Hacking Data and Instruction Breakpoints

[BullyWiiPlaza]

I have been trying to get breakpoints working and implemented most of the code here already. This StackOverflow post explains data breakpoints in a nutshell which seems to match with my research for the most part.

The idea is to use the hardware debug registers DABR/IABR:

• Via setDABR or setIABR syscalls
  
• Via the OSSetDABR, OSSetIABR coreinit.rpl functions
• Via the assembly instructions "move to special purpose register" mtspr 0x3F5, r4 and mtspr 0x3F2, r4 where r4 is the value to move to the respective hardware register
  

  #define DATA_ADDRESS_BREAKPOINT_REGISTER 0x3F5
  #define INSTRUCTION_ADDRESS_BREAKPOINT_REGISTER 0x3F2

Once a breakpoint is hit, the CPU will apparently generate an exception DSI ("data storage interrupt") which should be caught by a handler. Inside the handler function, you can then retrieve the respective breakpoint address from the OSContext structure via the SRR0 field (read/write data address) and exception_specific1 (instruction pointer) since it is passed a reference of the current thread:

unsigned char breakPointHandler(void *interruptedContext);

Consult the OSContext struct definition here or here for more information about its fields. I used IDA Pro by the way to figure out the OSContext offsets as well so they are quite certainly correct.

Spoiler

I tried OSSetExceptionCallback() and __OSSetInterruptHandler() to register the handler but neither of them causes the handler to ever be called even when a breakpoint should be hit. I decided to turn on interrupts/the debugger by calling/patching the respective functions because it seems like debugging is disabled by default. Still, this didn't change anything. Breakpoints are never hit. I only tried the OSSetDABR and OSSetIABR coreinit.rpl functions though.

Do you have an idea of how breakpoints can be realized correctly or maybe I made a mistake somewhere in my approach since I'm pretty sure that I'm close?

Thank you very much

@QuarkTheAwesome
@dimok
@FIX94
@CosmoCortney
@skoolzout1
@NWPlayer123
@wj44
@shinyquagsire23

 

[PandaOnSmack]

Thanks for working hard on this bully