Action name: BreakpointEditThis command opens a dialog box to edit an existing breakpoint.
Location
The breakpoint location: either an absolute address, a symbol name, a module+offset combination, or a source file name and a line number. The exact location syntax depends on the breakpoint kind: absolute, module relative, symbolic, or source code.Condition
This IDC expression will be evaluated each time the breakpoint is reached. If the expression returns true (non-zero), the debugger will execute the selected actions. Please note that you can use the register names in the IDC scripts when the debugger is active. Tests like this are allowed, for example: EAX == EBX+5 or get_wide_dword(ESP+0x10) == 34
You can also use the "..." button to enter a multiline condition, or specify another scripting language to use. See here for more info.Settings
Enabled:
If the breakpoint is enabled or disabled. Disabled breakpoints
are not written to the debugged process.
Hardware:
If enabled, IDA will use a hardware breakpoint. The breakpoint
mode and size must be specified for them (see below).
Module relative:
The breakpoint location is stored as a combination of a module
name and an offset. This kind of breakpoint is useful for
DLLs that are loaded to various addresses because their addresses
cannot be calculated in advance. Example: kernel32+0x1234
Symbolic:
The breakpoint location is stored as a combination of a symbol
name and a possible offset. This kind of breakpoint is useful for
symbols that can be imported from different DLLs because their addresses
cannot be calculated in advance. Example: myfunc+44
Source code:
The breakpoint location is stored as a combination of a source file
name and a line number. Can be used only if the source code of the
debugged application is available. Example: myfile.cpp:55
Low level condition:
Evaluate the condition on the remote computer. Such conditions are
faster, especially during remote debugging, because there is no
network traffic between IDA and the remote computer on each
breakpoint hit. More details
Actions
Break:
Suspend the debugged application
Trace:
Add a new entry to the trace log
Refresh debugger memory:
By default IDA does not refresh the memory config before evaluating
a breakpoint condition. This option enables the refresh.
To refresh it manually, call refresh_debugger_memory
Enable tracing:
Enable tracing when the breakpoint hits. This is different from trace
breakpoints (where only a new entry is added to the trace log).
Disable tracing:
Disable tracing when the breakpoint fires.
Tracing type:
Instruction, Function and Basic block level tracing types can be selected
for breakpoints where enable/disable tracing have been selected.
Hardware breakpoint size
Number of bytes to watch: 1, 2 or 4 bytes for normal hardware breakpoints.
Any size for page breakpoints.
Hardware breakpoint mode
The access type the breakpoint will react: read/write, write, execute.
In the case of Intel hardware breakpoints, some limitations are enforced (in contrast with
page breakpoints).
It is impossible to create more than 4 hardware breakpoints.
The address of the breakpoint must be aligned appropriately:
- 2-byte breakpoints must be word-aligned. - 4-byte breakpoints must be dword-aligned.Please note that hardware breakpoints occur AFTER the instruction execution while software breakpoints occur BEFORE the instruction.
Usually, it is easier to use software breakpoints, except if:
- we want to be sure the memory is not modified by the debugger (instruction breakpoints modify the debugged process memory).
- we want to detect accesses to data bytes.
- the specified address is write protected (really rare!).
See also Breakpoints list Add breakpoint Delete breakpoint Breakpoint conditions Breakpoints submenu Index of IDC functions