A breakpoint is a debugger feature that allows you to interrupt program execution at a very specific location within a program. Breakpoints can be used to pause the execution at a particular instruction, or when the program calls a function/API function, or when the program reads, writes, or executes from a memory address. You can set multiple breakpoints all over a program, and execution will be interrupted upon reaching any of the breakpoints. Once a breakpoint has been reached, it is possible to monitor/modify various aspects of the process. Debuggers typically allow you to set different types of breakpoints:
- Software Breakpoints: By default, debuggers make use of software breakpoints. Software breakpoints are implemented by replacing the instruction at a breakpoint address with a software breakpoint instruction, such as the int 3 instruction (having an opcode of 0xCC). When a software breakpoint instruction (such as int 3) is executed, the control is transferred to the debugger, which is debugging the interrupted process. The advantage of using software breakpoints is that you can set an unlimited number of breakpoints. The disadvantage is that malware can look for the breakpoint instruction (int 3) and modify it to change the normal operation of an attached debugger.
- Hardware Breakpoints: CPU, such as x86, supports hardware breakpoints through the use of the CPU's debug registers, DR0 - DR7. You can set a maximum of four hardware breakpoints using DR0-DR3; the other remaining debug registers are used to specify additional conditions on each breakpoint. In the case of hardware breakpoints, no instruction is replaced, but the CPU decides whether the program should be interrupted, based on the values contained within the debug registers.
- Memory Breakpoints: These breakpoints allow you to pause the execution when an instruction accesses (reads from or writes to) the memory, rather than the execution. This is useful if you want to know when a particular memory is accessed (read or write), and to know which instruction accesses it. For example, if you find an interesting string or data in the memory, you can set a memory breakpoint on that address to determine under what circumstances the memory is accessed.
- Conditional Breakpoints: Using conditional breakpoints, you can specify the condition that must be satisfied to trigger the breakpoint. If a conditional breakpoint is reached but the condition is not satisfied, the debugger automatically resumes the execution of the program. Conditional breakpoints are not an instruction feature or a CPU feature; they are a feature offered by the debugger. You can therefore specify conditions for both software and hardware breakpoints. When the conditional breakpoint is set, it is the debugger's responsibility to evaluate the conditional expression and determine whether the program needs to be interrupted or not.