# 20.6.3 Hardware breakpoints

The hardware breakpoints are architecture-dependant and provide a limited but powerful way to make the debugger stop when reading, writing or executing at a certain memory address. On intel there's the '!dr' command to manually modify the DRX registers.

    [0xB7F08810]> !dr?
    Usage: !dr[type] [args]
      dr                   - show DR registers
      dr-                  - reset DR registers
      drr [addr]           - set a read watchpoint
      drw [addr]           - set a write watchpoint
      drx [addr]           - set an execution watchpoint
      dr[0-3][rwx] [addr]  - set a rwx wp at a certain DR reg
    Use addr=0 to undefine a DR watchpoint

Lets define some hardware breakpoints on intel:

    [0xB7F08810]> !dr0r 0x8048000 ; DR0 = read breakpoint
    [0xB7F08810]> !dr1x 0x8049200 ; DR1 = exec breakpoint
    [0xB7F08810]> !dr      ; list DRX reg values
    DR0 0x08048000 r
    DR1 0x08049200 x
    DR2 0x00000000 x
    DR3 0x00000000 x

    [0xB7F08810]> !dr-     ; reset DRX
    [0xB7F08810]> !dr
    DR0 0x00000000 x
    DR1 0x00000000 x
    DR2 0x00000000 x
    DR3 0x00000000 x

The hardware breakpoints can be configured automatically using the !bph command which forces the creation of hardware breakpoints. In the same form, there's also !bps which stands for 's'oftware breakpoints.

By default '!bp' will use software or hardware breakpoints (depending on the debugger platform) which is determined by the eval variable 'dbg.hwbp'.

When all the available hardware breakpoints have been consumed, radare will automatically start defining software breakpoints until a hardware breakpoint is released. On the intel platform only 4 hardware breakpoints can be defined.