Technique Search Instance

HTTP 200 OK
Allow: GET, PUT, PATCH, DELETE, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "id": 164,
    "key": "debug-registers-hardware-breakpoints",
    "unprotect_id": "U0127, B0001.005",
    "name": "Debug Registers, Hardware Breakpoints",
    "description": "Hardware breakpoints allow a debugger to pause execution at specific memory addresses without modifying the program code. They are stored in special CPU registers (DR0 through DR3 on Intel CPUs). \r\n\r\nFor anti-debugging, malware can inspect the values of these debug registers. If any of the registers contain a non-empty value, it indicates that a hardware breakpoint has been set by a debugger.\r\n\r\nA common way to capture this information is by calling RtlCaptureContext(), which retrieves the current thread’s execution context, including the debug registers. The malware can then check DR0–DR3. If one of them is populated, it signals the presence of an active debugger using hardware breakpoints.",
    "windows": "",
    "linux": "",
    "macos": "",
    "resources": "https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-getcurrentthread\r\nhttps://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-getthreadcontext\r\nhttps://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/registers-window\r\nhttps://isc.sans.edu/diary/31658",
    "creation_date": "2020-11-13T14:16:40Z",
    "tags": "DR0",
    "modification_date": "2025-09-20T05:12:10.301283Z",
    "category": [
        3
    ],
    "rules": [
        10
    ],
    "attachments": [],
    "featured_api": [],
    "contributors": []
}