I use the command :
signal SIGTRAP
to send the signal to the program (and then to the handler), the ...
- 51
3
votes
Accepted
How to use software watchpoints in LLDB?
As we know there are limitations to using watchpoints: there are a finite amount of watchpoints permitted per architecture (typically 4) and the “watched” size of memory usually caps out at 8 bytes. ...
- 459
2
votes
OllyDbg condition based on Windows Message for button click
MSG Structure is as below
typedef struct tagMSG {
HWND hwnd;
UINT message;
WPARAM wParam;
LPARAM lParam;
DWORD time;
POINT pt;
} MSG;
GetMessageAorW is as below
BOOL WINAPI ...
- 16.3k
2
votes
Accepted
How does the processor distinguishes processes wrt HW bps?
The various bits in the DR7 (debug control) register determines the applicability of the hardware breakpoint in question. Such breakpoints can be local or global.
Global breakpoint, as its name ...
- 6,040
2
votes
Accepted
What is the difference between binary instrumentation and software breakpoints?
Intel Pintool is not a JIT compiler. The explanation you quote just uses an analogy to JIT compilation, as there are logical similarities. IMHO this is not a well thought out analogy, and should be ...
- 11.7k
2
votes
Why doesn't the breakpoint get hit in gdb?
I found out the reason myself and it was truly enlightening! To insert a breakpoint, gcc replaces the bytes at the beginning of the breakpoint location with INT 3 instruction (0xCC byte) and records ...
- 1,361
Only top scored, non community-wiki answers of a minimum length are eligible