Force software breakpoint on read-only memory

Force software breakpoint on read-only memory

[Mathieu Tarral]

Hi,

I'm trying to set a software breakpoint on a read-only memory page.
GDB automatically sets the breakpoint as hardware, but I would like to
keep using software breakpoints.

I found the `set breakpoint auto-hw off option in` in the
documentation:
"If the target provides a memory map, GDB will warn when
trying to set software breakpoint at a read-only address."

However, even when I set it, GDB gives me a warning and my command is aborted:

$ gdb -x gdbinit ~/tmp/ntoskrnl.exe
0x80545c9f in ?? ()
(gdb) set breakpoint auto-hw off
(gdb) b NtOpenFile
Breakpoint 1 at 0x4a30b1
(gdb) continue
Continuing.
Warning:
Cannot insert breakpoint 1.
Cannot set software breakpoint at read-only address 0x4a30b1

Command aborted.
(gdb)



My stub interacts directly with the guest hardware, from the
hypervisor, so I can bypass the read-only protections.
That's why i wanted to force the software breakpoint
and ignore the memory map.

Is this a bug in GDB ?

Thanks !
--
Mathieu Tarral

Sent with ProtonMail Secure Email.

Re: Force software breakpoint on read-only memory

[Andrew Burgess]

* Mathieu Tarral <mathieu.tarral@protonmail.com> [2018-11-21 09:40:15 +0000]:

> Hi,
> 
> I'm trying to set a software breakpoint on a read-only memory page.
> GDB automatically sets the breakpoint as hardware, but I would like to
> keep using software breakpoints.
> 
> I found the `set breakpoint auto-hw off option in` in the
> documentation:
> "If the target provides a memory map, GDB will warn when
> trying to set software breakpoint at a read-only address."
> 
> However, even when I set it, GDB gives me a warning and my command is aborted:
> 
> $ gdb -x gdbinit ~/tmp/ntoskrnl.exe
> 0x80545c9f in ?? ()
> (gdb) set breakpoint auto-hw off
> (gdb) b NtOpenFile
> Breakpoint 1 at 0x4a30b1
> (gdb) continue
> Continuing.
> Warning:
> Cannot insert breakpoint 1.
> Cannot set software breakpoint at read-only address 0x4a30b1
> 
> Command aborted.
> (gdb)
> 
> 
> 
> My stub interacts directly with the guest hardware, from the
> hypervisor, so I can bypass the read-only protections.
> That's why i wanted to force the software breakpoint
> and ignore the memory map.
> 
> Is this a bug in GDB ?

Not in the sense that this is the designed behaviour.  Once GDB has a
memory map it assumes this is accurate.  When it spots you trying to
place a breakpoint in read-only memory if checks the 'auto-hw'
setting.  If this is on then it converts to a h/w breakpoint,
otherwise, it fails, after all you can't write to read-only memory.

The place to look in the GDB source is gdb/breakpoint.c:insert_bp_location.

My question would be, do you allow _all_ writes to read-only memory,
or only breakpoint writes?  If it's all, then could you "fix" the
memory map?

If you only want to allow s/w breakpoint writes then you'll need to
hack GDB, possibly adding a switch to ignore memory maps for s/w
breakpoints.

Thanks,
Andrew


> 
> Thanks !
> --
> Mathieu Tarral
> 
> Sent with ProtonMail Secure Email.