Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [gdb]

A source level debugger based on `ptrace` for *NIX systems and developed by the GNU project.

1
vote
0answers
98 views

Illegal instruction fault in stack based buffer overflow

I wrote this short C program to practice buffer overflow exploits: #include <stdio.h> #include <string.h> #include <stddef.h> #include <inttypes.h> char *decode(char *s){ ...
0
votes
0answers
17 views

Stack trace with GdbServer

When I debug binary file on linux with gdbServer with Ida ,I don't see stack trace. Why? How can I fix it to see stack trace??
0
votes
0answers
41 views

How to debug programs that load from another one? with radare2/gdb

I'm reversing engendering a plugin. This plugin is loaded into memory by the main program. I disassemble the plugin with radare2 but I don't know how to debug it. I try with gdb but same problem. I ...
2
votes
0answers
22 views

Using GDB to trace guest OS inside a hypervisor, the whole running on Qemu - kvm

I use Gdb to trace the execution (breakpoint, single stepping, ...) of a hypervisor OS in Qemu and it works fine so far. qemu-system-x86_64 -enable-kvm -display sdl -cpu host -serial my: stdio -m ...
1
vote
1answer
55 views

GUARD_PAGE memory breakpoints with gdb?

I came across a question the other day on reddit: How can we use PAGE_GUARD-based memory breakpoints in GDB (not hardware breakpoints)? Ollydbg, x64dbg and IDA PRO all support these types of ...
0
votes
1answer
72 views

how watchpoint on register works

GDB has an option to set watchpoint on register*, how does it work ? what happens during context switching ? why the only implementation is for mips ? Is there a way to make it work for lldb also ? *...
2
votes
1answer
65 views

GDB: Could not load shared library symbols

I'm currently having a look at the Damn Vulnerable Router Firmware, and I'm roughly following the description that is given here: https://p16.praetorian.com/blog/getting-started-with-damn-vulnerable-...
-2
votes
1answer
21 views

DT_DEBUG not filled on dlopen [closed]

A target library "lib42.so" has DT_DEBUG entry in the .dynamic section. After dlopen("lib42.so", RTLD_LOCAL | RTLD_NOW) succeded, r_debug->d_un.d_ptr is equal to zero. Why?
1
vote
1answer
70 views

why saved rip changed by push?

I am doing a reverse homework. see the following pictures: as can be seen from this picture, before call push touch3, "saved rip" is at 0x5561dca8, which is equal to the current rsp(0x5561dca8). ...
1
vote
0answers
46 views

How to use “handle SIGILL nostop noprint” with a gdbserver?

I have a program linked against libcrypto.so. If i run the program in gdb i'll get the following error: "Program received signal SIGILL, Illegal instruction." I researched a bit and found out that it ...
1
vote
0answers
49 views

How can a segfault happen during the libc exit call on Linux?

I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge. While testing, I have noticed ...
0
votes
1answer
59 views

What is a good resource to learn about how the call stack works while programming in C?

Sorry if this is a duplicate and please point me in the right direction if so. I have a strong foundation in C programming and I know how memory is allocated on the stack for variables/arrays/...
2
votes
1answer
106 views

ROP chain: Buffer Overflow Return Pointer

I am trying to get a ROP exploit to work on Ubuntu 18.04 LTS 64bit. I have a 64 bit binary (Nx enabled, ASLR disabled) with vuln function as follows: public vuln vuln proc near var_100= byte ptr -...
0
votes
1answer
143 views

pwntools shellcode narnia2

I'm trying to solve the narnia2 challenge on overthewire. I read a guide for help and managed to overwrite the stack with A's using some python $(python -c "print 'A'*132 + '\xef\xbe\xad\xde'") ...
3
votes
2answers
90 views

Step Over not working in GDB

In the function below, let's say EIP is 0x400688. Now, I want to step over the call instead of stepping inside the subroutine. 0x40067a <main+4> sub $0x20,%rsp ...
2
votes
1answer
47 views

obtaining string value from Unknown elf-x86-64 binary with gdb

I'm trying to find a string value stored in memory by a binary (possibly written in C) that won't show up when I perform "strings a.out". I have tried examining particular memory addresses of interest ...
-1
votes
1answer
120 views

Gdbserver and idapro

I would like to reverse a file so of an apk using idapro (on windows) and gdbserver(on remote target device) . I arrived until the attach of the running process. But after? Is there a tutorial ...
1
vote
0answers
193 views

Reverse Engineering Linux Core Dump

I have a Linux Core Dump file for a binary (which apparently crashed during execution) file command on the core dump: core.123: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from '/...
1
vote
0answers
79 views

Techniques for reversing (basic) hash function

Hi I'm relatively new to RE, and I'm using GDB and Radare2. As part of a crackme I'm trying to reverse a weak hash function that's a little too complicated for me to undo by hand. I've been trying to ...
7
votes
2answers
323 views

Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll

As a pentester for a consulting agency, it is part of our job to "evade" antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, ...
0
votes
1answer
83 views

gdb for main and input parameters

I have one elf 32 application and not stripped, I use gdb info functions and it list only the memory address and function name, but there is no function name with "main", so any way to find the main ...
0
votes
1answer
92 views

GDB MI output vs. stdout

I am using GDBs machine interface (mi) to write some simple tracers/loggers. Now I ran into the problem of telling apart GDB output from text the target-program itself wrote to stdout. If I look ...
1
vote
1answer
68 views

new process id generated during gdb debug

I debug a ELF32 executable in Ubntu 14, I set gdb breakpoint in main, after i click run, the program generate a new process 13050 and exited, I can't use info register to display value and continue ...
2
votes
2answers
2k views

Find base address and memory size of program debugged in gdb

I want to find out the base address and the imagesize of the program being debugged in gdb. As in, where it got loaded in memory. For shared libraries I can do "info sharedlibrary" and I get very ...
1
vote
1answer
188 views

gdb don't break when I use exec-wrapper script to exec my target binary

Why gdb doesn't break when I use exec-wrapper script to exec my target binary. Here my little test. I use a binary with no pie option to use predictable address. $ gcc -no-pie main.c I have this ...
2
votes
1answer
86 views

Why do we need to know the address of shellcode?

I have read many articles regarding the buffer overflow exploit. Everywhere its written as follow. "It's difficult to know the starting address of the shellcode" Why do we need to know the address ...
2
votes
2answers
169 views

Can't trace MIPS embedded device remotely

I'm trying to debug a remote device using gdbserver and IDA Pro. I'm attached to the correct PID and I'm able to step through instructions until the point where I redirect $pc to my ROP chain. At the ...
10
votes
4answers
2k views

How can breakpoint be set using offset in ELF file, not virtual address?

First, generate a simple executable. (ignore the warnings, the executable runs anyway) echo 'main(){puts("123");}'|gcc -x c - -o a Load it with gdb a, then: (gdb) info file Symbols from "/home/...
3
votes
2answers
1k views

Run a python command with “run” on GDB

Hi I'd like to run a python command python -c 'print "\x90"*52' when the program start in GDB, as I would do when I execute : python -c 'print "\x90"*52' | ./myProg . Does anyone knows any way to ...
1
vote
2answers
790 views

How to assemble and inject an instruction with GDB?

GDB has a x/i command (and also disassemble) which allows to view the instructions at a given address. How can we do the reverse – assemble an instruction and write to a given address?
3
votes
1answer
335 views

Buffer overflow challenge - shell not opening

I'm working on a buffer overflow CTF challenge. The binary for this challenge includes a give_shell function (they cover shellcode in the next challenge) I can successfully overwrite the saved EIP on ...
1
vote
1answer
1k views

Basic question: how to input non-printable hex values in GDB / NC? [duplicate]

I'm working on a CTF challenge that is an introduction to smashing the stack. I have the binary working in GDB, and can overwrite the correct part of the stack with printable characters. The ...
1
vote
1answer
3k views

Cannot Access memory error

I am trying to debug a simple buffer overflow program using gdb . I analyzed the program on windows without any issues .But now i am using linux gdb with exact same program but i am getting "Cannot ...
1
vote
1answer
373 views

Question about gdb and memory addresses

i am trying to use gdb to analyse a c program but i am a little confused. in the above picture you can see i am trying to analyse the stack . On the left we have memory addresses.Since i am using a ...
0
votes
1answer
467 views

Radare2 cannot debug on windows 7

I downloaded radare 2.5 for windows. I am trying to debug a binary on windows with radare and have tried the following: radare2 -d a.exe fork_and_ptraceme/CreateProcess: The request is not supported. ...
1
vote
0answers
58 views

Redirecting gdb output to stdout wihile using pwndbg

I am using pwndbg plugin with gdb. When any program that prints to stdout is run under gdb, I seem to not being able to see the output from the program during the debugging session. How can I redirect ...
1
vote
1answer
235 views

Break anywhere when $r1 equals to string GDB

Is there anyway to break on gdb where $r1 equals to a certain string I know there is : break [addr] if ((int)strcmp($r1, "hello")) == 0 But what to set in addr when I just wanna break when the r1 is ...
1
vote
1answer
416 views

How to set breakpoints in GDB on remote target without an executable?

I'm trying to use a gdb client running on my host machine to talk to a GDB server running on a debug probe. I can connect using the "target remote" command, and I can single step, use monitor ...
1
vote
0answers
183 views

Stack buffer overflow SIGSEGV help

I've been going at this for a couple of days now working through trial and error but I can't seem to pinpoint exactly why I'm still getting a SIGSEGV. Here's the stdout of me stepping through the ...
3
votes
1answer
205 views

Debugging Binary using Far Ret to switch Code Segment

It appears that GDB is unable to handle binaries which switch code segments. Using pwntools*, it's trivial to generate a 32-bit intel binary which uses retf to switch to the 64-bit code segment. ...
3
votes
2answers
593 views

Password Bruteforce using angr

I am having a binary which takes an input from user and checks every bit of our character using the check_value function which does some stuff. The disassembly of the interested function is: .text:...
6
votes
0answers
564 views

Generating symbol file for closed-source binary by hand

I have a closed-source binary (minecraft-pi). For a given section of the assembly like so: a2ed4: e92d45f8 push {r3, r4, r5, r6, r7, r8, sl, lr} a2ed8: e1a04000 mov ...
7
votes
2answers
1k views

what is radare2's equivalent to GDB's 'find &system,+9999999,“/bin/sh”'

What is radare2's equivalent to GDB's find &system,+9999999,"/bin/sh"?
1
vote
0answers
509 views

My core dump's backtrace stops to a signal handler, what can I do?

I obtained an ELF core dump that was provoked by fuzzing a proprietary server. As I do not have access anymore to the machine that hosted this server, and the server is part of a tightly coupled set ...
1
vote
1answer
1k views

Why does my shellcode work in gdb but not on the command line

So I just started with reverse engineering and have run into some issues until I recently noticed something strange. I wrote an extremely simple shellcode (exit system call) for practice and I played ...
6
votes
1answer
974 views

Understanding gdb output

So I was messing with gdb and came across something rather interesting. I ran the following code into gdb: int i, g = 1; for (i = 0; i < 100; i++) g++; Before execution, disas main ...
1
vote
1answer
345 views

Debugging EXE File in Windbg and How to set Breakpoints in Assembly

I am trying to set a breakpoint (created in assembly) and step into an EXE file line by line to watch registers and memory behavior. I have done this easily with gdb under Linux like this. gdb -q ./...
1
vote
2answers
255 views

Added instruction to shellcode

I have the following shellcode: xor eax, eax ; eax = 0 push eax ; 0 (end of the string) push 0x68732f2f ; //sh push 0x6e69622f ; /bin mov ebx, esp ; ebx = &(/bin//sh) xor ecx, ecx ...
1
vote
1answer
379 views

gdb-multiarch Segmentation fault

I've followed the guide from Cross debugging for MIPS ELF with QEMU/toolchain to cross compile a simple hello world application, but for some reason I get a segmentation fault when opening it with gdb-...
4
votes
2answers
438 views

ASM working as is, but not in a C program

I have this piece of ASM: section .text global _start _start: xor eax, eax push eax ; 0 to finish the /bin//sh string push 0x68732f2f ; //sh push 0x6e69622f ; /bin ...