I am trying to solve a reverse engineering challenge using using gdb
. I can run the program inside it but when I set a breakpoint at main
then I get
Program received signal SIGSEGV, Segmentation fault.
Setting it at something even earlier like _init
(there are two BTW) also was not very fruitful, could it be that the program might be corrupting itself at some point that I didn't catch? Have a look at the backtrace
for that matter:
#0 0x47048474 in ?? ()
#1 0x0804864a in __handle_global_ctors ()
#2 0x080488c5 in __do_global_ctors_aux ()
#3 0x08048349 in _init ()
Now I tried to statically decompile it using a simple recursive traversal disassembler (not IDA) but I couldn't find any traces of CC
(INT 3) so I guess another layer of obfuscation has been added.
I also tried record
with no success:
Breakpoint 5, 0x0804833a in _init ()
(gdb) record
(gdb) c
Continuing.
(null)Process record: failed to record execution log.
Oh and I couldn't find the hex string "47048474" either.
Any more ideas what can help in such a situation? Maybe detecting the self-modification?
ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.4.1, not stripped
)hbreak
to work. Finally I can continue.