I want to modify my teamspeak server (linux), I'm particulary interested in the connection with clients (UDP), so I figured I need to set a breakpoint at the linux socket function to start reversing. How can I achieve this?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
gdb you can set a syscall breakpoint with
If this is in 32-bit x86 (IA-32), check the syscall number in
your_linux_source_dir/usr/include/asm/unistd_32.h. There is no syscall called
socket in 32-bit x86, do you mean
socketcall? Its number is 102.
If this is in x86-64 (AMD64), check the syscall number in
your_linux_kernel_source_dir/usr/include/asm/unistd_64.h. The syscall called
socket is 41.
Then run the executable in
$ gdb myexecutable
And set the syscall breakpoint (41 is the
socket syscall number in x86-64, change to appropriate syscall number for you):
(gdb) catch syscall 41
And then run the program:
Using the name of syscall (such as
socket) instead of the number (eg.
41) may also work, depending on your configuration.