LAB-08Easy
Where to Break
Choose strategic breakpoint locations to answer a question about a validation routine.
10 min4 prerequisites5 tools
Disassembly
00: mov rax, 5
01: mov rcx, 5
02: cmp rax, rcx
03: jne reject
04: mov rdx, 1
05: jmp end
reject:
06: mov rdx, 0
end:
07: ret Hints
Hint 1
Break after the cmp/jne decision, before the branches merge.
Hint 2
RAX and RCX are both 5, so the comparison is equal.
Hint 3
A breakpoint at 0x4 catches execution only on the success path.
Submit Findings
Solution
Where to Break — Solution
- Breakpoint at 0x4 (after the
jneat 0x3, on the success path). This pauses exactly when the comparison passed. - RAX = RCX = 5, so
cmpis equal →jnenot taken → falls through tomov rdx, 1→ RDX = 1 atret. - The
jneinstruction at 0x3 is the decision point.
Methodology: break after the branch you care about, not on the branch itself, so you observe the consequence rather than the test.
Prerequisites
- d1-breakpoints
- a3-control-flow
- x64dbg/GDB basics
- Conditional jump behavior
Methodology
Investigation Methodology
1. Understand the Control Flow
cmp rax, rcx
jne reject ← Decision point
mov rdx, 1 ← Success path (address 4)
jmp end
reject:
mov rdx, 0 ← Failure path (address 6)
end:
ret
2. Strategic Breakpoint Placement
- On the branch (address 3): Shows you the test, not the outcome
- After the branch (address 4): Shows you the success path was taken
- At merge point (address 7): Shows final result, but not which path
Rule: Break after the branch you want to observe.
3. Trace Execution
mov rax, 5/mov rcx, 5→ Both = 5cmp rax, rcx→ 5 - 5 = 0 → ZF = 1jne reject→ ZF=1 → NOT taken (equal)- Falls through to
mov rdx, 1 jmp end→ skip failure pathretwith RDX = 1
4. Conditional Breakpoints
In x64dbg/GDB:
bp 0x401003(onjne)- Or conditional: break at address 3 if ZF=0 (failure path)
- Log breakpoints: auto-continue, log registers
Common Pitfalls
- Breaking on the `jne` itself — you see the test, not which way it went
- Not accounting for instruction sizes when calculating addresses
- Missing that `cmp` sets flags but doesn't store result
- Confusing `jne` (jump if NOT equal) with `je` (jump if equal)
Tools
- x64dbg / x32dbg (Windows)
- GDB / GEF / pwndbg (Linux)
- WinDbg (kernel/user)
- Binary Ninja Debugger
- Ghidra Debugger (experimental)
References
- Lesson D1: Breakpoints
- Lesson A3: Control Flow — JNE, JE
- x64dbg Breakpoint Guide
- GDB Breakpoint Commands
Extensions & Challenges
- Set a conditional breakpoint that only triggers when RAX ≠ RCX
- Use a log breakpoint to trace 100 iterations of a loop
- Research: Hardware breakpoints (DR0-DR3) vs software (INT3)
- Practice: Break on memory access (write to specific address)