Questions tagged [gdb]
A source level debugger based on `ptrace` for *NIX systems and developed by the GNU project.
59
questions with no upvoted or accepted answers
6
votes
0
answers
2k
views
Generating symbol file for closed-source binary by hand
I have a closed-source binary (minecraft-pi). For a given section of the assembly like so:
a2ed4: e92d45f8 push {r3, r4, r5, r6, r7, r8, sl, lr}
a2ed8: e1a04000 mov ...
- 161
5
votes
0
answers
285
views
What utilities allow you to debug a process without pausing execution?
I was just reading this answer on StackOverflow, "How can you debug a process using gdb without pausing it?"
The Linux kernel provides some support for this via PTRACE_SEIZE, but gdb doesn'...
- 1,779
4
votes
0
answers
426
views
Is there a way to reprint the screen in gdb gef?
I am using gdb-gef and I've searched the manual several times for the answer to this question. Sometimes I run a lot of commands and I would like to re-draw the current program state the way gef ...
- 1,830
4
votes
0
answers
357
views
Using GDB to trace guest OS inside a hypervisor, the whole running on Qemu - kvm
I use Gdb to trace the execution (breakpoint, single stepping, ...) of a hypervisor OS in Qemu and it works fine so far.
qemu-system-x86_64 -enable-kvm -display sdl -cpu host -serial my: stdio -m ...
- 141
3
votes
0
answers
102
views
format-string + ret2libc (or format string only)?
I found that we have a format-string bug with in argument 7. I found a function containing system(/bin/sh)). So I'm not saying stupidity I have to mess with a format-string and a ret2libc (correct me ...
- 31
3
votes
0
answers
57
views
IDA remote GDB debugger cannot suspend linux machine
I am starting Debugging Linux Virtual Machine by IDA GDB debugger. I can say I am able to connect to process (0) and start the machine (by using IDA 32bit, IMO it has something to do with bios! or I ...
- 31
3
votes
0
answers
104
views
debug stripped file
I've system embedded mips big endian with gdb-server and I want debug stripped file of the target, I can run in target gdb server with stripped file (--attach PID), but when I try to connect with gdb-...
- 31
3
votes
0
answers
3k
views
How to decompile python ELF file (Compiled with Nuitka)?
I have some files that compiled with nuitka. formats are .bin. I could get shell access to running process with pyrasite same as this guide. but I cannot decompile function codes or anything else, and ...
- 31
3
votes
0
answers
514
views
gdb - searching for pointers to a given memory region
Let's suppose there is a memory region that is m'mapped in memory, we need to find its address (which randomly changes, because of ASLR) by following a pointer path, basically, I'm trying to find a ...
- 151
3
votes
0
answers
310
views
Giving labels to local variables with GDB
In the GDB debugger of Linux, is it possible to give a local variable (at specific offset from the %esp register) a constant name, which I will see everytime I call disassemble instead of seeing the ...
- 403
2
votes
0
answers
61
views
What is the gdb command equivalent of bp MODULE_NAME+0x12345678 in WinDBG?
What is the gdb command equivalent of bp MODULE_NAME+0x12345678 in WinDBG?
I found this command useful to debug with ASLR (w/o disabling it).
- 101
2
votes
0
answers
53
views
Difference between __openat and openat (Android)
While reverse engineering an Android process, I wanted to explore the openat function. I noticed that there is a symbol "openat" and another symbol "__openat". What is the ...
- 193
2
votes
0
answers
46
views
IDA Pro ignores present database with remote debugging
I have a qemu instance running a custom Linux distribution, within which I'd like to debug an (already running) application. I have already embedded a gdbserver inside (and have a root shell available)...
- 121
2
votes
0
answers
133
views
How to get the address of a glibc private symbol at runtime programmatically?
I am trying to get the address of a private function in GLIBC.
For instance - the function __run_prefork_handlers().
I have done it with gdb, using info symbol __run_prefork_handlers and info address ...
- 121
2
votes
0
answers
243
views
can't debug properly
In the last few days I tried to solve "unlink" challenge in pwnable.kr and I'm struggling to attach a debugger remotely and locally on the server using pwntools (code added below).
#!/usr/...
- 21
2
votes
0
answers
522
views
Passing a String into a Function With GDB
So, I have a function with the prototype according to GDB:
{std::string (std::string)} 0x56027729e545
<function(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator&...
- 21
2
votes
0
answers
875
views
How to perform full MIPS system emulation with QEMU, using the squashfs image and uBoot kernel image?
TL;DR:
Need tips on emulation of MIPS-BE system using QEMU with the help of squashfs image file and uBoot Kernel image file extracted from the firmware file.
Long Version:
- What I have:
A cheap ...
- 51
2
votes
0
answers
144
views
What do you think is the optimum environment for reverse engineering dynamically-linked aarch64 Golang binaries developed in Alpine Linux?
Direct quote from Golang's website: "GDB does not understand Go programs well. The stack management, threading, and runtime contain aspects that differ enough from the execution model GDB expects ...
- 277
2
votes
0
answers
2k
views
IDA Pro GDB QEMU Tricore setup
I have added the lines below to IDA 6.95\cfg\gdb_arch.cfg to try to get QEMU Tricore debugging in IDA Pro, using an ARM tutorial as the basis (page 2):
https://www.hex-rays.com/products/ida/support/...
- 133
2
votes
0
answers
265
views
What does 'mapped' memory region mean in gdb-peda?
I was reading a write-up of a binary exploitation where I came across the following:
What does the mapped keyword listed under Name column mean? What sort of memory region does it refer to?
- 1,371
2
votes
0
answers
542
views
Solve problem with debugging Linksys-wrt54gl with JTAG using BusPirate programmer
I am getting this output when I am issuing this command:
$ sudo openocd -f board/MyBuspirate.cfg -f board/linksys-wrt54gl.cfg
Open On-Chip Debugger 0.10.0+dev-00092-g77189db (2017-02-25-13:44)
...
- 131
2
votes
0
answers
2k
views
Debugging a position independent executable ELF
I am trying to follow the write-up about hackercalc (a challenge for DEFCON 2015 quals). First, by loading the challenge into gdb, I observe that:
(gdb) info files
...
Entry point: 0xcf8
...
So I ...
- 1,410
2
votes
0
answers
2k
views
Remotely debugging Android native ARM library running in Bluestacks
I want to debug a native library loaded by JNI on Android. I have set up the debugging environment to debug native code running on Bluestacks.
I got gdbserver installed on rooted Bluestacks, running ...
- 121
2
votes
0
answers
2k
views
How to set-up GDB debugging in IDA Pro on Linux via Wine?
I tried running on linux via root terminal:
gdbserver --multi localhost:23947
And then at IDA Pro at Wine I use Remote GDB debugger with my local ip and port:
However when I start debugging I think ...
- 411
2
votes
0
answers
3k
views
Debug Android Native Code without source
Id like to debug (to log function calls) native ARM Android Code in a shared library. So far I got no source and tried to disassemble it with IDA, but its hard to track all the calls down to a ...
- 121
2
votes
1
answer
622
views
Debugging Binary using Far Ret to switch Code Segment
It appears that GDB is unable to handle binaries which switch code segments.
Using pwntools*, it's trivial to generate a 32-bit intel binary which uses retf to switch to the 64-bit code segment. ...
- 2,317
1
vote
0
answers
95
views
Binary Exploitation
I am trying to learn binary exploitation. I can modify the binary behaviour with gdb, but I have not understood how to exploit the binary in C.
I've found some references on "Hacking - the art of ...
- 31
1
vote
0
answers
119
views
Why Qiling doesn't recognize the right EntryPoint?
I'm trying to emulate an EFI driver. Luckily, I found a nice emulator called Qiling and try to debug it with GDB but it doesn't recognize the right Entry-Point.
Here is the Entry-Point in IDA and in ...
- 163
1
vote
0
answers
31
views
Using rbreak without import functions
While debugging with GDB I want to break for each function and print the PC register.
rbreak .
define hook-stop
i r $PC
c
end
The problem is that is stop on functions that imported like printf ...
1
vote
0
answers
74
views
Handle Ioctl call while running with qemu
I am using qemu to emulate a binary like this
qemu -strace XXXXX .
I saw that the first 2 system calls of this process were TCGETS to stdin and stdout. From man pages
Get and set terminal attributes
...
- 21
1
vote
0
answers
275
views
Dynamic Analysis with gdb on ELF binaries with no compilation/linking information
I am trying to do some dynamic analysis on a couple of ELF binaries with gdb. However, since those two are directly downloaded (ELF binary file only) with no additional information related to ...
- 11
1
vote
2
answers
231
views
Is address in program can change
I talking about linux arch.
When I open program in Ida (statically ) I can see all instructions address like 0x20da mov r8 r2
When I want use that address to breakpoint (for example with ptrace or ...
1
vote
0
answers
124
views
Debug only one thread with ida-gdb server
If I want to debug process in embedded that running linux , I can run gdb-server in embedded and attach to process with Ida.
The problem is if this process has 1 thread that can't stop over than x ...
- 21
1
vote
0
answers
241
views
Strange behaviour debugging Android ARM binary with gdbserver
I'm trying to run this armv5 binary from OWASP's mobile security guide (validate) using Android Studio's emulator on my x86_64 machine. I'm seeing very weird behaviour and would appreciate any ...
- 133
1
vote
0
answers
788
views
Illegal instruction fault in stack based buffer overflow
I wrote this short C program to practice buffer overflow exploits:
#include <stdio.h>
#include <string.h>
#include <stddef.h>
#include <inttypes.h>
char *decode(char *s){
...
- 143
1
vote
0
answers
524
views
How to use "handle SIGILL nostop noprint" with a gdbserver?
I have a program linked against libcrypto.so. If i run the program in gdb i'll get the following error:
"Program received signal SIGILL, Illegal instruction."
I researched a bit and found out that it ...
- 11
1
vote
0
answers
282
views
How can a segfault happen during the libc exit call on Linux?
I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge.
While testing, I have noticed ...
1
vote
0
answers
2k
views
Reverse Engineering Linux Core Dump
I have a Linux Core Dump file for a binary (which apparently crashed during execution)
file command on the core dump:
core.123: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from '/...
- 765
1
vote
0
answers
145
views
Techniques for reversing (basic) hash function
Hi I'm relatively new to RE, and I'm using GDB and Radare2. As part of a crackme I'm trying to reverse a weak hash function that's a little too complicated for me to undo by hand. I've been trying to ...
- 131
1
vote
0
answers
340
views
Stack buffer overflow SIGSEGV help
I've been going at this for a couple of days now working through trial and error but I can't seem to pinpoint exactly why I'm still getting a SIGSEGV.
Here's the stdout of me stepping through the ...
- 153
1
vote
0
answers
1k
views
My core dump's backtrace stops to a signal handler, what can I do?
I obtained an ELF core dump that was provoked by fuzzing a proprietary server. As I do not have access anymore to the machine that hosted this server, and the server is part of a tightly coupled set ...
1
vote
0
answers
201
views
How to dump PHP backtrace on live running script in lldb?
I'm trying to print PHP backtrace of the live running script using the following 2 simple steps:
Run PHP script as:
php -r "sleep(1000);"
On another console, I've called directly ...
- 475
1
vote
0
answers
364
views
gdbserver doesn't trigger breakpoints
I'm debugging a vulnerable app on a remote host. I've set up gbserver on the host with:
gdbserver host:1234 /my/target/app
On my local host I've connected with:
$ gdb /same/target/app
gdb$ target ...
- 275
1
vote
0
answers
142
views
How to find maximum and minimum process boundaries while debugging?
If I'm using GDB or any other debugger, I just want to know where the respective images are loaded for a given process.
Say I create an executable HelloWorld, and it just prints hello.
It has a ...
- 163
1
vote
0
answers
419
views
qemu and gdb error: could not load xml document
I'm trying to debug an application using Qemu for AARCH64
./qemu-arm64-static -g 1234 file.bin
When running GDB and connecting to the remote host, I get the following error message:
$ ./aarch64-...
- 506
1
vote
1
answer
49
views
Define operations to do in specific breakpoints using GDB
In gdbinit I defined some breakpoints.
How can I do that when specific breakpoint called I want to run x/s $r1 ?
- 43
0
votes
0
answers
19
views
Process always exit and die on router when debug using gdbserver
Im trying to debug the httpd process on the tplink router. I push the gdbserver on the router (i called it server), start it with command:
gdbserver --multi --attach 0.0.0.0:3333 <pid>
On the ...
- 67
0
votes
0
answers
219
views
/bin/sh shell not execute when performing ret2libc attack
I have attempted to do a ret2libc attack. It's a simple buffer overflow with the return address pointed to the system call with the string "/bin/sh" on the stack. For some reason, when I try ...
- 21
0
votes
0
answers
591
views
Using GDB to find the address of a buffer in a stripped C binary
I am working with a crackmes binary called Simple Overflow. It has two buffers with sizes 0x10 and 0x8, and it uses malloc to allocate two contiguous memory blocks (see <+25> and <+39> on ...
0
votes
0
answers
1k
views
Print write and comment into .gdbinit file
Is there any way how to write comment into gdb file?
b*0x1111 # break point at function
or
b*0x1111 // break point at function
or b*0x1111 ; break point at function
That return an error .
Or maybe is ...
- 43