Questions tagged [gdb]

A source level debugger based on `ptrace` for *NIX systems and developed by the GNU project.

42 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
0answers
758 views

Generating symbol file for closed-source binary by hand

I have a closed-source binary (minecraft-pi). For a given section of the assembly like so: a2ed4: e92d45f8 push {r3, r4, r5, r6, r7, r8, sl, lr} a2ed8: e1a04000 mov ...
3
votes
0answers
886 views

GDB find string strange results

I'm playing with gdb and strange things are happening. I wanted to find some address in memory where string "/bin/sh" is located, and gdb says it found it. But when I examine the memory there, the ...
2
votes
0answers
118 views

gdb - searching for pointers to a given memory region

Let's suppose there is a memory region that is m'mapped in memory, we need to find its address (which randomly changes, because of ASLR) by following a pointer path, basically, I'm trying to find a ...
2
votes
0answers
106 views

Using GDB to trace guest OS inside a hypervisor, the whole running on Qemu - kvm

I use Gdb to trace the execution (breakpoint, single stepping, ...) of a hypervisor OS in Qemu and it works fine so far. qemu-system-x86_64 -enable-kvm -display sdl -cpu host -serial my: stdio -m ...
2
votes
2answers
257 views

Can't trace MIPS embedded device remotely

I'm trying to debug a remote device using gdbserver and IDA Pro. I'm attached to the correct PID and I'm able to step through instructions until the point where I redirect $pc to my ROP chain. At the ...
2
votes
0answers
942 views

IDA Pro GDB QEMU Tricore setup

I have added the lines below to IDA 6.95\cfg\gdb_arch.cfg to try to get QEMU Tricore debugging in IDA Pro, using an ARM tutorial as the basis (page 2): https://www.hex-rays.com/products/ida/support/...
2
votes
0answers
267 views

Solve problem with debugging Linksys-wrt54gl with JTAG using BusPirate programmer

I am getting this output when I am issuing this command: $ sudo openocd -f board/MyBuspirate.cfg -f board/linksys-wrt54gl.cfg Open On-Chip Debugger 0.10.0+dev-00092-g77189db (2017-02-25-13:44) ...
2
votes
0answers
179 views

Giving labels to local variables with GDB

In the GDB debugger of Linux, is it possible to give a local variable (at specific offset from the %esp register) a constant name, which I will see everytime I call disassemble instead of seeing the ...
2
votes
0answers
1k views

Debugging a position independent executable ELF

I am trying to follow the write-up about hackercalc (a challenge for DEFCON 2015 quals). First, by loading the challenge into gdb, I observe that: (gdb) info files ... Entry point: 0xcf8 ... So I ...
2
votes
0answers
2k views

Remotely debugging Android native ARM library running in Bluestacks

I want to debug a native library loaded by JNI on Android. I have set up the debugging environment to debug native code running on Bluestacks. I got gdbserver installed on rooted Bluestacks, running ...
2
votes
0answers
1k views

How to set-up GDB debugging in IDA Pro on Linux via Wine?

I tried running on linux via root terminal: gdbserver --multi localhost:23947 And then at IDA Pro at Wine I use Remote GDB debugger with my local ip and port: However when I start debugging I think ...
2
votes
1answer
270 views

Debugging Binary using Far Ret to switch Code Segment

It appears that GDB is unable to handle binaries which switch code segments. Using pwntools*, it's trivial to generate a 32-bit intel binary which uses retf to switch to the 64-bit code segment. ...
1
vote
0answers
25 views

Strange behaviour debugging Android ARM binary with gdbserver

I'm trying to run this armv5 binary from OWASP's mobile security guide (validate) using Android Studio's emulator on my x86_64 machine. I'm seeing very weird behaviour and would appreciate any ...
1
vote
0answers
227 views

Illegal instruction fault in stack based buffer overflow

I wrote this short C program to practice buffer overflow exploits: #include <stdio.h> #include <string.h> #include <stddef.h> #include <inttypes.h> char *decode(char *s){ ...
1
vote
0answers
190 views

How to use “handle SIGILL nostop noprint” with a gdbserver?

I have a program linked against libcrypto.so. If i run the program in gdb i'll get the following error: "Program received signal SIGILL, Illegal instruction." I researched a bit and found out that it ...
1
vote
0answers
77 views

How can a segfault happen during the libc exit call on Linux?

I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge. While testing, I have noticed ...
1
vote
0answers
397 views

Reverse Engineering Linux Core Dump

I have a Linux Core Dump file for a binary (which apparently crashed during execution) file command on the core dump: core.123: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from '/...
1
vote
0answers
98 views

Techniques for reversing (basic) hash function

Hi I'm relatively new to RE, and I'm using GDB and Radare2. As part of a crackme I'm trying to reverse a weak hash function that's a little too complicated for me to undo by hand. I've been trying to ...
1
vote
0answers
233 views

Stack buffer overflow SIGSEGV help

I've been going at this for a couple of days now working through trial and error but I can't seem to pinpoint exactly why I'm still getting a SIGSEGV. Here's the stdout of me stepping through the ...
1
vote
0answers
630 views

My core dump's backtrace stops to a signal handler, what can I do?

I obtained an ELF core dump that was provoked by fuzzing a proprietary server. As I do not have access anymore to the machine that hosted this server, and the server is part of a tightly coupled set ...
1
vote
0answers
139 views

What does 'mapped' memory region mean in gdb-peda?

I was reading a write-up of a binary exploitation where I came across the following: What does the mapped keyword listed under Name column mean? What sort of memory region does it refer to?
1
vote
0answers
233 views

Find string in stripped binary file use gdb

Does this debugger support this feature? Through find it is impossible, as the file stripped.
1
vote
0answers
149 views

How to dump PHP backtrace on live running script in lldb?

I'm trying to print PHP backtrace of the live running script using the following 2 simple steps: Run PHP script as: php -r "sleep(1000);" On another console, I've called directly ...
1
vote
0answers
234 views

gdbserver doesn't trigger breakpoints

I'm debugging a vulnerable app on a remote host. I've set up gbserver on the host with: gdbserver host:1234 /my/target/app On my local host I've connected with: $ gdb /same/target/app gdb$ target ...
1
vote
0answers
120 views

How to find maximum and minimum process boundaries while debugging?

If I'm using GDB or any other debugger, I just want to know where the respective images are loaded for a given process. Say I create an executable HelloWorld, and it just prints hello. It has a ...
1
vote
0answers
3k views

Debug Android Native Code without source

Id like to debug (to log function calls) native ARM Android Code in a shared library. So far I got no source and tried to disassemble it with IDA, but its hard to track all the calls down to a ...
1
vote
0answers
294 views

qemu and gdb error: could not load xml document

I'm trying to debug an application using Qemu for AARCH64 ./qemu-arm64-static -g 1234 file.bin When running GDB and connecting to the remote host, I get the following error message: $ ./aarch64-...
0
votes
1answer
38 views

Arrangement of variables on the stack - out of order?

I was practicing some reverse engineering crack-mes as part of our university curriculum, and I have a question around the arrangement of variables on the stack. I have a very basic C++ code, like ...
0
votes
1answer
28 views

What's wrong with my mitm to support rr commands with gdbserver on IDA?

First of here is the gdb remote protocol doc. The idea of the below script is the following - you enter an actual command (one that will be send as a direct packet see packets) in the gdb window then ...
0
votes
0answers
25 views

<error sending command to monitor>

I'm trying to debug a backtrace created with rr so I type: rr replay -s 50505 -k it displays out: gdb '-l' '10000' '-ex' 'set sysroot /' '-ex' 'target extended-remote 127.0.0.1:50505' target Then ...
0
votes
1answer
261 views

Use GCC and objdump to disassemble any hex to assembly code

What would be the best way (also fewer steps) to generate assembly code for a given hex code ? For e.g., if we know the architecture is x86, and given hex value 0x55, what is the best way to generate ...
0
votes
0answers
42 views

How to change operator by GDB?

How can I change je to jne via GDB tooL?
0
votes
0answers
36 views

Examining Stack Frame in GDB

I am learning exploitation from the book "Hacking: The Art of Exploitation". In the program an integer variable auth_flag is declared after a char array password_buffer. So on stack frame first ...
0
votes
0answers
126 views

How to list all functions and their memory addresses for specific shared library using GDB/GEF?

I want to list all functions and their memory addresses for a specific shared library using GDB/GEF. Say, I find a shared library using GEF's vmmap, how do I then list all functions exported by that ...
0
votes
0answers
95 views

R13 off by 2 bytes. Any help?

in this challenge i have to overwrite RIP register to point to the function "print_flags" which calls "getenv" to get the "FLAGS" variable. I have overwritten RIP register with the address of "...
0
votes
0answers
26 views

Stack trace with GdbServer

When I debug binary file on linux with gdbServer with Ida ,I don't see stack trace. Why? How can I fix it to see stack trace??
0
votes
0answers
59 views

How to debug programs that load from another one? with radare2/gdb

I'm reversing engendering a plugin. This plugin is loaded into memory by the main program. I disassemble the plugin with radare2 but I don't know how to debug it. I try with gdb but same problem. I ...
0
votes
1answer
111 views

how watchpoint on register works

GDB has an option to set watchpoint on register*, how does it work ? what happens during context switching ? why the only implementation is for mips ? Is there a way to make it work for lldb also ? *...
0
votes
1answer
306 views

pwntools shellcode narnia2

I'm trying to solve the narnia2 challenge on overthewire. I read a guide for help and managed to overwrite the stack with A's using some python $(python -c "print 'A'*132 + '\xef\xbe\xad\xde'") ...
-1
votes
1answer
291 views

Practicing what SHOULD be a simple crackme. Program calls strlen() but never returns

I'm trying out a crackme from the "LSE CTF" called "Blue Box" worth only 10 points. I've attempted this inside GDB and radare2... It is very simple, takes one argument and first checks to make sure ...
-1
votes
1answer
324 views

Disassembling code with Hopper

I'm trying to figure out what this code is doing. The first thing that I don't understand is the condition that tests if arg0's value is 0x2. I read that 0x2 in ASCII is STX (Start of text). Here's ...
-1
votes
1answer
734 views

How do you effectively use gdb and IDA together?

When dealing with linux binaries, I like IDA as my static analysis tool and gdb as my debugger. However I have not found an effective way to integrate the two with each other. To give an example, let'...