State-of-the-art binary code analysis tools
 Action    name: BreakpointEdit
This command opens a dialog box to edit an existing breakpoint.


  The breakpoint location: either an absolute address, a symbol name,
  a module+offset combination, or a source file name and a line number.
  The exact location syntax depends on the breakpoint kind: absolute, module
  relative, symbolic, or source code.
  This IDC expression will be evaluated each time the breakpoint
  is reached. If the expression returns true (non-zero), the debugger will execute the
  selected actions. Please note that you can use the register names in the
  IDC scripts when the debugger is active. Tests like this are allowed,
  for example: EAX == EBX+5 or get_wide_dword(ESP+0x10) == 34
  You can also use the "..." button to enter a multiline condition, or specify
  another scripting language to use. See here for
  more info.
        If the breakpoint is enabled or disabled. Disabled breakpoints
        are not written to the debugged process.
        If enabled, IDA will use a hardware breakpoint. The breakpoint
        mode and size must be specified for them (see below).
  Module relative:
        The breakpoint location is stored as a combination of a module
        name and an offset. This kind of breakpoint is useful for
        DLLs that are loaded to various addresses because their addresses
        cannot be calculated in advance. Example: kernel32+0x1234
        The breakpoint location is stored as a combination of a symbol
        name and a possible offset. This kind of breakpoint is useful for
        symbols that can be imported from different DLLs because their addresses
        cannot be calculated in advance. Example: myfunc+44
  Source code:
        The breakpoint location is stored as a combination of a source file
        name and a line number. Can be used only if the source code of the
        debugged application is available. Example: myfile.cpp:55
  Low level condition:
        Evaluate the condition on the remote computer. Such conditions are
        faster, especially during remote debugging, because there is no
        network traffic between IDA and the remote computer on each
        breakpoint hit. More details
        Suspend the debugged application
        Add a new entry to the trace log
  Refresh debugger memory:
        By default IDA does not refresh the memory config before evaluating
        a breakpoint condition. This option enables the refresh.
        To refresh it, please call refresh_debugger_memory
  Enable tracing:
        Enable tracing when the breakpoint hits. This is different from trace
        breakpoints (where only a new entry is added to the trace log).
  Disable tracing:
        Disable tracing when the breakpoint fires.
  Tracing type:
        Instruction, Function and Basic block level tracing types can be selected
        for breakpoints where enable/disable tracing have been selected.
Hardware breakpoint size
        Number of bytes to watch: 1, 2 or 4 bytes for normal hardware breakpoints.
        Any size for page breakpoints.
Hardware breakpoint mode
        The access type the breakpoint will react: read/write, write, execute.
In the case of Intel hardware breakpoints, some limitations are enforced (in contrast with page breakpoints). It is impossible to create more than 4 hardware breakpoints. The address of the breakpoint must be aligned appropriately:
  - 2-byte breakpoints must be word-aligned.
  - 4-byte breakpoints must be dword-aligned.
Please note that hardware breakpoints occur AFTER the instruction execution while software breakpoints occur BEFORE the instruction.

Usually, it is easier to use software breakpoints, except if:

  - we want to be sure the memory is not modified by the debugger
  (instruction breakpoints modify the debugged process memory).
  - we want to detect accesses to data bytes.
  - the specified address is write protected (really rare!).
 See also Breakpoints list
          Add breakpoint
          Delete breakpoint
          Breakpoint conditions
          Breakpoints submenu
          Index of IDC functions
Index | Previous topic | Next topic