ollydbg内存断点的原理是什么?
好像只能设置1个内存断点,而且在哪一行设置内存断点似乎并不重要,很奇怪,有人能解释一下吗?
It seems only 1 memory breakpoint can be set, and it seems doesn't matter at which line the memory breakpoint is set,very weird,anyone can explain?
如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱,如果其他用户或者作者回复了您的评论,将不能在第一时间通知您!
发布评论
评论(2)
Ollydbg 中的内存断点适用于内存块。请注意,最小可能的块通常为 4096 字节(页大小)。您可以从反汇编器视图中选择一段代码并在其上设置内存断点。您可以在访问或写入时设置内存断点。这是通过使用保护页在内部实现的,保护页使用 PAGE_GUARD 修饰符。当访问内存(读/写)时,会发生 STATUS_GUARD_PAGE_VIOLATION 异常,该异常由 Ollydbg 处理。
示例
您希望 Ollydbg 在模块加载到特定地址(或范围)时中断。您可以进入 Ollydbg 中的内存视图并选择地址范围并在其上设置内存断点。
Memory breakpoints in Ollydbg apply to a block of memory. Note the smallest possible block is typically 4096 bytes (page size). You can select a chunk of code from the disassembler view and set a memory breakpoint on it. You can set Memory Breakpoints on either access or on write. This is internally implemented by using guard pages, which use the PAGE_GUARD modifier. When the memory is accessed (read/write), a STATUS_GUARD_PAGE_VIOLATION exception occurs, which is handled by Ollydbg.
Example
You want Ollydbg to break when a module is loaded at a particular address (or range). You can goto the Memory view in Ollydbg and select the address range and set a memory breakpoint on it.
OllyDbg使用
int 3
来设置断点,你可以设置任意数量的断点。检查您是否确实在代码段而不是数据中定义断点。
OllyDbg use
int 3
to set the breakpoints, and you can set as many breakpoints as you want.Check if you're really defining breakpoints in the code segment, not in data.