9 votes
Accepted

How to print the value of register with Radare 2

Printing the registry values in radare2 is quite simple. All registers You can print all the General Purpose registers using dr: [0x55bea3305070]> dr rax = 0x55bea3305070 rbx = 0x00000000 rcx = ...
user avatar
  • 8,639
8 votes

Radare2 (noob question) can't set breakpoint?

Run radare2 in debug mode. r2 -d
user avatar
8 votes
Accepted

How to stop debugger right after the execution?

Binaries are usually stripped. For ELF binaries, you can check it with file command $ file /bin/true /bin/true: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared ...
user avatar
  • 455
8 votes
Accepted

Detecting hardware breakpoints

This is a really good question since this topic isn't as popular as anti-debugging techniques to detect software breakpoints. Since you didn't mention the architecture we have to keep in mind that ...
user avatar
  • 8,639
7 votes

How to break when specific text is found

You are searching for Conditional Breakpoints OllyDBG It's possible to set a conditional breakpoint in both OllyDbg 1.01 and 2.00 Conditional Breakpoint Displays dialog window asking user to ...
user avatar
  • 8,639
6 votes

How to stop debugger right after the execution?

From http://lldb.llvm.org/tutorial.html: (lldb) process launch --stop-at-entry -- -program_arg value Note your break main is a gdb command; lldbs error message isnt "no such symbol", it's "invalid ...
user avatar
5 votes

Set Breakpoint at Entry point fails (GDB)

From http://www.delorie.com/gnu/docs/gdb/gdb_29.html: GDB normally ignores breakpoints when it resumes execution, until at least one instruction has been executed. If it did not do this, you would ...
user avatar
5 votes
Accepted

Memory Read Access Breakpoint Question

This is a tricky question. On x86 platform the maximum length of an instruction is 15 bytes. You can read 15 bytes backwards from the current EIP and pass it to Disasm function of BeaEngine. This ...
user avatar
  • 5,850
5 votes

OllyDbg: How to set a conditional breakpoint for a value anywhere in the stack?

Not for Ollydbg, but I wrote a plugin called StackContains for x64dbg that allows you to check if a value is present in the check during conditional tracing. This allows you to break as soon as the ...
user avatar
  • 1,602
5 votes
Accepted

Can I set more than 4 memory access breakpoints in WinDbg?

Those are called hardware breakpoints and are related to debug registers in the CPU. There are usually 6 of them but only DR0-DR3 used to specify an address for hardware breakpoints.
user avatar
4 votes
Accepted

How to set a Mouse Click BreakPoint in OllyDbg?

All messages in a gui application passes through the Application Defined Callback WinProc whose prototype is LRESULT CALLBACK WindowProc( _In_ HWND hwnd, _In_ UINT uMsg, _In_ WPARAM wParam,...
user avatar
  • 14.9k
4 votes

Is there any way to export breakpoint with IDA Pro?

Open BreakPoint list with {Cntrl-Alt-B} then select all with {Cntrl-A}, then RightClick on selection, go to Groups->Selection->ExportBreakPointAsIDC... to load them in another project go to ...
user avatar
4 votes

Can I force GDB breakpoints and disassemble?

gdb is primarily a Source Level Debugger to set a bp on an address instead of symbol use * (gdb) break main Breakpoint 1 at 0x100401094: file mingtest.cpp, line 4. (gdb) break *0x100401094 Note: ...
user avatar
  • 14.9k
4 votes
Accepted

What is Hardware Breakpoint and when we need to use it?

The short answer: From the user point of view, software breakpoints are only for instructions, and you may set them as many as you want, while hardware breakpoints are universal, but you may use only ...
user avatar
  • 1,046
3 votes

Immunity Debugger - Memory Breakpoint

Yes For a memory access breakpoint1, just right click the desired address > Breakpoint > Memory, on access: The same applies to values in the hex dump: 1: A breakpoint on access will break whenver ...
user avatar
  • 428
3 votes

Radare2 (noob question) can't set breakpoint?

You are probably using an obsolete version of radare2. Uninstall your current radare2 version then run: git clone https://github.com/radare/radare2 && cd radare2 && ./sys/install.sh ...
user avatar
  • 872
3 votes

Is it possible to hook CPU instructions without severe performance impact?

Writing an hypervisor The best way to currently do this is by creating a micro-hypervisor, exploiting technologies originally created to support faster virtualization to monitor usermode as well as ...
user avatar
  • 11.4k
3 votes
Accepted

How to stop IDA debugger when a register is set to a particular value?

You can use the following IDC script for the purpose. It would stop whenever register eax contains 0. The debugger must be running when the script is executed. #include <idc.idc> static main() ...
user avatar
  • 5,850
3 votes

lldb - breakpoint not reached when attach do process (but executing when set before app running)

The reason is due to address space layout randomization (ASLR). The dynamic loader will employ some randomization in the starting address (the slide) which you must account for. When you start the ...
user avatar
  • 1,321
3 votes

Understand hardware breakPoint option in ida

The options are explained in the help but I guess it could be a little laconic. The actions in Actions group are performed whenever the breakpoint is triggered (also expressed as hit or fired), and ...
user avatar
  • 34.7k
3 votes
Accepted

Debug point not hit with radare2

Your breakpoint doesn't work as it is put in the part of the code that is not executed with the pass your provided. I'll try not to give too much hint so that you can still solve it by yourself. You ...
user avatar
3 votes
Accepted

rip adress not visible with dr command

rip = x64 eip = x86 dr shows eip in your case it is probably some demangled name (not sure why radare2 inserts the GLIBC part ) but if you strip the GLIBC part you can use iD Command to demangle ...
user avatar
  • 14.9k
3 votes

Generate software breakpoint other than int3

if you were on windows then you can try ollydbg v2
user avatar
  • 14.9k
3 votes
Accepted

Generate software breakpoint other than int3

A more flexible solution using x64dbg In addition to ollydbg2's built-in experimental support, it's relatively easy to achieve something similar in x64dbg, although some manual scripting is required. ...
user avatar
  • 11.4k
3 votes

How to debug a DLL written in .NET/C#?

I've used dnSpy in production for debugging as it can be put on a USB. It's perfectly capable of decompiling and debugging dll's. It has a pretty rich set of features. It's able to attach to ...
user avatar
3 votes
Accepted

How to navigate Disassembly view to the current instruction location?

Normally the debugger should pause at the location where breakpoint is triggered, or you can use "jump to EIP" or similar command to navigate to the instruction being executed (which should be the one ...
user avatar
  • 34.7k
3 votes
Accepted

How to use software watchpoints in LLDB?

As we know there are limitations to using watchpoints: there are a finite amount of watchpoints permitted per architecture (typically 4) and the “watched” size of memory usually caps out at 8 bytes. ...
user avatar
2 votes
Accepted

False positives with conditional breakpoint in OllyDBG

if you are setting a breakpoint on the specific address 0x412d18 you must make sure that the specific address will be hit ( setting a breakpoint on a specific address and expecting it to break on ...
user avatar
  • 14.9k
2 votes

Analyze a created thread after main thread

Why I can not set the BP ? The warning message in the screenshot is telling you that you can set the BP.
user avatar
2 votes
Accepted

Ollydbg:how to let Olly remember a breakpoint for next run

This is a limitation of OllyDbg v1. There are a couple of plugins designed to fix this in v1 (such as Breakpoint Manager), but the better solution is to upgrade to OllyDbg v2.
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible