Results 1 to 3 of 3

Thread: Software Memory Breakpoints ??

  1. #1
    Emerson
    Guest

    Software Memory Breakpoints ??

    Hi guys,

    I'm trying to find the technique used to detect memory access and I've not
    found much by googling. I have written code for using the dbg regs but it's
    limited to 4 BPM's. Are guard pages the way to go ?? Granularity of 4k means
    I'll get alot of hits with the number of vars likely to be in a 4k block, and
    quite a bit of overhead I guess !!

    Any help or idea's at all would be cool

    Cheerz,
    Emerson
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  2. #2
    Midfielder comrade's Avatar
    Join Date
    Jun 2006
    Location
    United States
    Posts
    46
    That's only way I think...

  3. #3
    AndreaGeddon
    Guest
    if you need ranged breakpoints (like bpr on 9x) you can emulate them changing page protections. Page_guard could be useful, but it is turned off every time the status_guard_page is raised, so if you need a harder control you can launch the process with debug_process flag and set the type of access you want to check with VirtualProtect, and trap every fault resulting by a memory access you want to check In this way for example being a debugger you can set a bp on a little range and filter with your exception_access_violation handler the faults that occur in the same page where the range is but that you are not interested on. For example if you want a bp on range 00401000 - 00401010, due to page boundary you will be notified at every access in the page 00401000 00402000 but your handler can filter unwanted > 00401010 accesses. You could also use conditional breakpoints! You should have to set page protection at every fault notify so this is *really* slow, however it works The page_guard is too limited i think, its useful only in few cases, when you dont need a deep control of memory ranges.
    Having a hardware support like in 9x would be great!
    Bye!!!
    AndreaGeddon
    I promise that I have read the FAQ and tried to use the Search to answer my question.

Similar Threads

  1. Defeating Memory Breakpoints
    By walied in forum Advanced Reversing and Programming
    Replies: 12
    Last Post: October 19th, 2013, 04:00
  2. Replies: 1
    Last Post: January 20th, 2012, 03:54
  3. Memory Hacking Software 3.0.0.0 Pro
    By L. Spiro in forum Tools of Our Trade (TOT) Messageboard
    Replies: 0
    Last Post: July 9th, 2006, 14:15
  4. Memory Hacking Software 2.0.4.7
    By L. Spiro in forum Tools of Our Trade (TOT) Messageboard
    Replies: 21
    Last Post: September 16th, 2005, 11:24
  5. Memory Hacking Software
    By disavowed in forum Tools of Our Trade (TOT) Messageboard
    Replies: 7
    Last Post: January 12th, 2005, 23:47

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •