en en en en en en en en en en en en en en en en en en en ca ceb pl en en vi hy nl en en en en en en en en en en en en en en en en en en en en en it en it en fr it en en en en en en en en en en en en en en en en en en en en en en sv en sk en sk en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en pl en en en en en it en it en fr it en en en en en en en en en en en en en en ja en en en en en en en en en en en en en en en en en en it en it en ja en en en en en en en en en en en it en it en fr it en en en en en en en en en en en en en it en it en ja en en en af en en en en en en en en en en en en en en es en en en lt pl en en en en en en en en en en nl en sv en en en en en en en en en en en en en ja en en en en en en en en en en en en en it en it en fr it en en en en en en en en en en en en en en en en en en fr en en en en en en en en en ja en en en en en en en en en en en en en en en en en en en en en en en en en gl en en de en en en en en en en en en en en en en en en en en en en en ca ceb pl en en vi hy nl en en en de en
Debug Registers - Programming and Coding - Tuts 4 You
December 25, 2013 in Programming and Coding
I am reading up on ARteam securom information.
What I am wondering is te following.
Deroko in his post is posting a  method to set hardware breakpoints to work his way around with te code splicing.
What I am mis understanding is te following code from te goodies dir there is vmtrace.asm.
In here he sets Dr0 with te following info:
What I am missing here is how did he calculate 10101h.
According to te intel manual, there is 31 bits:
0     0   1     0    0    0  0   0   0   1  0 0 0 0 0 0 0 0 1 0
LE  LE RW RW                                    3 3 2 2 1 1 0 0    DEBUG REGS
Based on te above I am doing te following:
I set bit 1 to enable global breakpoint for debug register 0
Than I set 0 to te other bits till 10, according to te intel manual bit 10 should be 1.
Bits 11 - 15 are set to 0
Bit 16 and 17 describes what type of breakpoint to set
00 break on execution
01 break on write                  //Bit 16 = 0 - Bit 17 = 1?
10 break on read/ write
11 break on read/ write
Than bit 18 and 19 describe te size:
According to intel manual:
00 1 byte                             //Bit 18 = 0 - Bit 19 = 0 to tell 1 byte?
10 undefined/ 8 bytes
based on te above my results = 20402h
What am I missing here? as my breakpoint isn't triggered either, it only works when setting 10101h and I have no idea why.
Could someone explain to me how to work with these.
Posted December 25, 2013
Posted December 25, 2013
sure it isnt 10101h as a b, its bitflags so binary makes more sense here,
Posted December 26, 2013
Posted December 26, 2013
evlncrn8 te result from deroko = 10000000100000001 -> converted to hexadecimal as 10101h
My result = 100000010000000010 -> converted to hexadecimal as 20402h.
I have no idea why I am not getting te result he is getting.
It looks like he is setting lesser bits or I am missing an important thing here.
Posted December 26, 2013
Posted December 26, 2013 (edited)
Some time ago I wrote a usable hardware breakpoint structure + conversion to uint and vice-versa, so I decided to extend te thing a little.
Using this code (c++):
So you're setting a local hardware breakpoint (that's OK), on execute with size 2 (which is ignore iirc)
Also notice, that te code you provided:
mov [ecx.context_dr0], eax //eax reg hold te address to breakpointmov [ecx.context_dr7], 10101h //should be a breakpoint on write
will NOT work work x64, you should first set dr7 and then dr0 (otherwise dr0 gets reset):
mov [ecx.context_dr7], 10101h //should be a breakpoint on writemov [ecx.context_dr0], eax //eax reg hold te address to breakpoint
Seems like deroko made a small mistake in his paper..
EDIT: 0x10001 is te result of, so you should use that:
dr7.HWBP_MODE[0]=MODE_LOCAL; //enable hardware breakpointdr7.HWBP_SIZE[0]=SIZE_1; //byte+word+dword(+qword)dr7.HWBP_TYPE[0]=TYPE_WRITE; //write
Edited December 26, 2013 by Mr. eXoDia
Posted December 26, 2013
Posted December 26, 2013
will NOT work work x64, you should first set dr7 and then dr0 (otherwise dr0 gets reset):
what do you mean? you're only modifying a struct in memory, as long as you call SetContext() only once, you'll be fine.
Also, writing to a dr register does not have any sideeffects on other dr registers, to my knowledge (x86 and x64).
Posted December 26, 2013
Posted December 26, 2013
Thanks for te information.
I am trying to do it in ASM, will see what I can make out of this C++ information.
Atm te results still don't make sense to me, and all te results are giving me are stack overflows (as te breakpoint is never triggered).
So: 10001 = te right result, but I still don't understand how to calculate them manually by setting te bits.
Posted December 26, 2013
Posted December 26, 2013
would set a data breakpoint on te address in DR0, local, on write for one byte.
Te breakpoint would not work if
* there is no valid address in DR0
* te address is only read, not written to
as to te why:
Flags for each of te 4 debug registers (2 for each).
Te first flag is set to specify a local breakpoint (so te CPU resets te flag when switching tasks),
and te second flag is set to specify a global breakpoint.
2 bits for each register, defining when te breakpoint will be triggered:
00b - Triggers when code is executed
01b - Triggers when data is written
11b - Triggers when data is read or written
2 bits for each register, defining te size of te breakpoint:
00b - 1 byte
01b - 2 bytes
10b - 8 bytes
11b - 4 bytes
Te rightmost flag (position 0) enabes a local breakpoint for DR0.
Te leftmost flag (position 17) specifies "data written".
Te 24th bit (not written) is zero and specifies "1 byte size".
Posted December 26, 2013
Posted December 26, 2013 (edited)
what do you mean? you're only modifying a struct in memory, as long as you call SetContext() only once, you'll be fine.
Also, writing to a dr register does not have any sideeffects on other dr registers, to my knowledge (x86 and x64).
Merry Christmas to you too!
Here is a video to show what I mean, not setting dr7 sort of 'locks' te dr0 register... But you're indeed right about te structure part, in this case it doesn't matter..
Edited December 26, 2013 by Mr. eXoDia
Posted December 27, 2013
Posted December 27, 2013
Thanks for te explanations guys!
It's time to finish this little debug engine.
Posted May 6, 2014
Posted May 6, 2014
Stumbled over this old thread, meanwhile there is a tool to easy calculate Debug Register values -> https://bitbucket.org/cypherpunk/drx_calc
Posted May 8, 2014
Posted May 8, 2014
Create an account or sign in to comment
You need to be a member in order to leave a comment
Sign up for a new account in our community. It's easy!
Register a new account
Already have an account? Sign in here.
Go to topic listing
Tuts 4 You - Forums
Tuts 4 You - Downloads
Powered by Invision Community