Using GDB Watchpoints to Detect Memory Modifications in C/C++ Programs

Memory management is a critical aspect of C/C++ programming, and bugs such as wild pointers, out‑of‑bounds accesses, or unintended writes often cause hard‑to‑locate crashes. The article introduces watchpoints—a GDB feature that can halt execution whenever a specified memory region is accessed or modified.

After a brief introduction, a simple C++ program is presented that creates a local variable int a = 10; , obtains its address, modifies it in a separate thread, and prints the result. The example illustrates a scenario where the variable’s value unexpectedly changes from 4960 to 1.

Using GDB, the author shows how to compile the program, set a breakpoint at the line printing a , and then query the variable’s address with p &a . With the address known (e.g., 0x7fffffffe508 ), a watchpoint is added via watch *(int*)0x7fffffffe508 , which creates a hardware watchpoint that monitors the 4‑byte region.

Running the program with c (continue) triggers the watchpoint when the thread writes to the memory, and GDB reports the old and new values, the location of the write ( a.cc:8 ), and the responsible thread. This demonstrates how GDB can pinpoint the exact line that altered the memory.

The article then explains that modern CPUs provide debug registers (DR0‑DR7 on x86) that enable hardware watchpoints, capable of detecting both reads and writes. GDB commands rwatch , awatch , and watch correspond to read, write, or both types of monitoring. When hardware support is unavailable, GDB falls back to software watchpoints, which are slower because they check the condition after each instruction.

Limitations are noted: software watchpoints may miss modifications in multithreaded programs, whereas hardware watchpoints remain reliable. The article concludes by encouraging readers to apply watchpoints for deeper insight into memory‑related bugs.