PDA

View Full Version : Hello question about olly dbg tracking back breakpoint


nah
June 27th, 2013, 02:49
Hi, i explain briefly my question. The situation is that i set hardware breakpoint on accsess, now when some function reads the memory the breakpoint will hit, but how to track/trace it to back to see whats going on....???

blabberer
June 27th, 2013, 14:53
by looking at the stack ? ( ctrl+k )
is stack empty ?
by setting a break on the procedure entry and watching the return address ?? (is analysis empty)
manually walking the dis assembly for conditional jumps and breaking on branches ? and watching the stack ???
good old tracing from a known point and narrowing down

there is no substitute to manual tracing

disavowed
June 29th, 2013, 11:17
Your question is a bit vague, but if you're asking how to know what instruction caused the breakpoint to be hit, just look at the instruction previously executed (one line above EIP in the disassembly). The debugger breaks right *after* the instruction that caused the hardware breakpoint to hit was executed.

nah
July 1st, 2013, 21:32
i mean when a breakpoint hits i want to follow it back, how would i do it step in f7, step out f8 f9 run wont do it ...

disavowed
July 2nd, 2013, 17:25
Sounds like what you want is IntelliTrace - http://msdn.microsoft.com/en-us/library/dd264915(v=vs.100).aspx
Works great, as long as you're debugging your own code.