Scribd
Upload
52 views

Chapter 8 Debugging

Debuggers are tools used to examine the execution of programs. Source-level debuggers allow debugging during coding by mapping machine execution to source code lines and setting breakpoints. Assembly-level debuggers operate at the machine instruction level and are used for malware analysis. Types of debuggers include user mode and kernel mode debuggers. Debuggers can single step through code, set breakpoints to examine execution at critical points, and use hardware and conditional breakpoints. Debuggers also handle program exceptions.

Uploaded by

Jayesh Shinde
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
52 views

Chapter 8 Debugging

Debuggers are tools used to examine the execution of programs. Source-level debuggers allow debugging during coding by mapping machine execution to source code lines and setting breakpoints. Assembly-level debuggers operate at the machine instruction level and are used for malware analysis. Types of debuggers include user mode and kernel mode debuggers. Debuggers can single step through code, set breakpoints to examine execution at critical points, and use hardware and conditional breakpoints. Debuggers also handle program exceptions.

Uploaded by

Jayesh Shinde
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 8

Debugging

Chapter 8 Debugging
Debuggers
 Hardware or software used to examine execution of another
program
Disassembler: static snapshot of what code looks like before execution
Debugger: dynamic snapshot of what code does during execution
Source-Level (built-in most IDE)
 Debug while coding
 Map machine execution to corresponding source code lines
 Allow setting of breakpoints at source-code lines
Assembly-level
Strictly operate at machine instruction level
Main debugger used for malware (no need to access to source code)
Types of Debuggers
 User mode
 Debug one program via another program all in user space
 Examples: OllyDbg, gdb
 Kernel mode
Debugging a kernel requires a second machine
Must configure target OS to allow kernel debugging
 Examples: WinDbg
Using a Debugger
 Single stepping
One machine instruction or source line at a time (slow)
Stepping-over: bypass call instructions (F8)
Stepping-into: in the call function (starting from the first
instruction) (F7)
Stepping-out: run until return back to calling function (finish)
Breakpoints
 Breakpoints (software)
 Needed because registers/memory addr are changing
 Allows one to examine the state of the machine at critical
execution points
 File creation – set breakpoint to CreateFileW and look at the value on
stack to get filename
 Encryption – set breakpoint at encryption to see data before encrypted
 Implemented by overwriting INT 3 (0xcc) into opcode of
instruction
 When 0xcc is executed, OS generates an exception and transfer
control to debugger
 Debugger restores overwritten byte upon continue
Hardware Breakpoints
 Hardware execution breakpoints (faster)
 Dedicated registers that store virtual addresses
 Can be set to break on access – break when a memory location
is encountered (halt on non-execution memory address)
 Only 4 hardware registers (DR0-DR3) – x86
 4 active hardware breakpoints at once.
 Can be modified by running program (malware)!
 Malware can disable them
 Counter-measure is “General Detect” flag in DR7 (debug control) that
triggers a breakpoint prior to any mov involving debug registers
 Detect when the debug register is changed
Conditional Breakpoints
 Conditional software execution breakpoints
Break only if a certain condition is met
Example
 Break on GetProcAddress function only if address parameter is
RegSetValue
 Implemented as normal software breakpoint, but debugger checks
condition and automatically continues if not met
 Program slow down -> examine whether condition is met
Exceptions
 Exceptions pass control to debugger
 Division by 0, invalid memory access, INT 3
(0xcc/breakpoint),
 Might interfere with exception handlers that program needs to run

First-chance and second-chance exceptions


 Debugger (if attached) gets first-chance control – see if in
debugger when exception occurs –almost dead
 If debugger does not want it, program allowed to handle
exception
 If program does not handle exception and would crash, debugger
gets a second-chance to handle exception – already dead
 Malware may intentionally trigger first-chance exceptions to
determine environment

You might also like