Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

A source level debugger based on `ptrace` for *NIX systems and developed by the GNU project.

1
vote
0answers
31 views

Can't trace MIPS embedded device remotely

I'm trying to debug a remote device using gdbserver and IDA Pro. I'm attached to the correct PID and I'm able to step through instructions until the point where I redirect $pc to my ROP chain. At the ...
9
votes
4answers
707 views

How can breakpoint be set using offset in ELF file, not virtual address?

First, generate a simple executable. (ignore the warnings, the executable runs anyway) echo 'main(){puts("123");}'|gcc -x c - -o a Load it with gdb a, then: (gdb) info file Symbols from "/home/...
3
votes
1answer
56 views

Run a python command with “run” on GDB

Hi I'd like to run a python command python -c 'print "\x90"*52' when the program start in GDB, as I would do when I execute : python -c 'print "\x90"*52' | ./myProg . Does anyone knows any way to ...
1
vote
2answers
107 views

How to assemble and inject an instruction with GDB?

GDB has a x/i command (and also disassemble) which allows to view the instructions at a given address. How can we do the reverse – assemble an instruction and write to a given address?
3
votes
1answer
136 views

Buffer overflow challenge - shell not opening

I'm working on a buffer overflow CTF challenge. The binary for this challenge includes a give_shell function (they cover shellcode in the next challenge) I can successfully overwrite the saved EIP on ...
0
votes
1answer
57 views

Basic question: how to input non-printable hex values in GDB / NC?

I'm working on a CTF challenge that is an introduction to smashing the stack. I have the binary working in GDB, and can overwrite the correct part of the stack with printable characters. The ...
1
vote
1answer
243 views

Cannot Access memory error

I am trying to debug a simple buffer overflow program using gdb . I analyzed the program on windows without any issues .But now i am using linux gdb with exact same program but i am getting "Cannot ...
1
vote
1answer
59 views

Question about gdb and memory addresses

i am trying to use gdb to analyse a c program but i am a little confused. in the above picture you can see i am trying to analyse the stack . On the left we have memory addresses.Since i am using a ...
0
votes
1answer
119 views

Radare2 cannot debug on windows 7

I downloaded radare 2.5 for windows. I am trying to debug a binary on windows with radare and have tried the following: radare2 -d a.exe fork_and_ptraceme/CreateProcess: The request is not supported. ...
1
vote
0answers
34 views

Redirecting gdb output to stdout wihile using pwndbg

I am using pwndbg plugin with gdb. When any program that prints to stdout is run under gdb, I seem to not being able to see the output from the program during the debugging session. How can I redirect ...
1
vote
1answer
74 views

Break anywhere when $r1 equals to string GDB

Is there anyway to break on gdb where $r1 equals to a certain string I know there is : break [addr] if ((int)strcmp($r1, "hello")) == 0 But what to set in addr when I just wanna break when the r1 is ...
1
vote
1answer
134 views

How to set breakpoints in GDB on remote target without an executable?

I'm trying to use a gdb client running on my host machine to talk to a GDB server running on a debug probe. I can connect using the "target remote" command, and I can single step, use monitor ...
0
votes
0answers
63 views

Set a Breakpoint in an executable type dynamic (ET_DYN)

I am trying to debug an executable marked as a shared object. I know the trick of run it in GDB and stop with CTRL+C, and other tricks from the question How to handle stripped binaries with GDB? No ...
1
vote
0answers
116 views

Stack buffer overflow SIGSEGV help

I've been going at this for a couple of days now working through trial and error but I can't seem to pinpoint exactly why I'm still getting a SIGSEGV. Here's the stdout of me stepping through the ...
2
votes
1answer
109 views

Debugging Binary using Far Ret to switch Code Segment

It appears that GDB is unable to handle binaries which switch code segments. Using pwntools*, it's trivial to generate a 32-bit intel binary which uses retf to switch to the 64-bit code segment. ...
3
votes
2answers
420 views

Password Bruteforce using angr

I am having a binary which takes an input from user and checks every bit of our character using the check_value function which does some stuff. The disassembly of the interested function is: .text:...
6
votes
0answers
256 views

Generating symbol file for closed-source binary by hand

I have a closed-source binary (minecraft-pi). For a given section of the assembly like so: a2ed4: e92d45f8 push {r3, r4, r5, r6, r7, r8, sl, lr} a2ed8: e1a04000 mov ...
1
vote
0answers
305 views

My core dump's backtrace stops to a signal handler, what can I do?

I obtained an ELF core dump that was provoked by fuzzing a proprietary server. As I do not have access anymore to the machine that hosted this server, and the server is part of a tightly coupled set ...
1
vote
1answer
339 views

Why does my shellcode work in gdb but not on the command line

So I just started with reverse engineering and have run into some issues until I recently noticed something strange. I wrote an extremely simple shellcode (exit system call) for practice and I played ...
6
votes
1answer
757 views

Understanding gdb output

So I was messing with gdb and came across something rather interesting. I ran the following code into gdb: int i, g = 1; for (i = 0; i < 100; i++) g++; Before execution, disas main ...
0
votes
0answers
102 views

gdb: How to determine if a function in a .so is ever used in an app

Newbie question about using gdb: I know how to set a breakpoint for a function in a .so file that is actually called from the app using the .so file. This can be done, for instance, using: b ...
1
vote
1answer
246 views

Debugging EXE File in Windbg and How to set Breakpoints in Assembly

I am trying to set a breakpoint (created in assembly) and step into an EXE file line by line to watch registers and memory behavior. I have done this easily with gdb under Linux like this. gdb -q ./...
1
vote
2answers
148 views

Added instruction to shellcode

I have the following shellcode: xor eax, eax ; eax = 0 push eax ; 0 (end of the string) push 0x68732f2f ; //sh push 0x6e69622f ; /bin mov ebx, esp ; ebx = &(/bin//sh) xor ecx, ecx ...
1
vote
1answer
232 views

gdb-multiarch Segmentation fault

I've followed the guide from Cross debugging for MIPS ELF with QEMU/toolchain to cross compile a simple hello world application, but for some reason I get a segmentation fault when opening it with gdb-...
4
votes
2answers
257 views

ASM working as is, but not in a C program

I have this piece of ASM: section .text global _start _start: xor eax, eax push eax ; 0 to finish the /bin//sh string push 0x68732f2f ; //sh push 0x6e69622f ; /bin ...
2
votes
0answers
465 views

IDA Pro GDB QEMU Tricore setup

I have added the lines below to IDA 6.95\cfg\gdb_arch.cfg to try to get QEMU Tricore debugging in IDA Pro, using an ARM tutorial as the basis (page 2): https://www.hex-rays.com/products/ida/support/...
1
vote
2answers
481 views

Understanding an if statement in assembly

I have written two simple C programs (one with an if and one without). Looking at the assembly differences there are a few lines that I can't manage to explain and was hoping to get some assistance. ...
1
vote
1answer
263 views

Loading user specified IDA symbols in GDB

While reversing a binary, whatever symbols we name inside IDA IDB database, is it possible to load the same in GDB while debugging? e.g. I tried wsym which attempts to inject those as symbols. However,...
-1
votes
1answer
176 views

Practicing what SHOULD be a simple crackme. Program calls strlen() but never returns

I'm trying out a crackme from the "LSE CTF" called "Blue Box" worth only 10 points. I've attempted this inside GDB and radare2... It is very simple, takes one argument and first checks to make sure ...
-1
votes
1answer
159 views

Disassembling code with Hopper

I'm trying to figure out what this code is doing. The first thing that I don't understand is the condition that tests if arg0's value is 0x2. I read that 0x2 in ASCII is STX (Start of text). Here's ...
2
votes
1answer
797 views

How to read canary value in gdb?

In a program I am debugging, the canary value is read to eax from gs:0x14 memory location. I am attaching gdb to the process late enough to break on the mov reading the canary to eax. Therefore, ...
1
vote
0answers
71 views

What does 'mapped' memory region mean in gdb-peda?

I was reading a write-up of a binary exploitation where I came across the following: What does the mapped keyword listed under Name column mean? What sort of memory region does it refer to?
1
vote
1answer
259 views

Why can't gdb read memory if pwntools is used to send input?

Here is the program which gdb is attached to: prog.c #include <stdio.h> void dummy(char* s) { } int main() { char buf[512]; scanf("%s", buf); printf("%s\n", buf); dummy(buf);...
2
votes
2answers
1k views

Changing Entrypoint in ELF executable

I wrote some code that does the following: Searches for and finds an offset in a binary file to add code (looks for a sequence of 00s I can overwrite). Then, I change the entrypoint of the ELF to ...
1
vote
0answers
121 views

Find string in stripped binary file use gdb

Does this debugger support this feature? Through find it is impossible, as the file stripped.
0
votes
0answers
67 views

Transferring control of ptrace to another process

I have a program that runs fine most of the time, but all of a sudden "overheats". When this happens, all of a sudden resources just go up rapidly in a matter of seconds until the system locks up. I ...
3
votes
2answers
304 views

Why is there a difference in offset between ida and gdb?

A PIE binary, when loaded in IDA shows an offset (0x202010) different from gdb (0x2013a1) for instruction located at 0x555555554c68 in (gdb) and 0xc68 (in IDA). How can I explain this discrepancy?
1
vote
0answers
153 views

Solve problem with debugging Linksys-wrt54gl with JTAG using BusPirate programmer

I am getting this output when I am issuing this command: $ sudo openocd -f board/MyBuspirate.cfg -f board/linksys-wrt54gl.cfg Open On-Chip Debugger 0.10.0+dev-00092-g77189db (2017-02-25-13:44) ...
5
votes
1answer
335 views

QEMU gdb server thread problem

I am having a problem using a statically compiled QEMU arm version. I am trying to debug an application from an embedded device. Everything seems to work fine except breakpoints on other threads. I am ...
3
votes
1answer
325 views

Buffer overflow on server

I have a server (for reference: pastebin.com/ghJX69uH) that I can netcat to and it will ask to input a message. I know it is vulnerable to buffer overflow, but I can't seem to get the shellcode to ...
1
vote
1answer
226 views

How can I change the values in esp?

0x08048785 <+344>: movl $0x0,0xc(%esp) 0x0804878d <+352>: movl $0x804896c,0x8(%esp) 0x08048795 <+360>: movl $0x8048973,0x4(%esp) 0x0804879d <+368>: movl ...
0
votes
1answer
278 views

Given a heap address, can gdb show which function allocated the heap at this address?

In windbg, we can use "!heap -p -a [address]" to show the stacktrace when the heap was allocated. In gdb, especially for kernel debugging, there is any way to achieve the same thing in linux?
4
votes
0answers
284 views

GDB find string strange results

I'm playing with gdb and strange things are happening. I wanted to find some address in memory where string "/bin/sh" is located, and gdb says it found it. But when I examine the memory there, the ...
1
vote
1answer
175 views

I have a problem with understanding the register %bl

0x080484ad <+0>: xor %ebx,%ebx 0x080484af <+2>: mov (%eax),%bl ***** 0x080484b1 <+4>: xor $0x52,%bl 0x080484b4 <+7>: cmp $0x11,%bl ...
1
vote
1answer
654 views

GCC change the order of variable declaration

I have this very simple piece of code: // test.c int main(){ int a = 0; char b[10]; int c = 0; return 0; } Compiled with gcc (6.2.1): $ gcc -g -o test test.c And analysed with gdb: $ gdb ...
3
votes
1answer
338 views

Why doesn't the breakpoint get hit in gdb?

I was following the writeup of the challenge tehran. If I set a breakpoint 0x804bade, it never gets hit for the following input. begin() { fillout(0x8048000, 16384, 7); puts("%144c%n", 42, ...
0
votes
1answer
207 views

Why can't gdb find symbol which IDA can?

I was reversing this binary. While I tried to set a breakpoint in gdb on main function, it couldn't find its definition. Loading up the same binary in IDA shows up main method in the Function pane. ...
1
vote
1answer
1k views

Passing argument through registers instead of the stack

I'm learning (and re-learning) C and assembly, and I came across a difference between what I've been taught and the actual result I have. Some code: int test(int a, int b){ return a + b; } int ...
0
votes
1answer
75 views

why 'ni' goes into function in Android gdb debugging?

I'm debugging android JNI with gdb without source code. I use ni command to step over arm asm instructions. I suppose ni is step over, but it still goes into function like BL xxxx, and I have to use ...
0
votes
0answers
155 views

step over 8-byte-instruction in android arm code cause SIGILL

I'm debugging android jni with gdb, trying to single step through BLX snprintf, but the debug session crashes with SIGILL. Here's the code in gdb: The first line blx 0x9d857ad0 is actually BLX ...