I would like to debug my elf file on linux using GDB and follow the disassembly in IDA, is this possible? And if it is how would I rebase IDA to match with GDB?
Thanks!
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this communityIf you are trying to rebase an elf, you could do info proc mappings
. This will show you all of the mapped addresses. (This could also be viewed by doing cat /proc/<pid>/map
)
Then just rebase your IDA via EDIT->Segments->Rebase program and select Image Base
from the radio buttons.
Ex:
(gdb) info proc mappings
process 12383
Mapped address spaces:
Start Addr End Addr Size Offset objfile
0x8048000 0x8049000 0x1000 0 /home/user/my_elf
0x8049000 0x804a000 0x1000 0 /home/user/my_elf
0x804a000 0x804b000 0x1000 0x1000 /home/user/my_elf
0xb7e73000 0xb7e74000 0x1000 0
0xb7e74000 0xb7fbd000 0x149000 0 /lib/i386-linux-gnu/libc-2.13.so
0xb7fbd000 0xb7fbe000 0x1000 0x149000 /lib/i386-linux-gnu/libc-2.13.so
0xb7fbe000 0xb7fc0000 0x2000 0x149000 /lib/i386-linux-gnu/libc-2.13.so
0xb7fc0000 0xb7fc1000 0x1000 0x14b000 /lib/i386-linux-gnu/libc-2.13.so
0xb7fc1000 0xb7fc4000 0x3000 0
0xb7fdf000 0xb7fe1000 0x2000 0
0xb7fe1000 0xb7fe2000 0x1000 0 [vdso]
0xb7fe2000 0xb7ffe000 0x1c000 0 /lib/i386-linux-gnu/ld-2.13.so
0xb7ffe000 0xb7fff000 0x1000 0x1b000 /lib/i386-linux-gnu/ld-2.13.so
0xb7fff000 0xb8000000 0x1000 0x1c000 /lib/i386-linux-gnu/ld-2.13.so
0xbffdf000 0xc0000000 0x21000 0 [stack]
If I would be looking at the elf in IDA i would use 0x8048000 for the base. If I would be looking at libc-2.13.so I would use 0xb7e74000.
Hope that helps.