1

I'm currently practicing some RE w/ GDB and am having issues simply stopping the run/start on the first/second instruction. I am new to GDB/RE and have a limited knowledge of some of GDB's inner workings. So far when I open the program I have done:

(gdb) set disassembly-flavor intel
(gdb) file /path/to/binary
(gdb) info file
Symbols from "/path/to/binary".                                                                                                
Local exec file:                                                                                                          
    `/path/to/binary', file type elf32-i386.                                                                               
    Entry point: 0x8048450
    .
    .
    .
(gdb) b *0x8048450
(gdb) start
Temporary breakpoint 2 at 0x80485f7                                                                                       
Starting program: /path/to/binary                                                                                              
During startup program exited with code 1.

So clearly setting the breakpoint at the entry point is not useful. Below is the output of the command :

 objdump /path/to/binary -M intel -D

At the preceeding memory address.

08048450 <_start>:
 8048450:       31 ed                   xor    ebp,ebp
 8048452:       5e                      pop    esi                                                                        
 8048453:       89 e1                   mov    ecx,esp                                                                    
 8048455:       83 e4 f0                and    esp,0xfffffff0                                                             
 8048458:       50                      push   eax                                                                        
 8048459:       54                      push   esp                                                                        
 804845a:       52                      push   edx                                                                        
 804845b:       68 c0 86 04 08          push   0x80486c0                                                                  
 8048460:       68 60 86 04 08          push   0x8048660                                                                  
 8048465:       51                      push   ecx                                                                        
 8048466:       56                      push   esi                                                                        
 8048467:       68 e9 85 04 08          push   0x80485e9                                                                  
 804846c:       e8 bf ff ff ff          call   8048430     <__libc_start_main@plt>                                            
 8048471:       f4                      hlt                                                                               
 8048472:       66 90                   xchg   ax,ax                                                                      
 8048474:       66 90                   xchg   ax,ax                                                                      
 8048476:       66 90                   xchg   ax,ax                                                                      
 8048478:       66 90                   xchg   ax,ax                                                                      
 804847a:       66 90                   xchg   ax,ax                                                                      
 804847c:       66 90                   xchg   ax,ax                                                                      
 804847e:       66 90                   xchg   ax,ax

My overall goal is to jump to a specific function in the program using the b *Mem, jump *Mem technique and execute the code w/in that function. In order to do this however I need to be able to stop the program while it is running I believe.

3

From http://www.delorie.com/gnu/docs/gdb/gdb_29.html:

GDB normally ignores breakpoints when it resumes execution, until at least one instruction has been executed. If it did not do this, you would be unable to proceed past a breakpoint without first disabling the breakpoint. This rule applies whether or not the breakpoint already existed when your program stopped.

You might just get bitten by this; when loading, gdb puts the instruction pointer at the first instruction, and it won't break on this when starting the program.

According to this question and answer, this seems to be dependent on the version of gdb you're using, and disabling ASLR might help (i don't think that happens in your case though, since you checked the entry point after loading the specific instance of your program).

But i found this question that has a trick to break on the very first instruction that's getting executed; when i tested it, it even stopped within the dynaloader before passing execution to the entry point.

Still, i fail to see why you absolutely need to have a breakpoint at the entry point. If you want to change anything before the program executes its first instruction, just do it before running your program. You could, for example, change the instructions at the entry point to jmp my_special_function, which will probably need a few more bytes than just one instruction at _start, and have your special function end in the 4 instruction before the push, then jmp to 8048458. You can do all this after loading the program and run it afterwards.

  • so there is some command that can manipulate the bytes in a binary file w/in gdb, therefore allowing me to make an unconditional jump to the address of my function? That seems a little far-fetched, could you help my understanding some more? – user1234567878787 Oct 12 '15 at 19:24
  • You can use something like set {char} 0x8048450=0xeb to modify single bytes. This works for other data types as well. This won't change the file, it will change the loaded version of the binary. – Guntram Blohm Oct 12 '15 at 19:54
  • 1
    But see the link i just added to the answer (reverseengineering.stackexchange.com/questions/8724/…), it has a trick that allows you to stop on the very first instruction executed even if gdb doesn't honor breakpoints there. When i tried it, it stopped within the dynaloader even before jumping to the entry point. – Guntram Blohm Oct 12 '15 at 19:58
  • Followed the link and attempted their solution w/ the same result as before, no luck. I am curious do you know why gdb outputs 'During startup program exited with code 1.' ? Is that likely bc the return value of the program is 1? – user1234567878787 Oct 12 '15 at 20:25
  • @user1234567878787 GDB will modify the bytes in RAM and not on disk. One real annoyance is that when you set breakpoints, GDB does not deal well with self modifying code. – Milhous Oct 13 '15 at 1:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.