Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [gdb]

A source level debugger based on `ptrace` for *NIX systems and developed by the GNU project.

Filter by
Sorted by
Tagged with
0
votes
0answers
9 views

Arrangement of variables on the stack - out of order?

I was practicing some reverse engineering crack-mes as part of our university curriculum, and I have a question around the arrangement of variables on the stack. I have a very basic C++ code, like ...
0
votes
1answer
26 views

What's wrong with my mitm to support rr commands with gdbserver on IDA?

First of here is the gdb remote protocol doc. The idea of the below script is the following - you enter an actual command (one that will be send as a direct packet see packets) in the gdb window then ...
2
votes
2answers
66 views

gdb shows that EBP contains a value other than some address(which is what it is supposed to contain). How is this possible?

I am fairly new to RE and Binary Exploitation, I have learned basic assembly instructions for Binary Exploitation and I was doing Protostar exercises (stack0) in which I have to simply overflow the ...
0
votes
0answers
24 views

<error sending command to monitor>

I'm trying to debug a backtrace created with rr so I type: rr replay -s 50505 -k it displays out: gdb '-l' '10000' '-ex' 'set sysroot /' '-ex' 'target extended-remote 127.0.0.1:50505' target Then ...
1
vote
0answers
22 views

Strange behaviour debugging Android ARM binary with gdbserver

I'm trying to run this armv5 binary from OWASP's mobile security guide (validate) using Android Studio's emulator on my x86_64 machine. I'm seeing very weird behaviour and would appreciate any ...
2
votes
1answer
102 views

Breakpoint in GDB hit 144 times before first call to function

I am working on a reverse engineering challenge and have a binary file. I know how to get the flag by changing the instruction flow after doing a strcmp so I jump to the function that prints the flag....
0
votes
1answer
134 views

How to decrypt the password using radare2 or gdb?

.--------------------------------------------------. | [0x804851b] | ...
0
votes
1answer
175 views

Use GCC and objdump to disassemble any hex to assembly code

What would be the best way (also fewer steps) to generate assembly code for a given hex code ? For e.g., if we know the architecture is x86, and given hex value 0x55, what is the best way to generate ...
1
vote
1answer
80 views

Reverse getline(cin, text)

Sup, guys. I'm trying to solve a crackme that was made in C++, and I was able to "recreate" a function call, through the library calls the program made. Here's the piece of code that I'm trying to ...
3
votes
1answer
101 views

Why EIP is being overwritten before local buffer ends?

I am doing a simple buffer overflow exercise, here is the source: //vuln.c #include <stdio.h> #include <string.h> int main(int argc, char* argv[]) { char buf[256]; strcpy(buf,...
2
votes
1answer
41 views

How to set breakpoint with gdb on arbitrary memory location?

I'm trying to debug some code on Linux. There's an arbitrary memory location I need the program to jump to. This location is result of calling mmap with appropriate protection flags for executing a ...
0
votes
0answers
41 views

How to change operator by GDB?

How can I change je to jne via GDB tooL?
0
votes
0answers
33 views

Examining Stack Frame in GDB

I am learning exploitation from the book "Hacking: The Art of Exploitation". In the program an integer variable auth_flag is declared after a char array password_buffer. So on stack frame first ...
0
votes
0answers
113 views

How to list all functions and their memory addresses for specific shared library using GDB/GEF?

I want to list all functions and their memory addresses for a specific shared library using GDB/GEF. Say, I find a shared library using GEF's vmmap, how do I then list all functions exported by that ...
1
vote
1answer
42 views

Find out if address store in heap or stack

While dynamic debugging with ida and gdb-server on binary file running on linux , I saw address that store some value. How can I know if this address allocated in stack or in heap?
2
votes
2answers
152 views

eip register address not matching with address at breakpoint (breakpoint set at main function)

I recently started reading a book about reverse engineering. In one of the examples it uses gdb (debugger) to disassemble the main. So I did it, and the output is below (gdb) disass main Dump of ...
2
votes
0answers
108 views

gdb - searching for pointers to a given memory region

Let's suppose there is a memory region that is m'mapped in memory, we need to find its address (which randomly changes, because of ASLR) by following a pointer path, basically, I'm trying to find a ...
0
votes
0answers
93 views

R13 off by 2 bytes. Any help?

in this challenge i have to overwrite RIP register to point to the function "print_flags" which calls "getenv" to get the "FLAGS" variable. I have overwritten RIP register with the address of "...
1
vote
0answers
430 views

Reversing ELF 64-bit LSB pie executable [duplicate]

I have a file crackme, which is an executable. hamuto@hamuto-pc:~/Security/NOOB/FruitSalad$ file crackme crackme: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, ...
1
vote
1answer
88 views

radare2 shows main function arguments argv as pointer to char on the stack, not as pointer to pointer to char

Well, I've been digging around process command line arguments as well as environment variables a bit these last days, especially looking up the way main function arguments were pushed onto the stack. ...
1
vote
0answers
214 views

Illegal instruction fault in stack based buffer overflow

I wrote this short C program to practice buffer overflow exploits: #include <stdio.h> #include <string.h> #include <stddef.h> #include <inttypes.h> char *decode(char *s){ ...
0
votes
0answers
26 views

Stack trace with GdbServer

When I debug binary file on linux with gdbServer with Ida ,I don't see stack trace. Why? How can I fix it to see stack trace??
0
votes
0answers
58 views

How to debug programs that load from another one? with radare2/gdb

I'm reversing engendering a plugin. This plugin is loaded into memory by the main program. I disassemble the plugin with radare2 but I don't know how to debug it. I try with gdb but same problem. I ...
2
votes
0answers
92 views

Using GDB to trace guest OS inside a hypervisor, the whole running on Qemu - kvm

I use Gdb to trace the execution (breakpoint, single stepping, ...) of a hypervisor OS in Qemu and it works fine so far. qemu-system-x86_64 -enable-kvm -display sdl -cpu host -serial my: stdio -m ...
1
vote
1answer
81 views

GUARD_PAGE memory breakpoints with gdb?

I came across a question the other day on reddit: How can we use PAGE_GUARD-based memory breakpoints in GDB (not hardware breakpoints)? Ollydbg, x64dbg and IDA PRO all support these types of ...
0
votes
1answer
106 views

how watchpoint on register works

GDB has an option to set watchpoint on register*, how does it work ? what happens during context switching ? why the only implementation is for mips ? Is there a way to make it work for lldb also ? *...
2
votes
1answer
452 views

GDB: Could not load shared library symbols

I'm currently having a look at the Damn Vulnerable Router Firmware, and I'm roughly following the description that is given here: https://p16.praetorian.com/blog/getting-started-with-damn-vulnerable-...
-2
votes
1answer
36 views

DT_DEBUG not filled on dlopen [closed]

A target library "lib42.so" has DT_DEBUG entry in the .dynamic section. After dlopen("lib42.so", RTLD_LOCAL | RTLD_NOW) succeded, r_debug->d_un.d_ptr is equal to zero. Why?
1
vote
1answer
224 views

why saved rip changed by push?

I am doing a reverse homework. see the following pictures: as can be seen from this picture, before call push touch3, "saved rip" is at 0x5561dca8, which is equal to the current rsp(0x5561dca8). ...
1
vote
0answers
177 views

How to use “handle SIGILL nostop noprint” with a gdbserver?

I have a program linked against libcrypto.so. If i run the program in gdb i'll get the following error: "Program received signal SIGILL, Illegal instruction." I researched a bit and found out that it ...
1
vote
0answers
75 views

How can a segfault happen during the libc exit call on Linux?

I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge. While testing, I have noticed ...
0
votes
1answer
60 views

What is a good resource to learn about how the call stack works while programming in C?

Sorry if this is a duplicate and please point me in the right direction if so. I have a strong foundation in C programming and I know how memory is allocated on the stack for variables/arrays/...
2
votes
1answer
171 views

ROP chain: Buffer Overflow Return Pointer

I am trying to get a ROP exploit to work on Ubuntu 18.04 LTS 64bit. I have a 64 bit binary (Nx enabled, ASLR disabled) with vuln function as follows: public vuln vuln proc near var_100= byte ptr -...
0
votes
1answer
292 views

pwntools shellcode narnia2

I'm trying to solve the narnia2 challenge on overthewire. I read a guide for help and managed to overwrite the stack with A's using some python $(python -c "print 'A'*132 + '\xef\xbe\xad\xde'") ...
2
votes
2answers
269 views

Step Over not working in GDB

In the function below, let's say EIP is 0x400688. Now, I want to step over the call instead of stepping inside the subroutine. 0x40067a <main+4> sub $0x20,%rsp ...
2
votes
1answer
92 views

obtaining string value from Unknown elf-x86-64 binary with gdb

I'm trying to find a string value stored in memory by a binary (possibly written in C) that won't show up when I perform "strings a.out". I have tried examining particular memory addresses of interest ...
-1
votes
1answer
214 views

Gdbserver and idapro

I would like to reverse a file so of an apk using idapro (on windows) and gdbserver(on remote target device) . I arrived until the attach of the running process. But after? Is there a tutorial ...
1
vote
0answers
375 views

Reverse Engineering Linux Core Dump

I have a Linux Core Dump file for a binary (which apparently crashed during execution) file command on the core dump: core.123: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from '/...
1
vote
0answers
98 views

Techniques for reversing (basic) hash function

Hi I'm relatively new to RE, and I'm using GDB and Radare2. As part of a crackme I'm trying to reverse a weak hash function that's a little too complicated for me to undo by hand. I've been trying to ...
7
votes
2answers
546 views

Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll

As a pentester for a consulting agency, it is part of our job to "evade" antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, ...
0
votes
1answer
135 views

gdb for main and input parameters

I have one elf 32 application and not stripped, I use gdb info functions and it list only the memory address and function name, but there is no function name with "main", so any way to find the main ...
0
votes
1answer
184 views

GDB MI output vs. stdout

I am using GDBs machine interface (mi) to write some simple tracers/loggers. Now I ran into the problem of telling apart GDB output from text the target-program itself wrote to stdout. If I look ...
1
vote
1answer
154 views

new process id generated during gdb debug

I debug a ELF32 executable in Ubntu 14, I set gdb breakpoint in main, after i click run, the program generate a new process 13050 and exited, I can't use info register to display value and continue ...
3
votes
2answers
5k views

Find base address and memory size of program debugged in gdb

I want to find out the base address and the imagesize of the program being debugged in gdb. As in, where it got loaded in memory. For shared libraries I can do "info sharedlibrary" and I get very ...
1
vote
1answer
378 views

gdb don't break when I use exec-wrapper script to exec my target binary

Why gdb doesn't break when I use exec-wrapper script to exec my target binary. Here my little test. I use a binary with no pie option to use predictable address. $ gcc -no-pie main.c I have this ...
2
votes
1answer
113 views

Why do we need to know the address of shellcode?

I have read many articles regarding the buffer overflow exploit. Everywhere its written as follow. "It's difficult to know the starting address of the shellcode" Why do we need to know the address ...
2
votes
2answers
255 views

Can't trace MIPS embedded device remotely

I'm trying to debug a remote device using gdbserver and IDA Pro. I'm attached to the correct PID and I'm able to step through instructions until the point where I redirect $pc to my ROP chain. At the ...
11
votes
4answers
4k views

How can breakpoint be set using offset in ELF file, not virtual address?

First, generate a simple executable. (ignore the warnings, the executable runs anyway) echo 'main(){puts("123");}'|gcc -x c - -o a Load it with gdb a, then: (gdb) info file Symbols from "/home/...
4
votes
2answers
4k views

Run a python command with “run” on GDB

Hi I'd like to run a python command python -c 'print "\x90"*52' when the program start in GDB, as I would do when I execute : python -c 'print "\x90"*52' | ./myProg . Does anyone knows any way to ...
2
votes
4answers
2k views

How to assemble and inject an instruction with GDB?

GDB has a x/i command (and also disassemble) which allows to view the instructions at a given address. How can we do the reverse – assemble an instruction and write to a given address?