All Questions

Tagged with
Filter by
Sorted by
Tagged with
0
votes
0answers
53 views

How to debug programs that load from another one? with radare2/gdb

I'm reversing engendering a plugin. This plugin is loaded into memory by the main program. I disassemble the plugin with radare2 but I don't know how to debug it. I try with gdb but same problem. I ...
0
votes
1answer
90 views

how watchpoint on register works

GDB has an option to set watchpoint on register*, how does it work ? what happens during context switching ? why the only implementation is for mips ? Is there a way to make it work for lldb also ? *...
0
votes
1answer
152 views

GDB MI output vs. stdout

I am using GDBs machine interface (mi) to write some simple tracers/loggers. Now I ran into the problem of telling apart GDB output from text the target-program itself wrote to stdout. If I look ...
2
votes
2answers
4k views

Find base address and memory size of program debugged in gdb

I want to find out the base address and the imagesize of the program being debugged in gdb. As in, where it got loaded in memory. For shared libraries I can do "info sharedlibrary" and I get very ...
2
votes
1answer
609 views

Custom gdb output

Yesterday i noticed a nice output from dbg while going through a write up on the internet. As am new to dbg i googled a lot as i wanted to make dbg work similar for me. As seen below this ...
2
votes
1answer
3k views

What does Hopper's Debugger Server do?

Hopper offers a GDB/LLDB Debugger Server companion to the standard program. I'm unclear on what this should / can be used for. When I run the debugger server on the same machine that I'm using I see ...
7
votes
1answer
6k views

What is the difference between step into and step over when debugging?

I am using EDB and stepping through the program but I do not even know what the difference in behavior is when doing this. I feel like this is something I should know if I ever have hope of reverse ...
0
votes
2answers
2k views

At which address on the stack or in memory is eax stored after the malloc call? [closed]

Here is my objdump -d snippet with the malloc call and surrounding code. This binary is stripped. dbgLab.bin: file format elf32-i386 080483d0 <malloc@plt>: 80483d0: ff 25 04 a0 04 08 ...
6
votes
1answer
321 views

Attaching gdb to hidden library/process

On OSX I'm trying to debug/attach to a framework that the application unarchives at runtime. The frame work normally resides in the /Resources folder within the application bundle as .gz file. The ...
6
votes
1answer
680 views

Annotating the Stack in GDB?

Is there a GUI (or even a script for the CLI) for GDB that will annotate views of the stack with saved registers, each of the frames, etc? It should be possible to gather this information on each ...
86
votes
1answer
65k views

How to handle stripped binaries with GDB? No source, no symbols and GDB only shows addresses?

I have GDB but the binary I want reverse engineer dynamically has no symbols, that is when I run the file utility it shows me stripped: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), ...
74
votes
16answers
90k views

Decent GUI for GDB

Learning the GDB commands is on my bucket-list, but in the meantime is there a graphical debugger for *nix platforms that accepts Windbg commands, and has similar functionality? For example, the ...
9
votes
1answer
549 views

How does GDB's process recording work?

A curious and useful feature of GDB is process recording, allowing an analyst to step forwards and backwards through execution, writing a continuous log of the changes to program state that allow for ...