cBreakpoint
cBreakpoint
I am AndrewThomas\Jetamay and thus I have authorized myself to post this here.
Project Download Link:
Look @ attachments
Warning : Hardware breakpoints, or any for that matter, can cause applications to crash if they're not handled safely.
Notice : Only compile this code in debug mode. When compiling this code in release mode, the optimization process screws it up a bit. Thus avoid compiling this in release mode if you plan to make use of hardware breakpoints. I am in the process of fixing this.
Notice : When running this application through a debugger, like the one provided in MSVS2003, hardware breakpoints will cause the EIP to freeze, along with registers, etc, however no exception is throw for it to be handled inside the debugger, thus the exception handler does not catch the exception, leaving the thread at a dead stand-still. This may only be a fault only in the software I am using to debug the class. Please report back about this.
Notice : This class was designed for 32 bit machines only, and an unexpected result may occur when used otherwise. Thus I have forced PC32BIT to be defined before you make use of the class. This is to inform all 64 bit users that the code they're running was not meant for their machine.
Notice : If you intend to use hardware breakpoints in hacks, make sure you're not overwriting breakpoints in the target's threads(if it makes use of them). Also assure that your target isn't scanning the thread's debug registers for protection purposes. If it is, you may have to write a local hook for the API.
Notice : Reffer to the constants defined below. There are two types of breakpoints defined below, global, and local, you are not able to set global breakpoints in the windows operating system, however I have included the global definition for the sake of education.
[highlight=cpp]const char CHWBP_BP_LOCAL = 0x01;
const char CHWBP_BP_GLOBAL = 0x02;[/highlight]
Notice : When setting INT3 breakpoints, the Breakpoint::bBpSize members MUST be 1 byte(CHWBP_BP_SIZE_1B), as well as Breakpoint::bBpType set to BpType_Execution, otherwise the method you passed this to will return error(-1).
Notice : When setting a hardware breakpoint on execution, the size MUST be 1 byte, otherwise the method you passed this to will return error(-1).
bitTools.h
bitTools.h is a group of methods used to perform bitwise operations with ease. I included these methods so I could debug and write my class without having to worry if I set a bit incorrectly. It doesn't include all the operations, just the ones needed for the cBreakpoint class. As you will soon see, these methods could have been merged into a single function, while adding a flag param to determine which sort of bitwise operation to perform, but I decided, for organizations sake, I should leave them separated, you may merge them if you'd like. As you can see they're all templated, and because of this, their definition and body remain in a header file. The templating allows you to use various data types. They're all pretty self explanatory, if you need to me to explain, just say so.
Notice :
[highlight=cpp]
#pragma once
template<typename T>
int OrBit(T& inBuf, int shiftCount, T bitState, int bitBaseBits, bool inverse = false)
{
int bitShift = 0;
if(inverse)
{
int totalSize = sizeof(T) * 8;
bitShift = totalSize - shiftCount - bitBaseBits;
}else
bitShift = shiftCount;
T bitWord = bitState;
bitWord = bitWord<<bitShift;
inBuf = inBuf | bitWord;
return 1;
}
template<typename T>
int XorBit(T& inBuf, int shiftCount, T bitState, int bitBaseBits, bool inverse = false)
{
int bitShift = 0;
if(inverse)
{
int totalSize = sizeof(T) * 8;
bitShift = totalSize - shiftCount - bitBaseBits;
}else
bitShift = shiftCount;
T bitBuffer = bitState;
bitBuffer = bitWord<<bitShift;
inBuf = inBuf ^ bitBuffer;
return 1;
}
template<typename T>
int AndBit(T& inBuf, int shiftCount, T bitState, int bitBaseBits, bool inverse = false)
{
int bitShift = 0;
if(inverse)
{
int totalSize = sizeof(T) * 8;
bitShift = totalSize - shiftCount - bitBaseBits;
}else
bitShift = shiftCount;
T bitBuffer = bitState;
bitBuffer = bitBuffer<<bitShift;
inBuf = inBuf & bitBuffer;
return 1;
}
template<typename T>
int GetSetBitCount(T inBuf)
{
int size = sizeof(T) * 8;
int bitCount = 0;
T bitBuffer = inBuf;
for(unsigned int i = 0; i < size; i++)
{
if((bool) bitBuffer & 1)
bitCount++;
bitBuffer = inBuf<<1;
}
return bitCount;
}
template<typename T>
int IsBitSet(T inBuf, int bitCount)
{
T bitBuffer = 1;
bitBuffer = bitBuffer << bitCount;
T ret = inBuf & bitBuffer;
return (bool) ret;
}
[/highlight]
Project Download Link:
Look @ attachments
Warning : Hardware breakpoints, or any for that matter, can cause applications to crash if they're not handled safely.
Notice : Only compile this code in debug mode. When compiling this code in release mode, the optimization process screws it up a bit. Thus avoid compiling this in release mode if you plan to make use of hardware breakpoints. I am in the process of fixing this.
Notice : When running this application through a debugger, like the one provided in MSVS2003, hardware breakpoints will cause the EIP to freeze, along with registers, etc, however no exception is throw for it to be handled inside the debugger, thus the exception handler does not catch the exception, leaving the thread at a dead stand-still. This may only be a fault only in the software I am using to debug the class. Please report back about this.
Notice : This class was designed for 32 bit machines only, and an unexpected result may occur when used otherwise. Thus I have forced PC32BIT to be defined before you make use of the class. This is to inform all 64 bit users that the code they're running was not meant for their machine.
Notice : If you intend to use hardware breakpoints in hacks, make sure you're not overwriting breakpoints in the target's threads(if it makes use of them). Also assure that your target isn't scanning the thread's debug registers for protection purposes. If it is, you may have to write a local hook for the API.
Notice : Reffer to the constants defined below. There are two types of breakpoints defined below, global, and local, you are not able to set global breakpoints in the windows operating system, however I have included the global definition for the sake of education.
[highlight=cpp]const char CHWBP_BP_LOCAL = 0x01;
const char CHWBP_BP_GLOBAL = 0x02;[/highlight]
Notice : When setting INT3 breakpoints, the Breakpoint::bBpSize members MUST be 1 byte(CHWBP_BP_SIZE_1B), as well as Breakpoint::bBpType set to BpType_Execution, otherwise the method you passed this to will return error(-1).
Notice : When setting a hardware breakpoint on execution, the size MUST be 1 byte, otherwise the method you passed this to will return error(-1).
cBreakpoint
I'm going to explain to you how the class I wrote(cBreakpoint) works, and how you can use it in your programs. Before asking questions about this post, please assure you've read on vectored exception handlers, Hardware breakpoints, and the first eight pages of the Intel Developers Manual Volume 3. As well as a basic understanding of bits and bitwise operators in C++, intermediate C++ knowledge, and an understanding of how the windows paging system and multi-threading system works.bitTools.h
bitTools.h is a group of methods used to perform bitwise operations with ease. I included these methods so I could debug and write my class without having to worry if I set a bit incorrectly. It doesn't include all the operations, just the ones needed for the cBreakpoint class. As you will soon see, these methods could have been merged into a single function, while adding a flag param to determine which sort of bitwise operation to perform, but I decided, for organizations sake, I should leave them separated, you may merge them if you'd like. As you can see they're all templated, and because of this, their definition and body remain in a header file. The templating allows you to use various data types. They're all pretty self explanatory, if you need to me to explain, just say so.
Notice :
Regardless if you're setting an INT3 or HWBP, you will not need to use any of these bitwise operations, they're only included for the use of cBreakpoint.
Some characters may be hidden or removed by php tags. Refer to actual copy of source provided in download for use.[highlight=cpp]
#pragma once
template<typename T>
int OrBit(T& inBuf, int shiftCount, T bitState, int bitBaseBits, bool inverse = false)
{
int bitShift = 0;
if(inverse)
{
int totalSize = sizeof(T) * 8;
bitShift = totalSize - shiftCount - bitBaseBits;
}else
bitShift = shiftCount;
T bitWord = bitState;
bitWord = bitWord<<bitShift;
inBuf = inBuf | bitWord;
return 1;
}
template<typename T>
int XorBit(T& inBuf, int shiftCount, T bitState, int bitBaseBits, bool inverse = false)
{
int bitShift = 0;
if(inverse)
{
int totalSize = sizeof(T) * 8;
bitShift = totalSize - shiftCount - bitBaseBits;
}else
bitShift = shiftCount;
T bitBuffer = bitState;
bitBuffer = bitWord<<bitShift;
inBuf = inBuf ^ bitBuffer;
return 1;
}
template<typename T>
int AndBit(T& inBuf, int shiftCount, T bitState, int bitBaseBits, bool inverse = false)
{
int bitShift = 0;
if(inverse)
{
int totalSize = sizeof(T) * 8;
bitShift = totalSize - shiftCount - bitBaseBits;
}else
bitShift = shiftCount;
T bitBuffer = bitState;
bitBuffer = bitBuffer<<bitShift;
inBuf = inBuf & bitBuffer;
return 1;
}
template<typename T>
int GetSetBitCount(T inBuf)
{
int size = sizeof(T) * 8;
int bitCount = 0;
T bitBuffer = inBuf;
for(unsigned int i = 0; i < size; i++)
{
if((bool) bitBuffer & 1)
bitCount++;
bitBuffer = inBuf<<1;
}
return bitCount;
}
template<typename T>
int IsBitSet(T inBuf, int bitCount)
{
T bitBuffer = 1;
bitBuffer = bitBuffer << bitCount;
T ret = inBuf & bitBuffer;
return (bool) ret;
}
[/highlight]
cBreakpoint
cBreakpoint has several methods, I will explain both the private and public methods. Please note, the class's members are static to avoid people from creating multiple instances of the same class(as it is not required to do so). If you wish to create your own instance of the class, you may remove the static prefix on the methods.
The processor can set up to 4 hardware breakpoints. When windows starts executing a thread, it will set the processors registers according to where the thread was last, and resume exectution, until it decides to move to another thread, it then stores the thread's registers and other information accociated with the thread and switches to another. This allows up to 4 HWBPs per a thread. The processor has 8 debug registeres. This is where understanding the window's paging system and virtual addresses will be helpful.
They are :
DR0 - Linear address of the first breakpoint
DR1 - Linear address of the second breakpoint
DR2 - Linear address of the thrid breakpoint
DR3 - Linear address of the fourth breakpoint
DR4 - Irrelevent to this tutorial, read intel developers manual Vol.3
DR5 - Irrelevent to this tutorial, read intel developers manual Vol.3
DR6 - Irrelevent to this tutorial, read intel developers manual Vol.3
DR7 - Bits representing whether the breakpoint is enabled(locally or globally), the breakpoint's condition, and the breakpoint's size. Along with a few other irrelevent(to this tutorial) variables.
That was the explanation in a slightly complicated form, but for simpler users, just know this :
Don't use two of the same debug registers at a time.
[highlight=cpp]
enum DebugRegisterIndex
{
DbgReg0 = 0,
DbgReg1 = 1,
DbgReg2 = 2,
DbgReg3 = 3,
};
[/highlight]
Class Enumrators:
Most are self explanatory, however, I will talk about DebugRegisterIndex.The processor can set up to 4 hardware breakpoints. When windows starts executing a thread, it will set the processors registers according to where the thread was last, and resume exectution, until it decides to move to another thread, it then stores the thread's registers and other information accociated with the thread and switches to another. This allows up to 4 HWBPs per a thread. The processor has 8 debug registeres. This is where understanding the window's paging system and virtual addresses will be helpful.
They are :
DR0 - Linear address of the first breakpoint
DR1 - Linear address of the second breakpoint
DR2 - Linear address of the thrid breakpoint
DR3 - Linear address of the fourth breakpoint
DR4 - Irrelevent to this tutorial, read intel developers manual Vol.3
DR5 - Irrelevent to this tutorial, read intel developers manual Vol.3
DR6 - Irrelevent to this tutorial, read intel developers manual Vol.3
DR7 - Bits representing whether the breakpoint is enabled(locally or globally), the breakpoint's condition, and the breakpoint's size. Along with a few other irrelevent(to this tutorial) variables.
That was the explanation in a slightly complicated form, but for simpler users, just know this :
Don't use two of the same debug registers at a time.
[highlight=cpp]
enum DebugRegisterIndex
{
DbgReg0 = 0,
DbgReg1 = 1,
DbgReg2 = 2,
DbgReg3 = 3,
};
[/highlight]
Class Constants & Definitions
All are pretty self explanatory, if further documentation is needed on them, please post a request for it.
[highlight=cpp]
//BYTE INDEX
#define CHWBP_BYTE_INDEX_DR_BPFLAGS 0
#define CHWBP_BYTE_INDEX_DR_BPTYPE_SIZE 16
//BP Type
const char CHWBP_BP_LOCAL = 0x01;
const char CHWBP_BP_GLOBAL = 0x02;
//BP Break type
const char CHWBP_BP_TYPE_EXECUTION = 0x00;
const char CHWBP_BP_TYPE_WRITE = 0x01;
const char CHWBP_BP_TYPE_RESERVED = 0x02;
const char CHWBP_BP_TYPE_READ_WRITE = 0x03;
//Size of BP
const char CHWBP_BP_SIZE_1B = 0x00;
const char CHWBP_BP_SIZE_2B = 0x01;
const char CHWBP_BP_SIZE_DWORD = 0x02;
const char CHWBP_BP_SIZE_WORD = 0x03;
[/highlight]
Class Structs
Class Public Methods
All are pretty self explanatory, if further documentation is needed on them, please post a request for it.
[highlight=cpp]
//BYTE INDEX
#define CHWBP_BYTE_INDEX_DR_BPFLAGS 0
#define CHWBP_BYTE_INDEX_DR_BPTYPE_SIZE 16
//BP Type
const char CHWBP_BP_LOCAL = 0x01;
const char CHWBP_BP_GLOBAL = 0x02;
//BP Break type
const char CHWBP_BP_TYPE_EXECUTION = 0x00;
const char CHWBP_BP_TYPE_WRITE = 0x01;
const char CHWBP_BP_TYPE_RESERVED = 0x02;
const char CHWBP_BP_TYPE_READ_WRITE = 0x03;
//Size of BP
const char CHWBP_BP_SIZE_1B = 0x00;
const char CHWBP_BP_SIZE_2B = 0x01;
const char CHWBP_BP_SIZE_DWORD = 0x02;
const char CHWBP_BP_SIZE_WORD = 0x03;
[/highlight]
Class Structs
The only struct in this class is used in all the public methods. This struct holds information about the breakpoint. It should not be altered after a breakpoint is set, or before it is restored. The struct is defined like so:
[highlight=cpp]struct Breakpoint
{
unsigned long ulTgtAddress;
char bStolenByte;
HANDLE hThread;
unsigned short bBpClass;
unsigned short bBpType;
unsigned short bDebugRegister;
char bBpSize;
};[/highlight]
ulTargetAddress: Address where the breakpoint will be set.
bStolenByte: This member is not used in hardware breakpoints, however it is used in an INT3 breakpoint. An INT3 breakpoint is a memory breakpoint, and therefore it requires a single byte to represent it's instruction to the processor. However, when you set an INT3 breakpoint, the it will replace the first byte located a the target address with 0xCC(INT3), and store the replaced byte in bStolenByte. When the processor hits this newly written instruction, windows will throw an exception(Read managing the exceptions section) in your program. This exception should be handled by a) restoring the breakpoint, b) pushing EIP back one byte, c) fill in the blank, and then continue execution. This will cause the processor to reprocess the byte, but because you restored the breakpoint, it will be the stolen byte it reprocesses. If you wish, you may reset the breakpoint afterwords.
hThread: Handle to the thread the Breakpoint will be set inside of.
bBpClass: Corresponds to one of the members of the Breakpoin***ass enumerator.
bBpType: Corresponds to one of the members of the BreakpointType enumerator.
bDebugRegister : Corresponds to one of the members of the DebugRegisterIndex enumerator.
bBpSize: Specifies size of the breakpoint. Can be set to one of the following:
[highlight=cpp]
const char CHWBP_BP_SIZE_1B = 0x00;
const char CHWBP_BP_SIZE_2B = 0x01;
const char CHWBP_BP_SIZE_DWORD = 0x02;
const char CHWBP_BP_SIZE_WORD = 0x03;
[/highlight]
[highlight=cpp]struct Breakpoint
{
unsigned long ulTgtAddress;
char bStolenByte;
HANDLE hThread;
unsigned short bBpClass;
unsigned short bBpType;
unsigned short bDebugRegister;
char bBpSize;
};[/highlight]
ulTargetAddress: Address where the breakpoint will be set.
bStolenByte: This member is not used in hardware breakpoints, however it is used in an INT3 breakpoint. An INT3 breakpoint is a memory breakpoint, and therefore it requires a single byte to represent it's instruction to the processor. However, when you set an INT3 breakpoint, the it will replace the first byte located a the target address with 0xCC(INT3), and store the replaced byte in bStolenByte. When the processor hits this newly written instruction, windows will throw an exception(Read managing the exceptions section) in your program. This exception should be handled by a) restoring the breakpoint, b) pushing EIP back one byte, c) fill in the blank, and then continue execution. This will cause the processor to reprocess the byte, but because you restored the breakpoint, it will be the stolen byte it reprocesses. If you wish, you may reset the breakpoint afterwords.
hThread: Handle to the thread the Breakpoint will be set inside of.
bBpClass: Corresponds to one of the members of the Breakpoin***ass enumerator.
bBpType: Corresponds to one of the members of the BreakpointType enumerator.
bDebugRegister : Corresponds to one of the members of the DebugRegisterIndex enumerator.
bBpSize: Specifies size of the breakpoint. Can be set to one of the following:
[highlight=cpp]
const char CHWBP_BP_SIZE_1B = 0x00;
const char CHWBP_BP_SIZE_2B = 0x01;
const char CHWBP_BP_SIZE_DWORD = 0x02;
const char CHWBP_BP_SIZE_WORD = 0x03;
[/highlight]
Class Public Methods
The class has three public methods I will explain here. If you have a hard time understanding a portion here, continue reading, it should be answered, otherwise, post your question in this thread.
[highlight=cpp] static int SetBp(Breakpoint* bpInfo);
static int RestoreBp(Breakpoint* bpInfo);
static int RestoreHwBpContext(Breakpoint* bpInfo, CONTEXT& context_inOut);[/highlight]
SetBp(Breakpoint* bpInfo)
Class Private MethodsHere I will describe the private members of the class. Please note none of these methods are intended to be used directly by the user.
[highlight=cpp] static int FetchDebugIndex(Breakpoint* bpInfo);
static char GetByteTypeById(int id);
static int SetHardwareBreakpoint(Breakpoint* bpInfo);
static int SetINT3Breakpoint(Breakpoint* bpInfo);
static int RestoreHardwareBreakpoint(Breakpoint* bpInfo);
static int RestoreINT3Breakpoint(Breakpoint* bpInfo);[/highlight]FetchDebugIndex(Breakpoint* bpInfo)
[highlight=cpp]/* /-------------------------------------------------\
* |Programmed By : Jetamay/Andrew |
* \-------------------------------------------------/
* Notice: Don't redistribute without giving credit, or use in applications that must
* be payed for, unless permission has been given by me directly.
*
* For information on how to use this class, please read the post on *********.com
*
*
* |===========================
* |Enjoy the rest of the day,|
* |=======
Jetamay/Andrew |==
* |==============
*/
#pragma once
#ifndef PC32BIT
#error You must be using a 32bit PC to use this class. If you are, define PC32BIT before including this header.
#endif
#ifndef _WIN32_WINNT
#error _WIN32_WINNT not defined.
#else
#if _WIN32_WINNT < 0x0500
#error _WIN32_WINNT has been defined by the user, but to an unexpected value. Please assure it's defined above 0x0500
#endif
#endif
#include <windows.h>
//BYTE INDEX
#define CHWBP_BYTE_INDEX_DR_BPFLAGS 0
#define CHWBP_BYTE_INDEX_DR_BPTYPE_SIZE 16
//BP Type
const char CHWBP_BP_LOCAL = 0x01;
const char CHWBP_BP_GLOBAL = 0x02;
//BP Break type
const char CHWBP_BP_TYPE_EXECUTION = 0x00;
const char CHWBP_BP_TYPE_WRITE = 0x01;
const char CHWBP_BP_TYPE_RESERVED = 0x02;
const char CHWBP_BP_TYPE_READ_WRITE = 0x03;
//Size of BP
const char CHWBP_BP_SIZE_1B = 0x00;
const char CHWBP_BP_SIZE_2B = 0x01;
const char CHWBP_BP_SIZE_DWORD = 0x02;
const char CHWBP_BP_SIZE_WORD = 0x03;
enum BreakPointType
{
BpType_Execution = 0,
BpType_Write = 1,
BpType_Read_Write = 2,
BpType_Reserved = 3,
};
enum Breakpoin***ass
{
HardwareBreakpoint = 1,
INT3Breakpoint = 2,
};
enum DebugRegisterIndex
{
DbgReg0 = 0,
DbgReg1 = 1,
DbgReg2 = 2,
DbgReg3 = 3,
};
struct Breakpoint
{
unsigned long ulTgtAddress;
char bStolenByte;
HANDLE hThread;
unsigned short bBpClass;
unsigned short bBpType;
unsigned short bDebugRegister;
char bBpSize;
};
class cBreakpoint
{
private:
static int FetchDebugIndex(Breakpoint* bpInfo);
static char GetByteTypeById(int id);
static int SetHardwareBreakpoint(Breakpoint* bpInfo);
static int SetINT3Breakpoint(Breakpoint* bpInfo);
static int RestoreHardwareBreakpoint(Breakpoint* bpInfo);
static int RestoreINT3Breakpoint(Breakpoint* bpInfo);
public:
static int SetBp(Breakpoint* bpInfo);
static int RestoreBp(Breakpoint* bpInfo);
static int RestoreHwBpContext(Breakpoint* bpInfo, CONTEXT& context_inOut);
};[/highlight]
[highlight=cpp] static int SetBp(Breakpoint* bpInfo);
static int RestoreBp(Breakpoint* bpInfo);
static int RestoreHwBpContext(Breakpoint* bpInfo, CONTEXT& context_inOut);[/highlight]
SetBp(Breakpoint* bpInfo)
-The first parameter of this method takes a pointer to a Breakpoint structure, which was descriped in a the Class Structs segmet of this tutorial. Required members for the breakpoint class must be filled, excluding bStolenByte. hThread can be set to 0(the current thread) or otherwise to sepcifie a different thread. This method decides if it should call SetHardwareBreakpoint or SetINT3Breakpoint Return 1 = success, -1 = Fail.
RestoreBp(Breakpoint* bpInfo)-The first parameter of this method takes a pointer to a Breakpoint structure, which was descriped in a the Class Structs segmet of this tutorial. This will, in the case of a hwbp, remove the bp from the debug registers. In the case of an INT3 bp, it will restore the stolen byte. Return 1 = success, -1 = Fail.
RestoreHwBpContext(Breakpoint* bpInfo, CONTEXT& context_inOut)-The first parameter of this method takes a pointer to a Breakpoint structure, which was descriped in a the Class Structs segmet of this tutorial. The second is a context struct. RestoreHwBpContext will modify the param passed in through context_inOut param, removing the hardware breakpoint from the passed in context struct. This is helpful when removing HWBPs in a Exception handler. More explanation is in the Managing Exceptions segment of this tutorial.
Return 1 = success, -1 = Fail.
Return 1 = success, -1 = Fail.
Class Private Methods
[highlight=cpp] static int FetchDebugIndex(Breakpoint* bpInfo);
static char GetByteTypeById(int id);
static int SetHardwareBreakpoint(Breakpoint* bpInfo);
static int SetINT3Breakpoint(Breakpoint* bpInfo);
static int RestoreHardwareBreakpoint(Breakpoint* bpInfo);
static int RestoreINT3Breakpoint(Breakpoint* bpInfo);[/highlight]FetchDebugIndex(Breakpoint* bpInfo)
-Returns which debug register is being used by the passed in Breakpoint struct. If it returns -1, it means the index exceeded 4, was below 0, or the passed struct is not a hardware breakpoint. Otherwise it will return 1.
char GetByteTypeById(int id)-The first param can be either of the units in the BreakPointType enumerator. It will return the corresponding byte-code for them.
SetHardwareBreakpoint(Breakpoint* bpInfo)-Sets a Hardware breakpoint corresponding with the passed in information in param 1. This should not be called directly, look at the public member SetBp. Return 1 = success, -1 = Fail.
SetINT3Breakpoint(Breakpoint* bpInfo)-Sets a memory breakpoint corresponding with the passed in information in param 1, and stores the byte it replaces to place an INT3 bp. This should not be called directly, look at the public member SetBp. Return 1 = success, -1 = Fail.
RestoreHardwareBreakpoint(Breakpoint* bpInfo)-The first parameter of this method takes a pointer to a Breakpoint structure, which was descriped in a the Class Structs segmet of this tutorial. RestoreHwBpContext will modify the CONTEXT struct for the thread bpInfo is assigned to, removing the hardware breakpoint. This should not be called directly, look at the public member RestoreBp. Return 1 = success, -1 = Fail.
RestoreINT3Breakpoint(Breakpoint* bpInfo)-It replaces the byte at ulTgtAddress with the byte it has stolen when it was set(the byte stored in bStolenByte member of the Breakpoint struct). This should not be called directly, look at the public member RestoreBp. Return 1 = success, -1 = Fail.
Some characters may be hidden or removed by php tags. Reffer to actual copy of source provided in download for use.[highlight=cpp]/* /-------------------------------------------------\
* |Programmed By : Jetamay/Andrew |
* \-------------------------------------------------/
* Notice: Don't redistribute without giving credit, or use in applications that must
* be payed for, unless permission has been given by me directly.
*
* For information on how to use this class, please read the post on *********.com
*
*
* |===========================
* |Enjoy the rest of the day,|
* |=======
Jetamay/Andrew |==* |==============
*/
#pragma once
#ifndef PC32BIT
#error You must be using a 32bit PC to use this class. If you are, define PC32BIT before including this header.
#endif
#ifndef _WIN32_WINNT
#error _WIN32_WINNT not defined.
#else
#if _WIN32_WINNT < 0x0500
#error _WIN32_WINNT has been defined by the user, but to an unexpected value. Please assure it's defined above 0x0500
#endif
#endif
#include <windows.h>
//BYTE INDEX
#define CHWBP_BYTE_INDEX_DR_BPFLAGS 0
#define CHWBP_BYTE_INDEX_DR_BPTYPE_SIZE 16
//BP Type
const char CHWBP_BP_LOCAL = 0x01;
const char CHWBP_BP_GLOBAL = 0x02;
//BP Break type
const char CHWBP_BP_TYPE_EXECUTION = 0x00;
const char CHWBP_BP_TYPE_WRITE = 0x01;
const char CHWBP_BP_TYPE_RESERVED = 0x02;
const char CHWBP_BP_TYPE_READ_WRITE = 0x03;
//Size of BP
const char CHWBP_BP_SIZE_1B = 0x00;
const char CHWBP_BP_SIZE_2B = 0x01;
const char CHWBP_BP_SIZE_DWORD = 0x02;
const char CHWBP_BP_SIZE_WORD = 0x03;
enum BreakPointType
{
BpType_Execution = 0,
BpType_Write = 1,
BpType_Read_Write = 2,
BpType_Reserved = 3,
};
enum Breakpoin***ass
{
HardwareBreakpoint = 1,
INT3Breakpoint = 2,
};
enum DebugRegisterIndex
{
DbgReg0 = 0,
DbgReg1 = 1,
DbgReg2 = 2,
DbgReg3 = 3,
};
struct Breakpoint
{
unsigned long ulTgtAddress;
char bStolenByte;
HANDLE hThread;
unsigned short bBpClass;
unsigned short bBpType;
unsigned short bDebugRegister;
char bBpSize;
};
class cBreakpoint
{
private:
static int FetchDebugIndex(Breakpoint* bpInfo);
static char GetByteTypeById(int id);
static int SetHardwareBreakpoint(Breakpoint* bpInfo);
static int SetINT3Breakpoint(Breakpoint* bpInfo);
static int RestoreHardwareBreakpoint(Breakpoint* bpInfo);
static int RestoreINT3Breakpoint(Breakpoint* bpInfo);
public:
static int SetBp(Breakpoint* bpInfo);
static int RestoreBp(Breakpoint* bpInfo);
static int RestoreHwBpContext(Breakpoint* bpInfo, CONTEXT& context_inOut);
};[/highlight]
Managing Exceptions
When a breakpoint is hit, an exception is throw, if this exception is not handled, your program will crash with an 'unhandled exception error'. There are various methods to implement an exception handler, for this tutorial I have chosen to use Vectored Exception Handlers. A vectored exception handler is a method that is called upon when an exception occurs, as long as the one before it has passed the exception. The way Vectored Exception Handling works, is like so(pesudo code)
[highlight=cpp]void ExceptionHandler(ExceptionInfo)
{
if(ExceptionInfo->ExceptionErrorCode == Exception_DevisionByZero)
{
MessageBox "I JUST HANDLED THE EXCEPTION"
ManageDevisionByZeroException();
return Excpetion_resume_exectution;
} else {
return Exception_pass_to_next_exception_handler;
}
}
void main
{
PushExceptionHandler(topOfVector, ExceptionHandler);
int i = 0 \ 0;
return;
}
[/highlight]When a devision by 0 occurs, ExceptionHandler will be called, if it can solve the problem, it will continue exection of the thread which threw the exception, otherwise, it will pass it to the exception handler after it. If there is no exception handler after it, you program crashes with an unhandled exception error. I assume you already have a fairly solid understanding of vectored exception handlers(as it was one of the prerequests) so I won't go into much detail.
When an breakpoint is hit, one of the following exceptions will be thrown : EXCEPTION_SINGLE_STEP or EXCEPTION_BREAKPOINT.
Also note, when you're disabling a hardware breakpoint in a exception handler, modify the passed ExceptionInfo->ContextRecord using cBreakpoint::RestoreHwBpContext to remove it, never call cBreakpoint::RestoreBp in an exception handler, because the exception handler will just reset the thread's context to ExceptionInfo->ContextRecord, when it has completed. As cBreakpoint::RestoreBp uses SetThreadContext.
Additional Notes:
Be 100% sure you read the notes above before using this class. Also, I haven't had time go over and fix grammar mistakes I may have made in this thread.
I'm no good at writing understandable or clear tutorials, so forgive me if this one is a bit hard to follow.
When a breakpoint is hit, an exception is throw, if this exception is not handled, your program will crash with an 'unhandled exception error'. There are various methods to implement an exception handler, for this tutorial I have chosen to use Vectored Exception Handlers. A vectored exception handler is a method that is called upon when an exception occurs, as long as the one before it has passed the exception. The way Vectored Exception Handling works, is like so(pesudo code)
[highlight=cpp]void ExceptionHandler(ExceptionInfo)
{
if(ExceptionInfo->ExceptionErrorCode == Exception_DevisionByZero)
{
MessageBox "I JUST HANDLED THE EXCEPTION"
ManageDevisionByZeroException();
return Excpetion_resume_exectution;
} else {
return Exception_pass_to_next_exception_handler;
}
}
void main
{
PushExceptionHandler(topOfVector, ExceptionHandler);
int i = 0 \ 0;
return;
}
[/highlight]When a devision by 0 occurs, ExceptionHandler will be called, if it can solve the problem, it will continue exection of the thread which threw the exception, otherwise, it will pass it to the exception handler after it. If there is no exception handler after it, you program crashes with an unhandled exception error. I assume you already have a fairly solid understanding of vectored exception handlers(as it was one of the prerequests) so I won't go into much detail.
When an breakpoint is hit, one of the following exceptions will be thrown : EXCEPTION_SINGLE_STEP or EXCEPTION_BREAKPOINT.
Also note, when you're disabling a hardware breakpoint in a exception handler, modify the passed ExceptionInfo->ContextRecord using cBreakpoint::RestoreHwBpContext to remove it, never call cBreakpoint::RestoreBp in an exception handler, because the exception handler will just reset the thread's context to ExceptionInfo->ContextRecord, when it has completed. As cBreakpoint::RestoreBp uses SetThreadContext.
Source Code
Look at attachments
Look at attachments
Additional Notes:
Be 100% sure you read the notes above before using this class. Also, I haven't had time go over and fix grammar mistakes I may have made in this thread.
I'm no good at writing understandable or clear tutorials, so forgive me if this one is a bit hard to follow.
Source Code.rar
Baba gewd buddie
2buseful
2buseful
Thanks for this.
This is awesome!
But now my head hurts (ow)
baba
But now my head hurts (ow)
baba
it seems very interesting and well done, I was just taking a look to how to code breakpoints by myself in these days... I think I'll give a look and try to your code 
thanks
edit: there is something not working as expected, in the log I see only "Exception..."
It seems that the log function itself is rising an exception the call again the log function that rise an exception and goon in loop
thanks
edit: there is something not working as expected, in the log I see only "Exception..."
It seems that the log function itself is rising an exception the call again the log function that rise an exception and goon in loop
This thread is closed for replies.