7

I am trying to analyze a crackme file.

When I open it with gdb, I firstly set its SIGTRAP handler with, e.g., int80.SIGTRAP handler address 0x8011111.

I caught it through catch syscall signal in gdb. And, there are some traps in the application, some int3 interactions.

0x80abcde - int3

My gdbinit file is set like this:

b * 0x80abcde
commands 1
call (void)0x8011111(5)
continue
end

Is this okay for emulation or do I need to still push the calling address on the stack ?

1 Answer 1

6

You could use the handle command instead, to pass the signal to the application. Maybe with something like:

handle SIGTRAP nostop print pass

GDB will:

  • Not stop on SIGTRAP
  • Pass it to the application
  • Tell you when it get a SIGTRAP
1
  • i have 2 questions also.When i change the handle , how could i stop on my own breakpoints ? HW bps are ok for this ? When i changed the handle like you said , gdb prints "Program terminated with SIGTRAP" , what do you think about this ? Oct 29, 2013 at 17:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.