1

I'm trying to solve FLARE-on 2015 challenge #06 (http://www.flare-on.com/files/2015_FLAREOn_Challenges.zip) using a dynamic analysis approach. It's an Android APK that loads a shared library (libvalidate.so). I have been able to break where this library is loaded but then, it seems that I'm not able to set other breakpoints within this library, which is critical to solve this challenge.

Here is what I've been able to do so far:

*Started the FLAREON android application (PID: 1278) on my Android Virtual Device (AVD) and entered a wrong password to force libvalidate.so to appear in the loaded shared libraries

*Port forwarding:

mobisec $ adb forward tcp:1234 tcp:1234
mobisec $ adb shell
avd # cd /data/
avd # ./gdbserver :1234 --attach 1278
Attached; pid = 1278
Listening on port 1234

*On Mobisec, in another terminal:

mobisec # cd /opt/mobisec/Android/ndk/toolchains/arm-linux-androideabi-4.9/prebuilt/linux-x86_64/bin/
mobisec # ./arm-linux-androideabi-gdb
(gdb) target remote :1234
Remote debugging using :1234
0xb6eca5cc in ?? ()
(gdb) set solib-search-path /data/flareon/system_lib/
[...removed...]
Reading symbols from /data/flareon/system_lib/libvalidate.so...(no debugging symbols found)...done.
Loaded symbols for /data/flareon/system_lib/libvalidate.so
[...removed...]

(gdb) info sharedlibrary 
Error reading attached process's symbol file.
com.flare_on.flare: No such file or directory.
From        To          Syms Read   Shared Object Library
[...removed...]
0xab137e20  0xab139038  Yes (*)     /data/flareon/system_lib/libvalidate.so
(gdb) 
(gdb) x/50i 0xab137e20
   0xab137e20:  ldr     r0, [pc, #4]    ; 0xab137e2c
   0xab137e24:  add     r0, pc, r0
   0xab137e28:  b       0xab137da8
   0xab137e2c:  ldrdeq  r4, [r0], -r4   ; <UNPREDICTABLE>
   0xab137e30:  cmp     r0, #0
   0xab137e34:  push    {r3, lr}
   0xab137e38:  popeq   {r3, pc}
   0xab137e3c:  blx     r0
   0xab137e40:  pop     {r3, pc}
   0xab137e44:  mov     r1, r0
   0xab137e48:  ldr     r2, [pc, #12]   ; 0xab137e5c
   0xab137e4c:  ldr     r0, [pc, #12]   ; 0xab137e60
   0xab137e50:  add     r2, pc, r2
   0xab137e54:  add     r0, pc, r0
   0xab137e58:  b       0xab137d9c
   0xab137e5c:  andeq   r4, r0, r8, lsr #3
   0xab137e60:                  ; <UNDEFINED> instruction: 0xffffffd4
   0xab137e64 <Java_com_flareon_flare_ValidateActivity_validate>:       push    {r4, r5, r6, r7, lr}
   0xab137e66 <Java_com_flareon_flare_ValidateActivity_validate+2>:
    ldr r4, [pc, #320]  ; (0xab137fa8 <Java_com_flareon_flare_ValidateActivity_validate+324>)
   0xab137e68 <Java_com_flareon_flare_ValidateActivity_validate+4>:     adds    r5, r0, #0
   0xab137e6a <Java_com_flareon_flare_ValidateActivity_validate+6>:     movs    r1, #0
   0xab137e6c <Java_com_flareon_flare_ValidateActivity_validate+8>:     add     sp, r4
   0xab137e6e <Java_com_flareon_flare_ValidateActivity_validate+10>:    str     r2, [sp, #8]
   0xab137e70 <Java_com_flareon_flare_ValidateActivity_validate+12>:    add     r0, sp, #120    ; 0x78
   0xab137e72 <Java_com_flareon_flare_ValidateActivity_validate+14>:
[...removed...]
(gdb) b Java_com_flareon_flare_ValidateActivity_validate
Breakpoint 1 at 0xab137e74
(gdb) c
Continuing.

At this stage, the android application runs in my emulator and I'm able to provide a string in the text field. When I click on the "Validate" button, the application freezes because the BP is reached:

Breakpoint 1, 0xab137e74 in Java_com_flareon_flare_ValidateActivity_validate () from /data/flareon/system_lib/libvalidate.so

But from here, I haven't found how I can continue to debug because all of my attempts fail:

(gdb) x/10i $pc
=> 0xab137e74 <Java_com_flareon_flare_ValidateActivity_validate+16>:    bl      0xab138f08
   0xab137e78 <Java_com_flareon_flare_ValidateActivity_validate+20>:
    ldr r1, [pc, #308]  ; (0xab137fb0 <Java_com_flareon_flare_ValidateActivity_validate+332>)
   0xab137e7a <Java_com_flareon_flare_ValidateActivity_validate+22>:    movs    r2, #92 ; 0x5c
   0xab137e7c <Java_com_flareon_flare_ValidateActivity_validate+24>:    add     r0, sp, #28
   0xab137e7e <Java_com_flareon_flare_ValidateActivity_validate+26>:    add     r1, pc
   0xab137e80 <Java_com_flareon_flare_ValidateActivity_validate+28>:    bl      0xab138f18
   0xab137e84 <Java_com_flareon_flare_ValidateActivity_validate+32>:    ldr     r1, [r5, #0]
   0xab137e86 <Java_com_flareon_flare_ValidateActivity_validate+34>:    movs    r3, #169        ; 0xa9
   0xab137e88 <Java_com_flareon_flare_ValidateActivity_validate+36>:    lsls    r3, r3, #2
   0xab137e8a <Java_com_flareon_flare_ValidateActivity_validate+38>:    ldr     r3, [r1, r3]
(gdb) step
Single stepping until exit from function Java_com_flareon_flare_ValidateActivity_validate,
which has no line number information.

Can you please help? Many thanks in advance for your feedback.

Post comment edit:

Thank you for the clarifications regarding the step (step out) vs si (step in) commands, very useful indeed. Maybe the initial post was lacking from clarity. What I would like to do is actually create another breakpoint later in the code but it seems to fail, as depicted below:

(gdb) b Java_com_flareon_flare_ValidateActivity_validate
Breakpoint 1 at 0xab143e74
(gdb) c
Continuing.

Breakpoint 1, 0xab143e74 in Java_com_flareon_flare_ValidateActivity_validate () from /data/flareon/system_lib/libvalidate.so
(gdb) x/20i $pc
=> 0xab143e74 <Java_com_flareon_flare_ValidateActivity_validate+16>:    bl      0xab144f08
   0xab143e78 <Java_com_flareon_flare_ValidateActivity_validate+20>:
    ldr r1, [pc, #308]  ; (0xab143fb0 <Java_com_flareon_flare_ValidateActivity_validate+332>)
   0xab143e7a <Java_com_flareon_flare_ValidateActivity_validate+22>:    movs    r2, #92 ; 0x5c
   0xab143e7c <Java_com_flareon_flare_ValidateActivity_validate+24>:    add     r0, sp, #28
   0xab143e7e <Java_com_flareon_flare_ValidateActivity_validate+26>:    add     r1, pc
   0xab143e80 <Java_com_flareon_flare_ValidateActivity_validate+28>:    bl      0xab144f18
   0xab143e84 <Java_com_flareon_flare_ValidateActivity_validate+32>:    ldr     r1, [r5, #0]
   0xab143e86 <Java_com_flareon_flare_ValidateActivity_validate+34>:    movs    r3, #169        ; 0xa9
   0xab143e88 <Java_com_flareon_flare_ValidateActivity_validate+36>:    lsls    r3, r3, #2
   0xab143e8a <Java_com_flareon_flare_ValidateActivity_validate+38>:    ldr     r3, [r1, r3]
   0xab143e8c <Java_com_flareon_flare_ValidateActivity_validate+40>:    adds    r0, r5, #0
   0xab143e8e <Java_com_flareon_flare_ValidateActivity_validate+42>:    ldr     r1, [sp, #8]
   0xab143e90 <Java_com_flareon_flare_ValidateActivity_validate+44>:    movs    r2, #0
   0xab143e92 <Java_com_flareon_flare_ValidateActivity_validate+46>:    blx     r3
   0xab143e94 <Java_com_flareon_flare_ValidateActivity_validate+48>:    subs    r6, r0, #0
   0xab143e96 <Java_com_flareon_flare_ValidateActivity_validate+50>:
    beq.n       0xab143eac <Java_com_flareon_flare_ValidateActivity_validate+72>
   0xab143e98 <Java_com_flareon_flare_ValidateActivity_validate+52>:    bl      0xab144f28
   0xab143e9c <Java_com_flareon_flare_ValidateActivity_validate+56>:    cmp     r0, #46 ; 0x2e
   0xab143e9e <Java_com_flareon_flare_ValidateActivity_validate+58>:
    bhi.n       0xab143eac <Java_com_flareon_flare_ValidateActivity_validate+72>
   0xab143ea0 <Java_com_flareon_flare_ValidateActivity_validate+60>:    movs    r2, #0
(gdb) b 0xab143e80
Function "0xab143e80" not defined.
Make breakpoint pending on future shared library load? (y or [n]) y
Breakpoint 2 (0xab143e80) pending.

As you can see, when I try to set a second BP at 0xab143e80, it says the function is not defined. Even if I force the creation of this BP, it is never reached.

My question is: once I am at the 1st breakpoint, how can I set another breakpoint (say for example at 0xab143e80)?

Improve this question
1
  • I'm not sure why you say " it seems that I'm not able to set other breakpoints within this library", since 0xab137e74 seems to be well within your library, and gets hit when library code is executed, not when the library is loaded. Your problem might be that you use step, which tries to step over one line of source code, which isn't available. Try stepi instead to step over one line of assembly, resp. to the start of the function at 0xab138f08. Or, set a breakpoint at 0xab138f08, then step or continue the program.
    – Guntram Blohm
    Commented Oct 7, 2015 at 13:19

1 Answer 1

Reset to default
3

Answer to your first question

Googling for gdb step yields https://sourceware.org/gdb/onlinedocs/gdb/Continuing-and-Stepping.html as the first result. From that page:

Warning: If you use the step command while control is within a function that was compiled without debugging information, execution proceeds until control reaches a function that does have debugging information. Likewise, it will not step into a function which is compiled without debugging information. To step through functions without debugging information, use the stepi command, described below.

Since the binary likely wasn't compiled with debugging information, you need to use stepi instead of step, as @guntram-blohm suggested in his comment above.

Answer to your second question

b 0xab143e80 is not the correct syntax to set a breakpoint on an address; you need to use b *0xab143e80.

Please refer to https://sourceware.org/gdb/onlinedocs/gdb/ for further questions on gdb usage and command syntax.

Improve this answer
3
  • Thanks a lot for your comments Guntram and Jason. I have completed my initial post to bring some more clarity about my question. I hope you can help... Anyway, thanks a lot to both of you for these inputs already.
    – Sebastien Damaye
    Commented Oct 7, 2015 at 14:19
  • I've updated my answer above to address both of your questions.
    – Jason Geffner
    Commented Oct 7, 2015 at 14:27
  • You're right! Damn, that was so simple :) Thanks a lot!
    – Sebastien Damaye
    Commented Oct 7, 2015 at 14:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.