#advanced
Introduction to Breakpoints
A more efficient and practical way to analyse the program is to do so while it runs. And the best way to do this is using breakpoints.
A breakpoint specifies where the program should stop executing. This is useful as it allows us to look at the state of the program at that particular point.
[Step-6] Setting breakpoints
Now let’s set a breakpoint using the command
db address
In this case, we want to set breakpoint at mov dword [local_ch], 4 and the memory address corresponding to this instruction is 0x00400b55
db 0x00400b55
Now that we’ve set a breakpoint, let’s run the program using
dc
Running dc will execute the program until we hit the breakpoint.
Queries & suggestions @Revnexbot
Introduction to Breakpoints
A more efficient and practical way to analyse the program is to do so while it runs. And the best way to do this is using breakpoints.
A breakpoint specifies where the program should stop executing. This is useful as it allows us to look at the state of the program at that particular point.
[Step-6] Setting breakpoints
Now let’s set a breakpoint using the command
db address
In this case, we want to set breakpoint at mov dword [local_ch], 4 and the memory address corresponding to this instruction is 0x00400b55
db 0x00400b55
Now that we’ve set a breakpoint, let’s run the program using
dc
Running dc will execute the program until we hit the breakpoint.
Queries & suggestions @Revnexbot
#advanced
Instruction pointers & the little b
Command - pdf
Once we hit the breakpoint, we can use this command instead of pdf @main to directly print out the main function.
The rip (see box-1) which is the current instruction shows where execution has stopped. The little b marked as box-2 represents the breakpoint.
We know that the mov instruction is used to transfer values. The statement (box-3) is transferring the value 4 into the variable (local_ch). Note that currently the instruction pointer (rip) is just above the memory address we specified i.e. the code box-3 haven't executed and the value of the variable should be empty
Queries & suggestions @Revnexbot
Instruction pointers & the little b
Command - pdf
Once we hit the breakpoint, we can use this command instead of pdf @main to directly print out the main function.
The rip (see box-1) which is the current instruction shows where execution has stopped. The little b marked as box-2 represents the breakpoint.
We know that the mov instruction is used to transfer values. The statement (box-3) is transferring the value 4 into the variable (local_ch). Note that currently the instruction pointer (rip) is just above the memory address we specified i.e. the code box-3 haven't executed and the value of the variable should be empty
Queries & suggestions @Revnexbot
#advanced
[Step-7] Printing contents of a variable
To view the contents of the variable (local_ch), we use the following instruction
px @memory-address
In this case, the corresponding memory address for local_ch will be rbp-0xc (from the first few lines of @pdf main)
This instruction prints the values of memory in hex
px @rbp-0xc
This shows that the variable currently doesn’t have anything stored in it - it’s just 0000 (row 1 - column 0).
Queries & suggestions @Revnexbot
[Step-7] Printing contents of a variable
To view the contents of the variable (local_ch), we use the following instruction
px @memory-address
In this case, the corresponding memory address for local_ch will be rbp-0xc (from the first few lines of @pdf main)
This instruction prints the values of memory in hex
px @rbp-0xc
This shows that the variable currently doesn’t have anything stored in it - it’s just 0000 (row 1 - column 0).
Queries & suggestions @Revnexbot
#advanced
[Step-8] ds - step to next instruction
Let’s execute this instruction (i.e. mov dword [local_ch], 4) and go to the next one using the following command (which only goes to the next instruction)
ds
If we view the memory location after running this command, we get the above (screenshot) output
We can see that the first 2 bytes (row 1 - column 0) have the value 4.
Queries & suggestions @Revnexbot
[Step-8] ds - step to next instruction
Let’s execute this instruction (i.e. mov dword [local_ch], 4) and go to the next one using the following command (which only goes to the next instruction)
ds
If we view the memory location after running this command, we get the above (screenshot) output
We can see that the first 2 bytes (row 1 - column 0) have the value 4.
Queries & suggestions @Revnexbot
Product Name:AceThinker Screen Grabber Pro(Yearly Subscription)
License Code:696B8-7A61Q-O12GD-8F2B5
Product Name:AceThinker Video Master
License Code:8B1E1-A8815-PA0GD-D3575
Product Name:AceThinker iPhone Screen Recorder
License Code:846E3-19F17-M02GD-1F6D4
Product Name:AceThinker PDF Writer(Yearly Subscription)
License Code:8D29B-3041P-PCFGD-238D9
Product Name:AceThinker Audio Recorder Online
License Code:59861-6941J-P72GD-A99C4
Product Name:AceThinker Screen Recorder Online
License Code:6DC53-45914-PDEGD-48F41
Product Name:AceThinker Video Converter Online(Yearly Subscription)
License Code:78CD9-5FC16-NA1GD-8E946
Product Name:AceThinker Music Recorder
License Code:9889C-D3D1I-O34GD-072D6
Product Name:AceThinker Video Keeper(Yearly Subscription)
License Code:86CE0-EB31F-M50GD-0D6F6
Product Name:AceThinker Screen Grabber Pro (Mac)
License Code:EA954-C881Q-P33GD-9CE28
Product Name:AceThinker Mac iPhone Screen Recorder
License Code:3E7B1-AF31N-N63GD-7858A
Product Name:AceThinker Disk Recovery(Yearly Subscription)
License Code:08C1A-F8C1F-QFFGD-F3E44
Product Name:AceThinker Rec
License Code:36904-CD21Q-M05GD-F9011
Product Name:AceThinker Video Editor(Yearly Subscription)
License Code:5B598-8EC1G-QC8GD-835B6
Product Name:AceThinker PDF Writer Mac
License Code:A4CCC-CFC1O-N1DGD-6A515
Product Name:AceThinker PDF Converter Pro(Yearly Subscription)
License Code:F0D7E-5BB1J-OC2GD-10C39
Product Name:AceThinker PDF Converter Pro Mac
License Code:2F7C1-9C91Q-P2BGD-B3542
Product Name:AceThinker iOS Recovery
License Code:96C1A-F6D1M-RA8GD-941A4
Product Name:AceThinker iOS Recovery
License Code:0B0EE-19817-R98GD-D2C45
Product Name:AceThinker Disk Recovery(Yearly Subscription)
License Code:E87E3-2161I-O2AGD-E0279
Product Name:AceThinker PDF Converter Lite
License Code:B8EB2-1561G-R82GD-6789D
Product Name:AceThinker PDF Writer
License Code:962CF-9271K-NF5GD-96CB8
Product Name:AceThinker Watermark Eraser(Yearly Subscription)
License Code:12279-5B51K-OC5GD-0468C
Product Name:AceThinker Mirror(Yearly Subscription)
License Code:9BA76-F9B15-R48GD-DBF4D
Product Name:AceThinker iOS Unlock(Yearly Subscription)
License Code:C2193-23F1P-QF1GD-66E2F
Product Name:AceThinker Video Editor Pro
License Code:5F97D-6531O-R0DGD-A43EB
Product Name:AceThinker Video Editor
License Code:1E4D7-1F014-M65GD-9C8F2
Send screenshots @Revnexbot
License Code:696B8-7A61Q-O12GD-8F2B5
Product Name:AceThinker Video Master
License Code:8B1E1-A8815-PA0GD-D3575
Product Name:AceThinker iPhone Screen Recorder
License Code:846E3-19F17-M02GD-1F6D4
Product Name:AceThinker PDF Writer(Yearly Subscription)
License Code:8D29B-3041P-PCFGD-238D9
Product Name:AceThinker Audio Recorder Online
License Code:59861-6941J-P72GD-A99C4
Product Name:AceThinker Screen Recorder Online
License Code:6DC53-45914-PDEGD-48F41
Product Name:AceThinker Video Converter Online(Yearly Subscription)
License Code:78CD9-5FC16-NA1GD-8E946
Product Name:AceThinker Music Recorder
License Code:9889C-D3D1I-O34GD-072D6
Product Name:AceThinker Video Keeper(Yearly Subscription)
License Code:86CE0-EB31F-M50GD-0D6F6
Product Name:AceThinker Screen Grabber Pro (Mac)
License Code:EA954-C881Q-P33GD-9CE28
Product Name:AceThinker Mac iPhone Screen Recorder
License Code:3E7B1-AF31N-N63GD-7858A
Product Name:AceThinker Disk Recovery(Yearly Subscription)
License Code:08C1A-F8C1F-QFFGD-F3E44
Product Name:AceThinker Rec
License Code:36904-CD21Q-M05GD-F9011
Product Name:AceThinker Video Editor(Yearly Subscription)
License Code:5B598-8EC1G-QC8GD-835B6
Product Name:AceThinker PDF Writer Mac
License Code:A4CCC-CFC1O-N1DGD-6A515
Product Name:AceThinker PDF Converter Pro(Yearly Subscription)
License Code:F0D7E-5BB1J-OC2GD-10C39
Product Name:AceThinker PDF Converter Pro Mac
License Code:2F7C1-9C91Q-P2BGD-B3542
Product Name:AceThinker iOS Recovery
License Code:96C1A-F6D1M-RA8GD-941A4
Product Name:AceThinker iOS Recovery
License Code:0B0EE-19817-R98GD-D2C45
Product Name:AceThinker Disk Recovery(Yearly Subscription)
License Code:E87E3-2161I-O2AGD-E0279
Product Name:AceThinker PDF Converter Lite
License Code:B8EB2-1561G-R82GD-6789D
Product Name:AceThinker PDF Writer
License Code:962CF-9271K-NF5GD-96CB8
Product Name:AceThinker Watermark Eraser(Yearly Subscription)
License Code:12279-5B51K-OC5GD-0468C
Product Name:AceThinker Mirror(Yearly Subscription)
License Code:9BA76-F9B15-R48GD-DBF4D
Product Name:AceThinker iOS Unlock(Yearly Subscription)
License Code:C2193-23F1P-QF1GD-66E2F
Product Name:AceThinker Video Editor Pro
License Code:5F97D-6531O-R0DGD-A43EB
Product Name:AceThinker Video Editor
License Code:1E4D7-1F014-M65GD-9C8F2
Send screenshots @Revnexbot
Apowersoft spoofer v1.3 (Update)
👉🏻 Link ~ @ApowersoftBot
~ Get license keys to all apowersoft products FREE
Send screenshots @Revnexbot
👉🏻 Link ~ @ApowersoftBot
~ Get license keys to all apowersoft products FREE
Send screenshots @Revnexbot
#advanced
[Step-9] Step to next instruction ~ mov dword [local_8h], 5
In this step, we're doing two things - (a) ds - command to step to next instruction (b) px @rbp-0x8 - command to view contents of variable (local_8h)
Remember rip, the instruction pointer?
Instruction pointer register (rip) points to the next instruction to execute. In previous screenshot (click), the rip is at instruction mov dword [local_ch], 4
This means when we use command "ds", instruction mov dword [local_ch], 4 should be executed
However, we have already executed command "ds" once in Step-8 (here)
... (continued)
Queries & suggestions @Revnexbot
[Step-9] Step to next instruction ~ mov dword [local_8h], 5
In this step, we're doing two things - (a) ds - command to step to next instruction (b) px @rbp-0x8 - command to view contents of variable (local_8h)
Remember rip, the instruction pointer?
Instruction pointer register (rip) points to the next instruction to execute. In previous screenshot (click), the rip is at instruction mov dword [local_ch], 4
This means when we use command "ds", instruction mov dword [local_ch], 4 should be executed
However, we have already executed command "ds" once in Step-8 (here)
... (continued)
Queries & suggestions @Revnexbot
#advanced
[Step-9] ds and px @rbp-0x8 explained
... continued from here
Hence our command "ds" in Step-9 (see screenshot) actually excutes instruction next to mov dword [local_ch], 4 which is mov dword [local_8h], 5 as seen from screenshot (box-3)
When mov dword [local_8h], 5 gets executed using "ds", the constant "5" is stored in variable "local_8h"
Let's examine the variable local_8h now using px @rbp-0x8 ~ screenshot (box-2)
Note: We're using @rbp-0x8 with "px" (alias for print hexadecimal) because rbp-0x8 is actual memory location of variable local_8h
We can confirm value of "local_8h" is indeed "5" see screenshot (box-3)
Queries & suggestions @Revnexbot
[Step-9] ds and px @rbp-0x8 explained
... continued from here
Hence our command "ds" in Step-9 (see screenshot) actually excutes instruction next to mov dword [local_ch], 4 which is mov dword [local_8h], 5 as seen from screenshot (box-3)
When mov dword [local_8h], 5 gets executed using "ds", the constant "5" is stored in variable "local_8h"
Let's examine the variable local_8h now using px @rbp-0x8 ~ screenshot (box-2)
Note: We're using @rbp-0x8 with "px" (alias for print hexadecimal) because rbp-0x8 is actual memory location of variable local_8h
We can confirm value of "local_8h" is indeed "5" see screenshot (box-3)
Queries & suggestions @Revnexbot
#advanced
[Step-10] pdf once again
Let's print the disassembly function using command "pdf"
Box-2 shows where our instruction pointer (rip) currently is i.e. just after mov dword [local_8h], 5 (box-3) - the instruction that we've executed in last step using "ds"
What if we run "ds" again?
Let's see
Queries & suggestions @Revnexbot
[Step-10] pdf once again
Let's print the disassembly function using command "pdf"
Box-2 shows where our instruction pointer (rip) currently is i.e. just after mov dword [local_8h], 5 (box-3) - the instruction that we've executed in last step using "ds"
What if we run "ds" again?
Let's see
Queries & suggestions @Revnexbot
#advanced
[Step-11] dr[?]
Command "dr" is used to print 'gpr' (general purpose) registers
We can also print value of a specific register using dr <register>
In above screenshot, we run "ds" (box-1) again and it executes next instruction mov edx, dword [local_ch] (box-3)
What does "mov edx, dword [local_ch]" do?
Value of variable local_ch is moved to edx register
We know from here (click) local_ch is "4" and hence after "ds" is executed edx becomes "4" as well
After running next command "dr", we can see ¹rdx is indeed "4" (0x00000004) ~ see above screenshot
¹Note: edx is the low 32 bit of the rdx register, which is a 64 bit register
Queries & suggestions @Revnexbot
[Step-11] dr[?]
Command "dr" is used to print 'gpr' (general purpose) registers
We can also print value of a specific register using dr <register>
In above screenshot, we run "ds" (box-1) again and it executes next instruction mov edx, dword [local_ch] (box-3)
What does "mov edx, dword [local_ch]" do?
Value of variable local_ch is moved to edx register
We know from here (click) local_ch is "4" and hence after "ds" is executed edx becomes "4" as well
After running next command "dr", we can see ¹rdx is indeed "4" (0x00000004) ~ see above screenshot
¹Note: edx is the low 32 bit of the rdx register, which is a 64 bit register
Queries & suggestions @Revnexbot