Breakpoint
lastmod 2018-12-10created 2018-12-102 edits
A breakpoint (also called a stopping point or pause point) refers to a place in software development where a program is intentionally stopped, either temporarily or completely, and is inserted for debugging purposes. In the South Korean software development community, it is sometimes abbreviated as "beupo".
Breakpoints are used as a means of obtaining information about a program that is already running. While program execution is suspended, the programmer inspects various parts of the test environment (general-purpose registers, memory, logs, files, etc.) to determine whether the program is functioning as expected and, if not, what the problem is. Accordingly, a breakpoint can also carry a condition for suspending program execution at the desired moment.
Soft breakpoints
This is the breakpoint we commonly use when debugging. It is a 1-byte instruction. It stops the process's execution and passes control to the breakpoint exception handler.
- One-shot breakpoint
- One that is used once and then disappears from the breakpoint list
- Persistent breakpoint
- One that is stored in the breakpoint list and used repeatedly
To create a soft breakpoint, the opcode must be changed to 0xCC. For example, if there is 0x8BC3 (2 bytes), the 1 byte 0x8B must be changed to 0xCC, the interrupt 3 (INT 3) instruction. This INT 3 instruction is the instruction that halts the CPU.
debug-mode run
When we set a breakpoint in a debugger and run in debug mode, the following happens.
- When a breakpoint is set, the debugger changes the first byte to 0xCC and saves the original byte (opcode) somewhere.
- When running in debug mode, the CPU encounters 0xCC and an INT3 event occurs, and the debugger receives that interrupt.
- The debugger then checks whether the instruction pointer (EIP register) points to an entry in the breakpoint list.
- If it is in the breakpoint list, the debugger writes the previously saved byte (opcode) back to that address (where 0xCC was written). (write)
- So when the user resumes, the opcode is executed intact again.
Hardware breakpoint
If a small number of breakpoints is enough, hardware breakpoints may be suitable. Also, unlike soft breakpoints, hardware breakpoints do not modify the software. Unlike soft breakpoints, they use the INT1 event. This INT1 event is used for the sigle step event (when you press next step in the debugger) and for hardware breakpoints. Hardware breakpoints are set using what are called debug registers. A typical CPU has 8 debug registers (DR). (DR0~DR7)
- DR0~DR3: used to store the addresses of breakpoints.
- DR4 and DR5 are reserved,
- DR6 is used as the status register. This status register indicates the type of breakpoint.
- DR7 acts as an on/off switch. It also stores the conditions of the other breakpoints.
Since only DR0~DR3 of the 8 DRs store breakpoint addresses, this means you can actually create 4 hardware breakpoints.
- DR7
By setting specific flags in DR7, you can create breakpoints that trigger under the following conditions.
- When the instruction at a specific address is executed (0x00)
- When data is written to a specific address (0x01)
- When a specific address is read or written, but not executed (0x11)
- Bits 0-7 act as on/off switches for DR0-DR3, and the L and R fields indicate the scope: local or global.
- bit1 is DR0-local,
- bit2 is DR0-global, and so on, acting as switches.
- When a switch is on, it is enabled.
- bit16,17 is the type of DR0
- bit18,19 is the length of DR0, and so on.
Memory breakpoint
A memory breakpoint is not actually a breakpoint. Personally, I think it is something like the Page Fault we commonly think of. The smallest unit of memory is the memory page. When a memory page is allocated, the page gets a specific permission set. There are 4 kinds of these permissions, listed below.
- Page execution
- Page read
- Page write
- Guard page
The OS assigns these permissions to pages. A page can have several of these permissions. Also, through functions provided by the OS, you can query which permissions a page has, and you can change the permissions.
Guard Page
What we look at here is the Guard page.
- It is useful for separating the heap from the stack, and can prevent memory from being used beyond a certain limit.
- It is useful for stopping a process when a specific memory region is accessed.
For example, when we reverse engineer a network-connected application, we can set a memory breakpoint (Guard Page) on the part of memory that received a packet. This breakpoint lets us find out when and how the application uses the contents of the received packet. Access to that memory page stops the CPU and raises a guard page debugging exception. We can examine which instruction accessed the buffer memory and find out what it does.
Soft breakpoint and Guard Page
With this method, instead of soft breakpoints, which require modifying the software, you can stop execution without modifying the software.