I am trying to solve a reverse engineering challenge using using
gdb. I can run the program inside it but when I set a breakpoint at
main then I get
Program received signal SIGSEGV, Segmentation fault.
Setting it at something even earlier like
_init (there are two BTW) also was not very fruitful, could it be that the program might be corrupting itself at some point that I didn't catch? Have a look at the
backtrace for that matter:
#0 0x47048474 in ?? () #1 0x0804864a in __handle_global_ctors () #2 0x080488c5 in __do_global_ctors_aux () #3 0x08048349 in _init ()
Now I tried to statically decompile it using a simple recursive traversal disassembler (not IDA) but I couldn't find any traces of
CC (INT 3) so I guess another layer of obfuscation has been added.
I also tried
record with no success:
Breakpoint 5, 0x0804833a in _init () (gdb) record (gdb) c Continuing. (null)Process record: failed to record execution log.
Oh and I couldn't find the hex string "47048474" either.
Any more ideas what can help in such a situation? Maybe detecting the self-modification?
ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.4.1, not stripped)
hbreakto work. Finally I can continue.