How do debuger set break point make control of program's stopping and running?

Started by
2 comments, last by Extrarius 18 years, 1 month ago
Like the title. THANKS!
Advertisement
In the Intel architecture, you can specify breakpoints as addresses (of instructions) using debug registers. When the processor reaches the instruction in question, it generates a debug exception (an interrupt), which is then intercepted by the OS, which can forward it to the debugger.

BTW, how to make a program execute at privilege level 0?

THANKS!
Quote:Original post by was2_0
BTW, how to make a program execute at privilege level 0?

THANKS!
You pretty much need the Driver Development Kit for that. You can technically do it without the DDK, but you'd be relying on hacks that could break any minute, and that's not good for stability if you know what I mean.
I beleive the free CD (only charge is shipping) version would be enough for basic ring-0 code.

If you're trying to actually debug something, you really should use a tool like OllyDbg(free) or IDA Pro(costly, but there is both a demo{time limit to each session, no saving} and freeware version{disassembly only, no debugging, older version}).
If you really need a kernel debugger, there are some utilities that come with the driver development kit, windows debugging tools, and several other downloads/cds straight from microsoft that can be helpful.
There is also the strongarm called SoftICE, but it's very expensive to get and is overkill unless you _really_ need priveleged debugging.

If you just want to learn the basics of making a debugger, you could always use one on another (I'd suggest not trying to reverse a high-end one like IDA or SoftICE using a debugger, but maybe OllyDBG would be reasonable)
"Walk not the trodden path, for it has borne it's burden." -John, Flying Monk

This topic is closed to new replies.

Advertisement