(x86)硬件断点的原理与测试_dll 硬件断点-CSDN博客

本文链接：https://blog.csdn.net/weixin_43890959/article/details/130450531

该代码示例展示了如何在Windows环境下通过设置线程上下文，利用DR0寄存器创建硬件断点。当程序执行到指定地址时，CPU检测到DR0中的地址与EIP相同，触发#DB异常，进入KiTrap01处理。在此过程中，DR6和DR7寄存器指示断点状态，允许调试器捕获和分析异常。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

测试代码如下：

/*
	设置硬件中断的程序
*/
#include <Windows.h>
#include <stdio.h>

HANDLE hThreadOfDebuggee;
// vc6++中，OpenThread未声明
typedef HANDLE (WINAPI * OPENTHREADFUN)(DWORD dwDesiredAccess,BOOL bInheritHandle,DWORD dwThreadId);
OPENTHREADFUN OpenThread;

BOOL SetHardWareBreakPointer(DWORD dwCurrectDebuggeeThreadID, DWORD dwHardWareBreakPointerAddress)
{

    CONTEXT context;
    context.ContextFlags = CONTEXT_FULL | CONTEXT_DEBUG_REGISTERS;
	
    hThreadOfDebuggee = OpenThread(THREAD_ALL_ACCESS, TRUE, dwCurrectDebuggeeThreadID);
    if (hThreadOfDebuggee)
    {
        SuspendThread(hThreadOfDebuggee);   // 挂起线程
        GetThreadContext(hThreadOfDebuggee, &context);

        context.Dr0 = dwHardWareBreakPointerAddress;
        context.Dr7 |= 1;   // 执行断点
         
        SetThreadContext(hThreadOfDebuggee, &context);
        ResumeThread(hThreadOfDebuggee);    // 恢复线程
        return TRUE;
    }
    else
    {
        DWORD dwRet = GetLastError();
        return FALSE;
    }  
}

void main()
{
	int tid, address;
	HMODULE hKernel32 = GetModuleHandle("kernel32.dll");
	OpenThread = (OPENTHREADFUN)GetProcAddress(hKernel32, "OpenThread");

	printf("input thread id: ");
	scanf("%d", &tid);
	printf("input address: ");
	scanf("%x", &address);
	printf("tid: %d, address: %p\n", tid, address);
	SetHardWareBreakPointer(tid, address);

	system("pause");
}

/*
	测试程序 
*/
#include <windows.h>
#include <stdio.h>

void Output()
{
	printf("Good Done!\n");
}

void main()
{
	int index = 0;

	printf("thread id: %d func_addr: %p\n", GetCurrentThreadId(), Output);
	system("pause");	

	while(1)
	{
		printf("index: %d\n", ++index);
		Output();
		Sleep(1000);
	}
}