Results 1 to 2 of 2

Thread: Hardware memory breakpoints

  1. #1

    Hardware memory breakpoints

    Hi!

    When I have a certain byte or range of bytes of which I know it will contain certain interesting data at some point, I usually set a hardware breakpoint on it.

    However, I noticed that it doesn't always break. For example, now I want to keep an eye on the byte at DS:[9F2020], so I set a hardware BP there. However

    (EAX = 9F2020)
    MOV DWORD PTR DS:[EAX],EBP

    won't cause Olly to break. However

    (EDI = 9F2024)
    REP STOS DWORD PTR ES:[EDI]

    will cause Olly to break.

    Am I misinterpreting the adressing system in Olly? I assume that

    009F2020 | 00 00
    __________^this is the byte on 009F2020

    Do I need just to set my breakpoint a byte or 4 bytes before that?
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  2. #2
    Super Moderator
    Join Date
    Dec 2004
    Posts
    1,456
    Blog Entries
    15
    how did you set hardware breakpoint
    for memory read and write
    you either need to set
    hardware bp->memory on access->byte // word // dword or
    hardware bp -> memory on write ->byte // word // dword

    if you had set an execute break it will not break on access of that memory

    i dont see any problems in hw bp

    Code:
    00401000 >MOV     EAX, 403000
    00401005  NOP
    00401006  NOP
    00401007  MOV     DWORD PTR DS:[EAX], EBP
    00401009  MOV     DWORD PTR DS:[EAX], EBP
    0040100B  NOP
    0040100C  NOP
    0040100D  NOP
    0040100E  CALL    00403000
    00401013  JMP     SHORT 00401013
    Log data
    Address Message
    Code:
    00401009   Hardware breakpoint 2 at msgbox.00401009		<----------------- second breakpoint @401009 hit
    						 	first 401007 did not hit though eax contains 403000
    00403000   Hardware breakpoint 1 at msgbox.MsgCaption               execution hw bp hit

Similar Threads

  1. Conditional Hardware break on memory address not working
    By OpenStrife in forum OllyDbg Support Forums
    Replies: 3
    Last Post: March 18th, 2013, 23:06
  2. how to view your memory breakpoints?
    By jaked in forum OllyDbg Support Forums
    Replies: 4
    Last Post: September 27th, 2005, 06:56
  3. Hardware breakpoints?
    By psyCK0 in forum Plugins (General)
    Replies: 5
    Last Post: February 28th, 2004, 12:13
  4. Hardware-based read-only memory
    By disavowed in forum Advanced Reversing and Programming
    Replies: 6
    Last Post: January 12th, 2004, 21:57
  5. Hardware breakpoints
    By Ricardo Narvaja in forum OllyDbg Support Forums
    Replies: 7
    Last Post: December 3rd, 2002, 04:02

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •