1

Is there anyway to break on gdb where $r1 equals to a certain string I know there is :

break [addr] if ((int)strcmp($r1, "hello")) == 0

But what to set in addr when I just wanna break when the r1 is "hello" no matter the address?

  • ask on Stackoverflow – julian Mar 28 '18 at 21:12
1

Python api in GDB is very convenient to script such solutions. Although the api is a little "wild", I refer to pwndbg on how to use the api. I wrote the following for x86_64 to break only when the first param matches "pol". Full code here

import gdb

class MyBreakpoint (gdb.Breakpoint):
    def stop (self):
        rdi = int(gdb.parse_and_eval("$rdi").cast(gdb.lookup_type('uint64_t')))
        print("x(%x)" % (rdi)), 
        result = gdb.selected_inferior().read_memory(rdi, 10)
        if b'\x00' in result:
            result = bytearray(result).split(b'\x00')[0]
        if result == b'pol':
            return True
        return False

MyBreakpoint("x")
  • Thank you for your help, but what is the difference between your script and break x if ((int)strcmp($rdi, "pol")) == 0" ? I would like to break anywhere not just X just break when r1 is equal to a string no matter in which function i am isnt that possible ? – Neolex Mar 29 '18 at 13:31
  • iirc gdb has no such feature. However you can use Intel PIN and instrument on the instructions where r1 is changed. Your other option is just to fetch all the instructions which change r1 in a disassembler and set conditional breakpoints. – sudhackar Mar 30 '18 at 4:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.