0

I'm trying to open an exe with gdb but although it seems to run I'm unable to list or disas anything. The file is obfuscated, and I may be answering my own question here, with nine rays .net obfuscator.

Does this mean I'm unable to use a debugger or should I be able to open with a debugger such as idapro or gdb but have stuff missing?

When in gdb I run (gdb)file name.exe I get the message 'Reading symbols from name.exe...(no debugging symbols found)...done.'

The output from linux files command is 'PE32 excutable (console Intel 80386 Mono/.Net Assembly, for MS Windows'

Thanks

  • No binary format handler is defined in the Linux kernel for PE binary files. As a result the kernel will not compose a process image in virtual memory from a PE binary. No process image means no debugging since there is nothing for ptrace to attach to. lwn.net/Articles/630727 – julian Apr 11 '18 at 3:42
2

If you just want a quick and dirty raw disassembly of a short snippet, you can load the relevant part of the exe using gdb's restore command. It is easier to first, extract the snippet, for example:

tail -c +4096 the-program-with-the-snippet.exe | head -c 1024 > snippet

Then, you need to start debugging a dummy program and replace its main function with the snippet you want to disassemble. For example::

~/tmp$ gdb -q dummy
Reading symbols from dummy...done.
(gdb) break main
Breakpoint 1 at 0x79f: file dummy.c, line 9.
(gdb) run
Starting program: /home/ale/tmp/dummy 

Breakpoint 1, main (argc=1, argv=0x7fffffffe2b8) at dummy.c:9
9       for (int i = 1; i < argc; ++i)
(gdb) restore snippet binary main
Restoring binary file snippet into memory (0x555555554790 to 0x555555554b90)
(gdb) disass
Dump of assembler code for function main:
   0x0000555555554790 <+0>:     add    %bh,-0x35(%rdi)
   0x0000555555554793 <+3>:     movabs 0xa1cba872a376f272,%eax
   0x000055555555479c <+12>:    jb     0x555555554806 <main+118>
   0x000055555555479e <+14>:    cmp    0x72a270b7(%rdx,%rsi,2),%esp
   0x00005555555547a5 <+21>:    loopne 0x5555555547c2 <main+50>
   0x00005555555547a7 <+23>:    movabs 0xa1cd0572a12b0f72,%eax
   0x00005555555547b0 <+32>:    jb     0x5555555547c2 <main+50>
   0x00005555555547b2 <+34>:    pop    %rsi
   0x00005555555547b3 <+35>:    movabs %eax,0xa1d13272a1cd3a72
   0x00005555555547bc <+44>:    jb     0x5555555547b5 <main+37>
   0x00005555555547be <+46>:    loopne 0x555555554760 <frame_dummy>
   0x00005555555547c0 <+48>:    jb     0x5555555547a6 <main+22>
   0x00005555555547c2 <+50>:    iret   
...
---Type <return> to continue, or q <return> to quit---

Of course, any format information (symbols and the like) is lost.

1

You wouldn't be able to debug a Windows executable on a Linux machine with gdb without installing and configuring components that are required. @SYS_V explained it very well in his comment.

If you want to debug a Windows executable on Linux you have several ways to do so. I recommend you to check out a specific one - Winedbg.


In addition, since you mentioned that you want to debug a .net application I'd suggest you check out de4dot and dnSpy, both are for Windows systems. de4dot can be used to deobfuscate .net obfuscated applications where dnSpy will allow you to decompile and debug .net applications.

Disassembling a .net applications is not a best practice since usually you'll only see the Intermediate Language (CIL/MSIL). .net decompilers are able to show you the original source code of the application.

If you want to decompile .net applications on Linux you can try with ILSpy or Mono decompiler.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.