3

I would like to debug my elf file on linux using GDB and follow the disassembly in IDA, is this possible? And if it is how would I rebase IDA to match with GDB?

Thanks!

3

If you are trying to rebase an elf, you could do info proc mappings. This will show you all of the mapped addresses. (This could also be viewed by doing cat /proc/<pid>/map)

Then just rebase your IDA via EDIT->Segments->Rebase program and select Image Base from the radio buttons.

Ex:

(gdb) info proc mappings 
process 12383
Mapped address spaces:
    Start Addr   End Addr       Size     Offset objfile
     0x8048000  0x8049000     0x1000          0      /home/user/my_elf
     0x8049000  0x804a000     0x1000          0      /home/user/my_elf
     0x804a000  0x804b000     0x1000     0x1000      /home/user/my_elf
    0xb7e73000 0xb7e74000     0x1000          0
    0xb7e74000 0xb7fbd000   0x149000          0     /lib/i386-linux-gnu/libc-2.13.so
    0xb7fbd000 0xb7fbe000     0x1000   0x149000     /lib/i386-linux-gnu/libc-2.13.so
    0xb7fbe000 0xb7fc0000     0x2000   0x149000     /lib/i386-linux-gnu/libc-2.13.so
    0xb7fc0000 0xb7fc1000     0x1000   0x14b000     /lib/i386-linux-gnu/libc-2.13.so
    0xb7fc1000 0xb7fc4000     0x3000          0
    0xb7fdf000 0xb7fe1000     0x2000          0
    0xb7fe1000 0xb7fe2000     0x1000          0           [vdso]
    0xb7fe2000 0xb7ffe000    0x1c000          0     /lib/i386-linux-gnu/ld-2.13.so
    0xb7ffe000 0xb7fff000     0x1000    0x1b000     /lib/i386-linux-gnu/ld-2.13.so
    0xb7fff000 0xb8000000     0x1000    0x1c000     /lib/i386-linux-gnu/ld-2.13.so
    0xbffdf000 0xc0000000    0x21000          0           [stack]

If I would be looking at the elf in IDA i would use 0x8048000 for the base. If I would be looking at libc-2.13.so I would use 0xb7e74000.

Hope that helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.