20.6.3 Hardware breakpoints

The hardware breakpoints are architecture-dependant and provide a limited but powerful way to make the debugger stop when reading, writing or executing at a certain memory address. On intel there's the '!dr' command to manually modify the DRX registers.

[0xB7F08810]> !dr?
Usage: !dr[type] [args]
  dr                   - show DR registers
  dr-                  - reset DR registers
  drr [addr]           - set a read watchpoint
  drw [addr]           - set a write watchpoint
  drx [addr]           - set an execution watchpoint
  dr[0-3][rwx] [addr]  - set a rwx wp at a certain DR reg
Use addr=0 to undefine a DR watchpoint

Lets define some hardware breakpoints on intel:

[0xB7F08810]> !dr0r 0x8048000 ; DR0 = read breakpoint
[0xB7F08810]> !dr1x 0x8049200 ; DR1 = exec breakpoint
[0xB7F08810]> !dr      ; list DRX reg values
DR0 0x08048000 r
DR1 0x08049200 x
DR2 0x00000000 x
DR3 0x00000000 x

[0xB7F08810]> !dr-     ; reset DRX
[0xB7F08810]> !dr
DR0 0x00000000 x
DR1 0x00000000 x
DR2 0x00000000 x
DR3 0x00000000 x

The hardware breakpoints can be configured automatically using the !bph command which forces the creation of hardware breakpoints. In the same form, there's also !bps which stands for 's'oftware breakpoints.

By default '!bp' will use software or hardware breakpoints (depending on the debugger platform) which is determined by the eval variable 'dbg.hwbp'.

When all the available hardware breakpoints have been consumed, radare will automatically start defining software breakpoints until a hardware breakpoint is released. On the intel platform only 4 hardware breakpoints can be defined.