Results 1 to 4 of 4

Thread: Some DRx Questions

  1. #1
    Lenus
    Guest

    Some DRx Questions

    as we known,in OD the hardware breakpoint use the DR0-DR3.
    my questions are
    1. F8 and F4 are also use these debug registers,but they still work after i set 4 hardware breakpoints.how can OD do?
    2. when i set a memory breakpoint,it apprea in the DR0,but it is overlayed by another hardware breakpoint after i set the hardware breakpoint.fortunately the memory breakpoint still work. where is it?
    3.at the memory map,we can set a memory breakpoint to a section with F2 or "right button" .what is the difference?
    4.when set a memory breakpoint to a section,how can OD do?i means whether the OD use the DRx debug registers or not.if no,how can OD do it?
    thx
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  2. #2
    Lord_Looser
    Guest

    Some DRx Questions

    3. OllyDbg help file:
    Set break-on-access (F2, available only under Windows NT/2000) - protects the whole memory block. After break happens, OllyDbg stops debugged program and removes breakpoint. This breakpoint is especially useful if you want to catch call or return to some module.

    Remove break-on-access (F2) - removes break-on-access protection from the memory block.

    Set memory breakpoint on access - sets memory breakpoint on the whole memory block. Program will stop each time memory block is accessed. OllyDbg supports only one memory breakpoint. Under Windows 95/98, debugged program may crash when system routines access memory blocks containing memory breakpoint. Use it as a last resort.

    others:
    http://msdn.microsoft.com/library/default.asp?url=/library/en-us/memor y/base/virtualprotectex.asp
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  3. #3
    Lenus
    Guest

    Some DRx Questions

    it is very kind of u,Lord_Looser.
    i do learn a lot of things from your reply.i think i must read the OllyDbg help file first and carefully.although there r some thing i still can't understand,thank u!!
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  4. #4
    focht
    Guest

    Some DRx Questions

    Hi,

    just some addendum ...
    Memory breakpoint management based on page protection attributes (PAGE_GUARD) needs some polish-up in newer versions.

    It is not clear if statement "OllyDbg supports only one memory breakpoint." refers to "per block/page" or whole section or whole mapped process address space.
    Technically ollydbg should be able to support one memory bp per page.
    This type of memory breakpoint should assigned an extra "show breakpoints" menu (to manage it).
    Another option could be mixed view with traditional style bp's but extra info row to indicate its type.

    Also the page protection attributes should be correctly displayed with "page guard" enabled when using this kind of memory breakpont ("memory map" view).

    Regards
    I promise that I have read the FAQ and tried to use the Search to answer my question.

Similar Threads

  1. 2 Questions
    By DaBookshah in forum The Newbie Forum
    Replies: 5
    Last Post: November 2nd, 2006, 09:06
  2. rsa Questions
    By tommychong in forum RCE Cryptographics
    Replies: 6
    Last Post: September 14th, 2005, 17:12
  3. Some DRx Questions
    By Lenus in forum The Newbie Forum
    Replies: 2
    Last Post: December 28th, 2004, 18:11
  4. ??? Questions ???
    By Anonymous in forum OllyDbg Support Forums
    Replies: 4
    Last Post: July 23rd, 2003, 14:52
  5. RegOrganizer 1.3B4: Questions and More Questions (sv / +spl/\j guru!)
    By foxthree in forum Malware Analysis and Unpacking Forum
    Replies: 17
    Last Post: March 9th, 2002, 06:43

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •