📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  Hardware Breakpoints

Topic created on: October 7, 2007 05:52 CDT by Soul12 .

yo guys

ive been playing with Hardware Breakpoints lately..but i have a little trouble getting it to work, ive searched google high and low for a working example and ive read the intel manuals and so on. i belive i got the Debug Registers set correctly. and i use a Standard Debugloop to catch the debug exception, it worked 1 time and then never worked again. so what im asking is if anybody has a working example with loop and everything ? :) would make me a happy camper

  jms     October 7, 2007 09:46.39 CDT
What are you using to set these breakpoints? Custom code? PyDBG? Olly/ImmDbg? Post a snippet of code and that would be helpful for us to help you figure out what's going on.

  Soul12     October 7, 2007 15:00.30 CDT
coding my own code mate..but i cant make it work probertly..everything is set right..the debug registers and so ..but yet i get wierd results..so looking for an working example of kind

  baibhav     October 8, 2007 04:34.21 CDT
Do you want to clear debug register or want to set any value in it ?

  Soul12     October 8, 2007 06:54.17 CDT
i want to use hardware breakpoints :)

context.dr0 = AddressToBreakon
context.dr7 = 0x1 // set first bit to 1 for back compatability

everything is now set for a Break on execution .. according to the intel manuals .. now im then entering a debug loop with a WaitOnDebugEVent() which then gets checked if it was a BP event and takes appropriate action..but i never reach my BP .. and tried setting it to Entrypoint and a instructions after EP and orther should be fool proof stuff.

and im wondering why my breakpoint aint fired....

  aLS     October 8, 2007 08:10.37 CDT
Hi Soul12, i think your problem is the DR7 register. I cant remember very well right now but im almost sure that you have to set more flags on it. At least on of the L0/L3 and G0/G3 to enable the bp and the GE and LE bits (for back compatibility). And the lowest bit enables the local breakpoint, isnt for compatibility.

Hope it helps

  baibhav     October 8, 2007 09:13.10 CDT
use following code  

ontext.dr0 = AddressToBreakon
context.dr7 = 0x303
It may work .. if not please let me know ..

Baibhav Singh

  Soul12     October 8, 2007 14:37.10 CDT
als, ya could be i remembered wrong and your right about the compatibillity .. and well i shouldent need to set more bits...

Instruction breakpoint addresses must have a length specification of 1 byte (the
LENn field is set to 00).

so unless making the BreakPoint Global is the sollution ? i dunno.

baibhav , why would that work ? you set the local and global bp.. ill try it thou. ( Dident wOrk..ill keep playing )

  aLS     October 8, 2007 17:53.55 CDT
Soul12, The GE and LE bits are not important if you're just testing but, as i said on my last post, you *must* set the Ln or Gn to enable the desired breakpoint, as in the value given by baihav.

You're right on the LENn point. the value given by baibhav should work for a breakpoint on execution if the LENn bit is set to 1.

Cheers

  aLS     October 8, 2007 23:33.14 CDT
"...if the LENn bit is set to 1."
I mean, to 0.

  Soul12     October 9, 2007 05:45.11 CDT
okay seems the culprit was the Debug EVents ..i was lookin for a EXCEPTION_BREAKPOINT but Hardware bp's raises EXCEPTION_SINGLE_STEP .. wierd but it works

  pedram     October 10, 2007 15:25.15 CDT
> Soul12: okay seems the culprit was the Debug EVents ..i was lookin for a EXCEPTION_BREAKPOINT but Hardware bp\'s raises EXCEPTION_SINGLE_STEP .. wierd but it works

Sorry for my laziness. I read this question on my iPhone and meant to respond but totally forgot. That is exactly the problem, hardware breakpoints are delivered as single step events. Check the PyDbg code for my implementation of differentiating between HW BP generated single step and actual generated single steps:

http://paimei.openrce.org:8000/browser/trunk/pydbg/pydbg.py#L1634

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit