Memory access breakpoints are implemented by removing page permissions according to the specified type of the page breakpoint to be added (for example, for a write page breakpoint, the write permission will be removed from the page). When the access violation exception occurs because the application tries to access the specific memory region, IDA reports a breakpoint hit.
As page breakpoints can be set for a small part of a memory page but the permissons of the whole page must be changed, page breakpoints can slow down the debugger because many access violation exceptions may be generated. If the application accesses memory outside of the desired range but on the same page, the generated exception must be silently handled and the application resumed. Specifically, page breakpoints in the code segment can slow down the debugger very much.
Memory access breakpoints are supported since IDA version 6.3 for the following debuggers:
Win32
Page breakpoints are supported for both local and remote debugging of 32 and 64bit applications.WinDbg
Page breakpoints are supported only for local debugging of 32-bit applications.Bochs
Page breakpoints are supported for both of 32 and 64bit applications. Page breakpoints in the bochs debugger are just like normal hardware breakpoints but with no limit on the number of breakpoints or their size. Please note that hardware breakpoints in the bochs debugger occur AFTER the instruction is executed while regular page breakpoints occur BEFORE the instruction is actually executed.
See also Breakpoints list Add breakpoint Delete breakpoint Edit breakpoint Breakpoints submenu.