ABAP Debugger

After finishing the last post on SE16N and DEBUG, I realised that since this site primarily caters to the aspiring security consultants, some portion of its target audience might be at all familiar with ABAP debugging at all. The idea behind this post is to acquaint Security Consultants with the basics of debugging. This is certainly not meant as a guide on how to debug ABAP code as you would need to be familiar with ABAP syntax to actually debug code.  However, I always consider that knowing ABAP is very helpful for any consultant, functional, security or basis. So if you have some free time you can always go through some of the free ABAP tutorials available on the web and the added knowledge would certainly come in handy the longer you stay with SAP.

To give an example of debugging I have actually used the same transaction that originally brought us to the DEBUG question. So the piece of code copied below (its a screenshot from SE38) is from the program that is called when  you execute SE16N and try to switch on &SAP_EDIT. I have put in a breakpoint on the first authority check statement which checks if the user has access to change access to S_DEVELOP for object type DEBUG. Setting breakpoints/removing breakpoints are done by taking the caret to the statement where you want program execution to stop during debugging and selecting either of the two buttons with STOP sign. I have used a user breakpoint below ( this is the second button) as I only want program execution to stop when I am executing code.

Now we go back to the transaction which we want to test. In our case this is SE16N. Debugging is switched on by typing in /h in command and provided you have access to S_DEVELOP with object type DEBUG (even a value of 03 for activity is fine), debugging will be switched on and indicated in the status bar below.

With debugging switched on we start executing the transaction (In our case this involves keying in &SAP_EDIT command) when the ABAP Debugger starts in a new session as shown below. The execution is now at the first line of the highlighted code in the left section of the scrren. The Debugger has a variety of tools to allow us to execute code. I have highlighted the buttons in the toolbar which allow us to step through code. For example we have options of executing single lines of code (single step) or execute the entire program. Also on the right hand side of the screen we have the option of entering different variables and observing how their values change in the course of program execution. The different tabs of the Debugger also allow us to check values for tables and structures used in the program.

Since I have already set a breakpoint in the program, I would just execute the program at this point and the entire set of lines in the program flow till my breakpoint is executed. Standard SAP code runs into hundreds of lines for even simple transactions and single stepping through them can be time consuming. The yellow arrow shown below shows the current line that is to be executed next.

In a typical debugging session we would now switch to execting single lines of code and checking for the variable values as they appear. Since I already have access value of the SY-SUBRC variable is already 0 after executing the authority-check statement. However a person with change access for DEBUG can use the pencil icon below to change the values for SY-SUBRC or for any of the variables being used. So a person with DEBUG can switch on debugging, try to execute a restricted transaction, change the value of SY-SUBRC during execution from 4/8/12 to 0 and actually run the tcode even though he did not have access to begin with. This is the big risk in giving anyone access to DEBUG with change option in a productive system and should be avoided at all cost.

Once the code with the breakpoint is executed we can continue to execute the rest of the program as before. The debugger session can be closed once you are done with the program execution. Finally please remember to remove the breakpoints set in the code once you are through.