1

I'm trying to run this armv5 binary from OWASP's mobile security guide (validate) using Android Studio's emulator on my x86_64 machine. I'm seeing very weird behaviour and would appreciate any guidance!

If I run the program

$ adb push validate /data/local/tmp
$ adb shell /data/local/tmp/validate AAAAAAAAAAAAAAAA
Entering base32_decode
Outlen = 10
Entering check_license
Incorrect serial.

It works as expected.

The issue arises when I attach gdbserver to the process and attempt to debug it over the network with gdb running on my x86_64 machine (Ubuntu 18.04).

Run under GDBserver

$ adb root
$ adb forward tcp:8888 tcp:8888
$ adb push validate /data/local/tmp
$ adb shell gdbserver --version
GNU gdbserver (GDB) 7.11
$ adb shell gdbserver :8888 /data/local/tmp/validate

Connect with GDB from host (Ubuntu 18.04 x86_64)

$ ~/Android/Sdk/ndk/20.0.5594570/prebuilt/linux-x86_64/bin/gdb --version
GNU gdb (GDB) 7.11
$ ~/Android/Sdk/ndk/20.0.5594570/prebuilt/linux-x86_64/bin/gdb

gdb$ target remote :8888
gdb$ break *(0x2a000000 + 0x3bc) # Set breakpoint in main function
gdb$ c
Program received signal SIGSEGV, Segmentation fault.
0x2a0003c0 in ?? ()

Upon further inspection, it seems that the reason it fails, is because GBD fails to restore the instruction at the breakpoint to it's original value after mangling it to facilitate the breakpoint.

Try with hardware breakpoint instead

gdb$ hbreak *(0x2a000000 + 0x3bc)

No SIGSEGV this time, but now if we try to step with

gdb$ nexti

It doesn't increment the program counter

Even if we clear the break points, it's still stuck on that one instruction and there doesn't appear to be any way to make gdb continue execution.

Android Image Details (taken from Android Studio AVDManager)

  • Name: Pixel_3_XL_API_25_armeab-v7a
  • CPU/ABI: Google APIs ARM (armeabi-v7a)

Aditional notes

  • gdb sets the architecture to armv5te so it's probably not related to gdb not supporting the architecture
  • I've tried a few other versions of gdb (7.11, 8.1, 8.3) compiled with ARM support, none work and the behaviour is inconsistent between versions
  • I've tried gdbserver versions 7.11 and 8.3, neither made a difference
  • The steps outlined above work fine when the android image is x86, they only fail if it's ARM.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.