bp (set breakpoint)
Description of the 'bp' command in HyperDbg.
Last updated
Description of the 'bp' command in HyperDbg.
Last updated
bp
bp [Address (hex)] [pid ProcessId (hex)] [tid ThreadId (hex)] [core CoreId (hex)]
Puts a breakpoint (0xcc) on the target function in user-mode and kernel-mode.
In HyperDbg, the 'bp' breakpoints are NOT . If you want to use breakpoint in an event-like form (e.g., if you want to create logs using script-engine), you should use command instead.
[Address (hex)]
The Virtual address of where we want to put a breakpoint.
[pid ProcessId (hex)] [tid ThreadId (hex)] [core CoreId (hex)] (optional)
Optional value to trigger breakpoint in just one special process or one special thread, or one special core. Add pid xx to your command or tid yy or core zz; thus, the command will be executed if the process id is equal to xx or the thread id is equal to yy or the core is equal to zz . If you don't specify these options, then by default, you receive breakpoints on all conditions. See the Remarks section for more information about pid.
As the Context, HyperDbg sends the virtual address of where the breakpoint is triggered (RIP of the triggered breakpoint).
If you want to put breakpoints on nt!ExAllocatePoolWithTag, nt!ExAllocatePoolWithTag+5,nt!ExAllocatePoolWithTag+@rax+5, fffff801639b1035, fffff801639b103a, and fffff801639b103f, you can use the following commands.
To set the breakpoint, you need to use the following function in libhyperdbg:
This command is guaranteed to keep debuggee in a halt state (in Debugger Mode); thus, nothing will change during its execution.
None
After that, you can see a list of active breakpoints using the '' command.
In this command, pid xx does not mean that we will change the layout to a new process, it means that the address should be available in the current process layout but will be triggered only on the process with process id equal to xx, you can use the '' command to switch to a new process if you want to put a breakpoint on the layout of another process.