Learning Malware Analysis

1.3 Interrupting a Program with Breakpoints

A breakpoint is a debugger feature that allows you to interrupt program execution at a very specific location within a program. Breakpoints can be used to pause the execution at a particular instruction, or when the program calls a function/API function, or when the program reads, writes, or executes from a memory address. You can set multiple breakpoints all over a program, and execution will be interrupted upon reaching any of the breakpoints. Once a breakpoint has been reached, it is possible to monitor/modify various aspects of the process. Debuggers typically allow you to set different types of breakpoints:

• Software Breakpoints: By default, debuggers make use of software breakpoints. Software ...