0

Sorry English isn't my first language.

I noticed something when setting breakpoints in GDB. It appears that they are ignored if symbols aren't loaded.

I have found it weird how GDB behaves when there are no symbols at all loaded and if I want to debug something I am having to set a break point at __libc_start_main@plt and nexti until I reach a the main binary. I also noticed that I cannot disassemble there in the main binary either (I receive this odd message "No function contains program counter for selected frame."), but that aside it break points are essentially ignored. I have found an odd work around and that is setting

set *0x56555878 = 0xcc 

My questions are:

  • Why does GDB behave so weirdly without symbols?
  • Why do normal for breakpoints fail to be recognized?
  • Is setting my desired breakpoints to 0xcc and then resting; Is this a good practice?
  • Is there a better way to set breakpoints?
  • Why can I not disassemble without Why can I not disassemble without symbols?

Edit: It looks like I cannot set *breakpoints in glibc but I can when I land in int main() program , But while in the int main() , I lose ability to disassemble.

1 Answer 1

4

gdb is primarily a Source Level Debugger

to set a bp on an address instead of symbol use *

(gdb) break main
Breakpoint 1 at 0x100401094: file mingtest.cpp, line 4.
(gdb) break *0x100401094
Note: breakpoint 1 also set at pc 0x100401094.
Breakpoint 2 at 0x100401094: file mingtest.cpp, line 4.
(gdb)

you can disassemble using address, length at any arbitrary addresss

(gdb) disassemble 0x100401094,+0x10
Dump of assembler code from 0x100401094 to 0x1004010a4:
   0x0000000100401094 <main(int, char**)+20>:   mov    edx,DWORD PTR [rbp+0x10]
   0x0000000100401097 <main(int, char**)+23>:   lea    rcx,[rip+0x1f62]        # 0x100403000
   0x000000010040109e <main(int, char**)+30>:   call   0x100401110 <printf>
   0x00000001004010a3 <main(int, char**)+35>:   mov    DWORD PTR [rbp-0x4],0x0
End of assembler dump.
(gdb)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.