Gray Hat Python

The Almighty Breakpoint

Now that we have a functional debugging core, it's time to add breakpoints. Using the information from Chapter 2, we will implement soft breakpoints, hardware breakpoints, and memory breakpoints. We will also develop special handlers for each type of breakpoint and show how to cleanly resume the process after a breakpoint has been hit.

Soft Breakpoints

In order to place soft breakpoints, we need to be able to read and write into a process's memory. This is done via the ReadProcessMemory()^[16] and WriteProcessMemory()^[17] functions. They have similar prototypes:

BOOL WINAPI ReadProcessMemory( HANDLE hProcess, LPCVOID lpBaseAddress, LPVOID lpBuffer, SIZE_T nSize, SIZE_T* lpNumberOfBytesRead ); BOOL WINAPI WriteProcessMemory( ...