Reverse › Module 6 › Lesson 2
Breakpoints
Breakpoint literacy — software, hardware, conditional, and watchpoints on $RE_LAB binaries to stop at decisions, not to patch stranger DRM.
Visual · t23_breakpoints
Breakpoints = stop execution at decision points. $RE_LAB. Original Cyberlium.
Opening
Breakpoints are bookmarks in execution — place them where YOUR crackme checks the password, not where Adobe checks the subscription.
Breakpoints pause execution so you observe register and memory state at critical moments: entry to main, before/after strcmp, before conditional jump, on write to global flag. GDB supports break function, break *address, conditional break if $rax==0, watch read/write on memory, and hardware watchpoints where supported. Cyberlium teaches breakpoint strategy on $RE_LAB crackmes — set at compare, validate input length check, catch 'success' path — NOT breakpoint spam on commercial software, NOT anti-debug evasion tuning against EDR on stranger hosts. Pair breakpoints with static addresses from objdump/Ghidra. chmod 600 notes under $HOME/cyberlium-lab.
1. Breakpoint types
Software break at address (int3); conditional break if register or memory matches; watchpoint on variable write.
Named break on symbol when not stripped; for stripped crackmes use address from static analysis.
Command guide
Try these commands — Breakpoint types
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
GDB breakpoints — https://sourceware.org/gdb/current/onlinedocs/gdb.html/Breakpoints.html GDB run — https://sourceware.org/gdb/current/onlinedocs/gdb.html/Starting.html pwn.college — https://pwn.college/ (debugger drills in authorized labs)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install gdb
macOS:
Command — copy this
brew install gdb
Windows: Use WSL gdb
═══ LINUX / macOS ═══
Optional command
sudo apt install gdb # gdb
Command — copy this
export LAB_RE=${LAB_RE:-$HOME/cyberlium-lab/t23-re}
gdb -q -batch -ex 'break main' -ex 'run' -ex 'info breakpoints' -ex quit "$LAB_RE/bin/check"
gdb -q -batch -ex 'break add' -ex 'run' -ex 'info locals' -ex quit "$LAB_RE/bin/check" 2>/dev/null | head -15Primary tools to practice this lesson: gdb. Reference sites: GDB breakpoints (https://sourceware.org/gdb/current/onlinedocs/gdb.html/Breakpoints.html); GDB run (https://sourceware.org/gdb/current/onlinedocs/gdb.html/Starting.html); pwn.college (https://pwn.college/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Strategy on crackmes
Break before string compare, before jump to success/fail blocks, on scanf/read input — map to pseudocode labels.
One breakpoint → one hypothesis → one observation row in notes — avoid blind stepping entire binary.
3. Ethics and scope
Breakpoints on YOUR toys and assigned CTF/crackme only — document hash and source.
Patch literacy comes later on YOUR binaries — breakpoints here are observe-only.
4. What you ship: breakpoint strategy card
Three breakpoint types + three crackme placement rules + conditional example + scope line.
5. What you record before the next lesson
Breakpoint strategy card path.
6. Wrong vs right: commercial piracy vs crackmes/CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Set breakpoints on Windows kernel to bypass third-party license driver.
Right
Breakpoint strategy for $RE_LAB crackme. Next: Trace/Observe.
Mission: breakpoint strategy card
1) Define software vs watchpoint. 2) Name three crackme breakpoint locations. 3) Write conditional break example. 4) Link one address to static disasm.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Break before or after compare — tradeoff?”
Knowledge Check
APPLY: Breakpoints on Cyberlium target:
Multiple choice
Knowledge Check
APPLY: True or False: Conditional breaks on licensed software for cracking are lab.
True or False
Knowledge Check
APPLY: Striped crackme breakpoints use:
Multiple choice