This 1-pager from Xusheng Li on GDB internals of how watchpoints are implemented is a delight to read! (especially that double-write behaviour false positive - I did not know about that)

Mar 24, 2026 · 12:19 PM UTC

5
79
359
22,200
Sort replies: Relevant Recent Liked
Replying to @gynvael
I've built some programmable instrumentation before and to tell if something is a read you can just check the the opcode. You simply cover most common instructions and read the Mod R/M, but if you wanted it to work on more exotic instructions a fast disassembler would be easier.
2
173
Replying to @gynvael
I think I had this problem when working in ReversingLabs, and we had to write our own debugger for Windows... Yeah, this hardware breakpoint stuff was even a bit difficult, and only 4 available registers for having them. Memory protection is a quick hack, but it's page size.
1
238
Replying to @gynvael
Interesting, thanks for sharing! I forgot about your magazine, need to look into it more often
1
199