Click here to Skip to main content
Click here to Skip to main content

Toggle hardware data/read/execute breakpoints programmatically

, 23 Jul 2008 CPOL
Rate this:
Please Sign up or sign in to vote.
Simple code to introduce a hardware breakpoint mechanism.

Introduction

I decided to write this article about hardware breakpoints for the following reasons:

  • Visual C++ only supports write-only data breakpoints. You might want to trigger a break when data is read as well.
  • You might not be using Visual C++, so chances are that your debugger uses some slow software-based mechanism.
  • You might want to set/remove a breakpoint programmatically.
  • You may be interested in low level CPU stuff!

Features

  • Works for x86 and x64.
  • Supports upto 4 hardware breakpoints per thread.

Debug Registers

x86/x64 contains a set of debug registers, named DR0, DR1, DR2, DR3, DR6, and DR7. These registers are 32-bit when in 32-bit mode, and 64-bit when in long mode. DR0, DR1, DR2, and DR3 contain the linear addresses of the breakpoint, and DR7 contains the bits explained here:

Bits Meaning
0-7 Flags for each of the 4 debug registers (2 for each). The first flag is set to specify a local breakpoint (so the CPU resets the flag when switching tasks), and the second flag is set to specify a global breakpoint. In Windows, obviously, you can only use the first flag (although I haven't tried the second).
16-23

2 bits for each register, defining when the breakpoint will be triggered:

  • 00b - Triggers when code is executed
  • 01b - Triggers when data is written
  • 10b - Reserved
  • 11b - Triggers when data is read or written
24-31

2 bits for each register, defining the size of the breakpoint:

  • 00b - 1 byte
  • 01b - 2 bytes
  • 10b - 8 bytes
  • 11b - 4 bytes

We use SetThreadContext to set the necessary flags for the thread. After that, when the breakpoint is triggered, an exception of the value EXCEPTION_SINGLE_STEP is raised.

Setting the Breakpoint

HANDLE SetHardwareBreakpoint(HANDLE hThread,HWBRK_TYPE Type,HWBRK_SIZE Size,void* s);
  • hThread - Handle to the thread for which the breakpoint is to be set.
  • Type - Type of the breakpoint:
    • HWBRK_TYPE_CODE
    • HWBRK_TYPE_READWRITE
    • HWBRK_TYPE_WRITE
  • Size - Size of the breakpoint:
    • HWBRK_SIZE_1
    • HWBRK_SIZE_2
    • HWBRK_SIZE_4
    • HWBRK_SIZE_8
  • addr - The address of the breakpoint.

The function returns a handle to the breakpoint, to be used later in RemoveHardwareBreakpoint. It can return 0 if:

  • You do not have access to the thread.
  • You have set the maximum number of breakpoints for that thread (4).

Removing the Breakpoint

bool RemoveHardwareBreakpoint(HANDLE hBrk);

Removes the breakpoint, returning true on success.

Sample

int __stdcall WinMain(HINSTANCE,HINSTANCE,LPSTR,int)
{
 char c1[100] = {0};
 lstrcpyA(c1,"Hello 1");
 HANDLE hX1 = 0;

 hX1 = SetHardwareBreakpoint(GetCurrentThread(), 
       HWBRK_TYPE_READWRITE,HWBRK_SIZE_4,c1);
 __try
 {
   volatile char a1 = c1[2];
   // To ensure that it won't be optimized out.
 }
 __except(GetExceptionCode() == STATUS_SINGLE_STEP)
 {
   MessageBoxA(0,"Breakpoint hit!",0,MB_OK);
 }
 RemoveHardwareBreakpoint(hX1);
 return 0; 
}

I wait for your comments and questions!

History

  • July 24, 2008 - First post.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Share

About the Author

Michael Chourdakis
Engineer
Greece Greece
I'm working in C++, PHP , Flash and DSP Programming, currently experimenting with Windows 7 technologies and professional audio applications.
 
I 've a PhD in Digital Signal Processing.
 
My home page: http://www.michaelchourdakis.com

Comments and Discussions

 
SuggestionThere is no need in creating an event PinmemberDiesIrae7-Aug-14 16:26 
GeneralRe: There is no need in creating an event PinmemberMichael Chourdakis7-Aug-14 17:06 
QuestionBreakpoints don't work under Olly 1 or 2 Pinmemberynot6730-Jun-14 0:46 
AnswerRe: Breakpoints don't work under Olly 1 or 2 PinmemberMichael Chourdakis1-Jul-14 2:16 
QuestionThis is awesome! PinprofessionalStewart_Lynch27-Mar-14 5:31 
Question"th" function question Pinmemberrabbit_slayer14-Nov-12 4:33 
AnswerRe: "th" function question PinmemberMichael Chourdakis14-Nov-12 6:38 
AnswerRe: "th" function question Pinmember_FKS_7-May-13 14:16 
QuestionBreakpoints don't trigger in the debugger? PinmemberMember 86976873-Apr-12 16:02 
AnswerRe: Breakpoints don't trigger in the debugger? PinmemberMichael Chourdakis3-Apr-12 21:02 
GeneralRe: Breakpoints don't trigger in the debugger? PinmemberMember 86976873-Apr-12 22:09 
GeneralRe: Breakpoints don't trigger in the debugger? PinmemberMember 86976879-Apr-12 16:42 
GeneralRe: Breakpoints don't trigger in the debugger? PinmemberMember 869768710-Apr-12 10:47 
QuestionHWBRK_TYPE_CODE not working as expected in VS 2008 PinmemberBrad Heide30-Mar-12 13:27 
I tried the test sample today in the Visual Studio 2008 debugger. It breaks execution as expected when calling SomeFunc() but two unexpected things happen:
 
1. VS fails to find the source code telling me "There is no source code available for the current location."   When I show disassembly it shows me on the following line:
 
01021005   jmp            SomeFunc (1021020h)
 
This despite that it shows the source code just fine for the HWBRK_TYPE_READWRITE and HWBRK_TYPE_WRITE cases.
 
2. It gets stuck on the call to SomeFunc(). Stepping over or into the function doesn't work and resuming execution (F5) doesn't work. Each time I try to step it just seems to break again in the same place. That is, it doesn't move from the jmp instruction shown in the disassembly.
 
Again I want to point out that when it breaks on the HWBRK_TYPE_READWRITE and HWBRK_TYPE_WRITE breakpoints I am able to step and resume execution using the VS debugger, just not with a HWBRK_TYPE_CODE breakpoint.
 
Is this the expected behavior of HWBRK_TYPE_CODE?
AnswerRe: HWBRK_TYPE_CODE not working as expected in VS 2008 PinmemberMichael Chourdakis30-Mar-12 21:59 
Questionmeaning of hThread? Pinmemberrrdillon13-Oct-11 9:44 
AnswerRe: meaning of hThread? PinmemberMichael Chourdakis13-Oct-11 9:50 
GeneralRe: meaning of hThread? Pinmemberrrdillon15-Oct-11 15:45 
GeneralRe: meaning of hThread? PinmemberMichael Chourdakis15-Oct-11 22:12 
GeneralGood Job Pinmemberimbadyc8-Jun-11 23:05 
GeneralMixed-mode applications PinmemberBrendan Wilson13-Aug-10 13:35 
GeneralRe: Mixed-mode applications PinmemberMichael Chourdakis15-Aug-10 4:43 
GeneralRe: Mixed-mode applications PinmemberBrendan Wilson15-Aug-10 10:43 
GeneralRe: Mixed-mode applications PinmemberIvan Kolev23-Feb-12 0:02 
GeneralSounds good Pinmembersvsundar (Vairavan)12-Aug-08 7:19 
GeneralRe: Sounds good PinmemberMichael Chourdakis12-Aug-08 9:05 
QuestionCould you add VS2005 solution file also? Pinmembernalla12-Aug-08 0:24 
AnswerRe: Could you add VS2005 solution file also? PinmemberMichael Chourdakis12-Aug-08 1:50 
QuestionWould it have to disrupt the thread? Pinmembersupercat926-Jul-08 17:59 
AnswerRe: Would it have to disrupt the thread? PinmemberMichael Chourdakis26-Jul-08 22:15 
GeneralInteresting Pinmemberjuggler24-Jul-08 4:11 
GeneralRe: Interesting PinmemberMichael Chourdakis24-Jul-08 4:20 
GeneralRe: Interesting Pinmemberjuggler24-Jul-08 4:33 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

| Advertise | Privacy | Terms of Use | Mobile
Web04 | 2.8.141220.1 | Last Updated 24 Jul 2008
Article Copyright 2008 by Michael Chourdakis
Everything else Copyright © CodeProject, 1999-2014
Layout: fixed | fluid