{"action":"created","issue":{"url":"https://api.github.com/repos/x64dbg/x64dbg/issues/2014","repository_url":"https://api.github.com/repos/x64dbg/x64dbg","labels_url":"https://api.github.com/repos/x64dbg/x64dbg/issues/2014/labels{/name}","comments_url":"https://api.github.com/repos/x64dbg/x64dbg/issues/2014/comments","events_url":"https://api.github.com/repos/x64dbg/x64dbg/issues/2014/events","html_url":"https://github.com/x64dbg/x64dbg/issues/2014","id":355955385,"node_id":"MDU6SXNzdWUzNTU5NTUzODU=","number":2014,"title":"Hardware (write) breakpoints behave very unreliable","user":{"login":"0xEmanuel","id":30754525,"node_id":"MDQ6VXNlcjMwNzU0NTI1","avatar_url":"https://avatars0.githubusercontent.com/u/30754525?v=4","gravatar_id":"","url":"https://api.github.com/users/0xEmanuel","html_url":"https://github.com/0xEmanuel","followers_url":"https://api.github.com/users/0xEmanuel/followers","following_url":"https://api.github.com/users/0xEmanuel/following{/other_user}","gists_url":"https://api.github.com/users/0xEmanuel/gists{/gist_id}","starred_url":"https://api.github.com/users/0xEmanuel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/0xEmanuel/subscriptions","organizations_url":"https://api.github.com/users/0xEmanuel/orgs","repos_url":"https://api.github.com/users/0xEmanuel/repos","events_url":"https://api.github.com/users/0xEmanuel/events{/privacy}","received_events_url":"https://api.github.com/users/0xEmanuel/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-08-31T12:09:44Z","updated_at":"2018-09-01T13:18:18Z","closed_at":null,"author_association":"NONE","body":"Hello, I have following issue:\r\n\r\nMost of the time x64dbg does not break on a Hardware write breakpoint, although we know that at the specified address occurs a write. In very few cases, it had worked (like 1 of 15 tries).\r\nImmunity Debugger works always, with the exact same settings.\r\n\r\nDebugger version: Aug 28 2018, 18:39:55 (using x32dbg)\r\nOS: Microsoft Windows 10 Pro, Version\t10.0.17134 Build 17134, x64 (Running inside VirtualBox)\r\n(!Malware!) Sample (SHA256): 3809394dceddbe1419e964cd08397e5fed4a0bbefc8be466f33614bac8794243 (x86)\r\n\r\nReproduction:\r\n- Use some Anti-Anti-Debug plugin (like ScyllaHide), since this sample uses an Anti-Debug method (you would get an ACCESS_VIOLATION_EXCEPTION without ScyllaHide)\r\n- Since this process is running without ASLR, it is going to be mapped always to the preferred image base which is: 00400000\r\n- Since we know that the unpacker will write to 00400114 we can set here a hardware write breakpoint (word).\r\n- Now run the debugger. x64dbg will unfortunately not break, although we know that the sample is writing to that specified area.\r\n- Immunity debugger works perfectly with the same reproduction steps (\"!hidedebug all_debug\", to bypass anti-debug, and set same HW BP)\r\n"},"comment":{"url":"https://api.github.com/repos/x64dbg/x64dbg/issues/comments/417859173","html_url":"https://github.com/x64dbg/x64dbg/issues/2014#issuecomment-417859173","issue_url":"https://api.github.com/repos/x64dbg/x64dbg/issues/2014","id":417859173,"node_id":"MDEyOklzc3VlQ29tbWVudDQxNzg1OTE3Mw==","user":{"login":"mrexodia","id":2458265,"node_id":"MDQ6VXNlcjI0NTgyNjU=","avatar_url":"https://avatars2.githubusercontent.com/u/2458265?v=4","gravatar_id":"","url":"https://api.github.com/users/mrexodia","html_url":"https://github.com/mrexodia","followers_url":"https://api.github.com/users/mrexodia/followers","following_url":"https://api.github.com/users/mrexodia/following{/other_user}","gists_url":"https://api.github.com/users/mrexodia/gists{/gist_id}","starred_url":"https://api.github.com/users/mrexodia/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mrexodia/subscriptions","organizations_url":"https://api.github.com/users/mrexodia/orgs","repos_url":"https://api.github.com/users/mrexodia/repos","events_url":"https://api.github.com/users/mrexodia/events{/privacy}","received_events_url":"https://api.github.com/users/mrexodia/received_events","type":"User","site_admin":false},"created_at":"2018-09-01T13:18:18Z","updated_at":"2018-09-01T13:18:18Z","author_association":"MEMBER","body":"I tested on my local machine and confirmed that stepping after a hardware breakpoint will resume execution. I cannot reproduce any issues with hardware breakpoints not triggering though."}}
{"actor":{"display_login":"mrexodia"}}