7

I'm new to debugging with IDA Pro and I ran into the problem that my breakpoint is not hit while attempting to debug with gdbserver. The program is written by myself and it is simple to debug with gdb. Can someone please help me regarding debugging with IDA? Here are the steps I perform for debugging:

  1. Start gdbserver version 7.7 configured as "x86_64-linux-gnu" in a terminal on my localhost like so:

    $ gdbserver --multi localhost:1234
    Listening on port 1234
    
  2. Open a new database in IDA Pro version 6.6, set a breakpoint in the code, chose the "Remote GDB Debugger" and start a new process. The IDA output window shows the following message:

    FFFFFFFFFFFFFFFF: process /home/benny/3-challenge has started (pid=0)
    FFFFD8F8: got SIGTRAP signal (Trace/breakpoint trap) (exc.code 5, tid 27171)
    
  3. A Warning pops up in IDA giving me the following message:

    FFFFD8F8: got SIGTRAP signal (Trace/breakpoint trap) (exc.code 5, tid 27171)
    
  4. The terminal where the gdbserver is running shows the following message:

    Remote debugging from host 127.0.0.1
    Process /home/benny/3-challenge created; pid = 27171
    

I guess the SIGTRAP may already be a problem, however, I don't understand why I get it. What am I doing wrong?

Anyway going further by ignoring the warning:

  1. The IDA Debug View shows the RIP at memory position FFFFD8F8 which is in an unexplored region of the binary: MEMORY:FFFFD8F8 db ?;

  2. Press F9 in IDA pops-up an "Exception Handling" dialog, which looks like this enter image description here

  3. Click "Yes (pass to app)", which terminates the execution of the debugging session and the IDA output window prints

    Debugger: process has exited (exit code 5)
    

While the output on the terminal running gdbserver prints

Child terminated with signal = 0x5 (SIGTRAP)
readchar: Got EOF
Remote side has terminated connection.  GDBserver will reopen the connection.
Listening on port 1234

Please let me know if you need more info.

UPDATE: I got fed up with GDB server and am now using Intel PIN for debugging, which works like a charm with IDA Pro.

3
  • What are you debugging? It might hold some anti-debugging methods.
    – Stolas
    Aug 27, 2014 at 10:07
  • As I said in the second sentence of my question: "The program I am debugging is written by myself". It is extremely simple and doesn't contain anti-debugging methods.
    – Benny
    Aug 27, 2014 at 16:18
  • oops missed that. Sorry, can you share it so I can try to reproduce it on my boxes?
    – Stolas
    Aug 28, 2014 at 5:24

1 Answer 1

3

The SIGTRAP is generally raised by a debug break exception (int 3).

When IDA receives it, it's asking you whether to pass it to the program (unhandled). If you do, and you do not have a signal handler installed for SIGTRAP, the program will die with a SIGTRAP error, as you see.

You want IDA to discard the exception, and continue execution (if you want to continue) or suspend to investigate state in IDA.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.