Archive for the ‘Reverse Engineering’ Category
Bits
Continuing the reverse engineering and software development series on debugging, below I review the role of bits in debugging.
Bits 0-7 are the on/off switches of breakpoints.
Bits 8-15 are used for non-debugging purposes in DR7
Bits 16-31 determine the type and length of the breakpoint that is being set
To Do: Add to this post or merge it with prior debugging posts
Breakpoints and other Debug Events
There are 3 major types of events you encounter when debugging:
- Breakpoints
- Memory violations (!!)
- Exceptions
- Software Breakpoints
- Hardware Breakpoints
- Memory Breakpoints
Using assembly language, to process a soft breakpoint the single byte instruction must be converted into an operation code (a.k.a. an opcode).
MOV EAX, EBX
8BC3
Hardware breakpoints, associated with the INT1 event, are useful when a small number of breakpoints are needed and the software can’t be modified. When registers are used in this way they’re known as debug registers.
- Page execution
- Page read
- Page write
- Guard page
Introduction to the Stack
The stack stores information about how a function is called, the parameters it takes, and how it should return after it is finished executing.
CPU Registers: an Overview
- EAX — a.k.a. the accumulator register, used for performing calculations as well as storing return values
- EDX — a.k.a. the data register, basically an extension of EAX
- ECX — a.k.a. the count register, used for looping, counts DOWNWARD not upward
- ESI — a.k.a. the source index, used for reading, holds the location of the input data stream
- EDI — a.k.a. the destination index, used for writing, points to the location where the result is stored
- EBP — a.k.a. the base pointer, used for managing function calls and stack operations, points to the bottom of the stack unless freed up from this function by the compiler, in which case it would be an extra general purpose register
- ESP — a.k.a. the stack pointer, used for managing function calls and stack operations, points to the very top of the stack
- EBX — an extra register, not designed for anything specificAnother register worth mentioning is:
- EIP — a.k.a. the instruction pointer, points to the current instruction that is being executed; as binary code is being executed by the CPU the EIP is updated to reflect the location where the execution is occurring