diff --git a/examples/f401_ktest.rs b/examples/f401_ktest.rs
index 169444910ebbf7cf53ad80918c0ffe71d13167e4..54d5aad190773523f67ddd2a1b673b19e848c3d5 100644
--- a/examples/f401_ktest.rs
+++ b/examples/f401_ktest.rs
@@ -1,6 +1,6 @@
 // minimal example for the stm32-f401 (and the f4 series)
 //! Prints "Hello, world!" on the host console using semihosting
-
+#![feature(asm)]
 #![no_main]
 #![no_std]
 
@@ -8,7 +8,7 @@ extern crate panic_halt;
 
 use stm32f4::stm32f401 as stm32;
 
-use cortex_m::asm;
+use cortex_m::{asm, bkpt, iprintln};
 use cortex_m_rt::entry;
 
 #[entry]
@@ -17,10 +17,16 @@ fn main() -> ! {
     // klee_make_symbolic(&mut x);
     // while x == 0 {}
     // // asm::bkpt();
-    asm::bkpt_nr(1);
+    //
+    //
+    bkpt!(1);
     asm::nop();
-    asm::bkpt_nr(2);
-    asm::bkpt();
+    asm::nop();
+
+    bkpt!(2);
+    asm::nop();
+
+    bkpt!();
     loop {
         asm::nop();
     }
diff --git a/runner/src/main.rs b/runner/src/main.rs
index 3d3724631fdf7dbfc896df78091ba0e27384340e..10c2815bbd4c2f39063e4575ae4e7abdb89b3770 100644
--- a/runner/src/main.rs
+++ b/runner/src/main.rs
@@ -66,13 +66,11 @@ fn main() {
     println!("reset 0x{:08x}", data);
 
     run_to_halt(&mut session);
-
-    break_step(&mut session);
-
+    cycnt_enable(&mut session);
+    cycnt_reset(&mut session);
     run_to_halt(&mut session);
-
-    break_step(&mut session);
-
+    let cyccnt = cycnt_read(&mut session);
+    println!("cyccnt {}", cyccnt);
     run_to_halt(&mut session);
 
     // session
@@ -124,7 +122,7 @@ fn main() {
     // println!("breapoint reached");
 }
 
-fn read_pc(session: &mut Session) {
+fn read_bkpt(session: &mut Session) -> Option<u8> {
     // try to read the program counter
     let pc_value = session
         .target
@@ -135,13 +133,13 @@ fn read_pc(session: &mut Session) {
     let mut instr16 = [0u8; 2];
     session.probe.read_block8(pc_value, &mut instr16).unwrap();
 
-    println!(
-        "instr16 {:?}, {:b}, {:b}, {:x}",
-        instr16, instr16[0], instr16[1], instr16[1]
-    );
+    match instr16[1] {
+        0b10111110 => Some(instr16[0]),
+        _ => None,
+    }
 }
 
-fn break_step(session: &mut Session) {
+fn step_from_bkpt(session: &mut Session) {
     // try to read the program counter
     let pc_value = session
         .target
@@ -164,6 +162,12 @@ fn break_step(session: &mut Session) {
 
 fn run_to_halt(session: &mut Session) {
     // Continue running
+    if read_bkpt(session).is_some() {
+        println!("Continue from breakpoint.");
+        step_from_bkpt(session);
+    } else {
+        println!("Continue");
+    }
     session.target.core.run(&mut session.probe).unwrap();
     println!("running");
     session
@@ -174,7 +178,6 @@ fn run_to_halt(session: &mut Session) {
 
     let cpu_info = session.target.core.halt(&mut session.probe).unwrap();
     println!("Run: Core stopped at address 0x{:08x}", cpu_info.pc);
-    read_pc(session);
 }
 // index is the oject number
 fn set_symbolic(session: &mut Session, data: &[u8]) {
@@ -201,3 +204,23 @@ fn open_probe() -> MasterProbe {
 
     MasterProbe::from_specific_probe(link)
 }
+
+const DWT_CTRL: u32 = 0xe000_1000;
+const DWT_CYCCNT: u32 = 0xe000_1004;
+
+fn cycnt_enable(session: &mut Session) {
+    session.probe.write32(DWT_CTRL, 0x1).unwrap();
+}
+
+fn cycnt_disable(session: &mut Session) {
+    session.probe.write32(DWT_CTRL, 0x0).unwrap();
+}
+
+fn cycnt_reset(session: &mut Session) {
+    // Reset cycle counter to 0
+    session.probe.write32(DWT_CYCCNT, 0x0).unwrap();
+}
+
+fn cycnt_read(session: &mut Session) -> u32 {
+    session.probe.read32(DWT_CYCCNT).unwrap()
+}