Questions tagged [gdb]

A source level debugger based on `ptrace` for *NIX systems and developed by the GNU project.

56 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6 votes
0 answers
1k views

Generating symbol file for closed-source binary by hand

I have a closed-source binary (minecraft-pi). For a given section of the assembly like so: a2ed4: e92d45f8 push {r3, r4, r5, r6, r7, r8, sl, lr} a2ed8: e1a04000 mov ...
user avatar
  • 161
4 votes
0 answers
298 views

Using GDB to trace guest OS inside a hypervisor, the whole running on Qemu - kvm

I use Gdb to trace the execution (breakpoint, single stepping, ...) of a hypervisor OS in Qemu and it works fine so far. qemu-system-x86_64 -enable-kvm -display sdl -cpu host -serial my: stdio -m ...
user avatar
  • 141
4 votes
1 answer
2k views

GDB find string strange results

I'm playing with gdb and strange things are happening. I wanted to find some address in memory where string "/bin/sh" is located, and gdb says it found it. But when I examine the memory there, the ...
user avatar
3 votes
0 answers
188 views

What utilities allow you to debug a process without pausing execution?

I was just reading this answer on StackOverflow, "How can you debug a process using gdb without pausing it?" The Linux kernel provides some support for this via PTRACE_SEIZE, but gdb doesn'...
user avatar
  • 1,664
3 votes
0 answers
357 views

gdb - searching for pointers to a given memory region

Let's suppose there is a memory region that is m'mapped in memory, we need to find its address (which randomly changes, because of ASLR) by following a pointer path, basically, I'm trying to find a ...
user avatar
3 votes
0 answers
262 views

Giving labels to local variables with GDB

In the GDB debugger of Linux, is it possible to give a local variable (at specific offset from the %esp register) a constant name, which I will see everytime I call disassemble instead of seeing the ...
user avatar
2 votes
0 answers
1k views

How to decompile python ELF file (Compiled with Nuitka)?

I have some files that compiled with nuitka. formats are .bin. I could get shell access to running process with pyrasite same as this guide. but I cannot decompile function codes or anything else, and ...
user avatar
  • 21
2 votes
0 answers
352 views

How to perform full MIPS system emulation with QEMU, using the squashfs image and uBoot kernel image?

TL;DR: Need tips on emulation of MIPS-BE system using QEMU with the help of squashfs image file and uBoot Kernel image file extracted from the firmware file. Long Version: - What I have: A cheap ...
user avatar
2 votes
2 answers
514 views

Can't trace MIPS embedded device remotely

I'm trying to debug a remote device using gdbserver and IDA Pro. I'm attached to the correct PID and I'm able to step through instructions until the point where I redirect $pc to my ROP chain. At the ...
user avatar
2 votes
0 answers
1k views

IDA Pro GDB QEMU Tricore setup

I have added the lines below to IDA 6.95\cfg\gdb_arch.cfg to try to get QEMU Tricore debugging in IDA Pro, using an ARM tutorial as the basis (page 2): https://www.hex-rays.com/products/ida/support/...
user avatar
2 votes
0 answers
476 views

Solve problem with debugging Linksys-wrt54gl with JTAG using BusPirate programmer

I am getting this output when I am issuing this command: $ sudo openocd -f board/MyBuspirate.cfg -f board/linksys-wrt54gl.cfg Open On-Chip Debugger 0.10.0+dev-00092-g77189db (2017-02-25-13:44) ...
user avatar
  • 131
2 votes
0 answers
2k views

Debugging a position independent executable ELF

I am trying to follow the write-up about hackercalc (a challenge for DEFCON 2015 quals). First, by loading the challenge into gdb, I observe that: (gdb) info files ... Entry point: 0xcf8 ... So I ...
user avatar
2 votes
0 answers
2k views

Remotely debugging Android native ARM library running in Bluestacks

I want to debug a native library loaded by JNI on Android. I have set up the debugging environment to debug native code running on Bluestacks. I got gdbserver installed on rooted Bluestacks, running ...
user avatar
  • 121
2 votes
0 answers
2k views

How to set-up GDB debugging in IDA Pro on Linux via Wine?

I tried running on linux via root terminal: gdbserver --multi localhost:23947 And then at IDA Pro at Wine I use Remote GDB debugger with my local ip and port: However when I start debugging I think ...
user avatar
  • 391
2 votes
1 answer
511 views

Debugging Binary using Far Ret to switch Code Segment

It appears that GDB is unable to handle binaries which switch code segments. Using pwntools*, it's trivial to generate a 32-bit intel binary which uses retf to switch to the 64-bit code segment. ...
user avatar
  • 2,277
1 vote
0 answers
39 views

Why Qiling doesn't recognize the right EntryPoint?

I'm trying to emulate an EFI driver. Luckily, I found a nice emulator called Qiling and try to debug it with GDB but it doesn't recognize the right Entry-Point. Here is the Entry-Point in IDA and in ...
user avatar
  • 83
1 vote
0 answers
25 views

Using rbreak without import functions

While debugging with GDB I want to break for each function and print the PC register. rbreak . define hook-stop i r $PC c end The problem is that is stop on functions that imported like printf ...
user avatar
1 vote
0 answers
145 views

Passing a String into a Function With GDB

So, I have a function with the prototype according to GDB: {std::string (std::string)} 0x56027729e545 <function(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator&...
user avatar
  • 11
1 vote
0 answers
46 views

Handle Ioctl call while running with qemu

I am using qemu to emulate a binary like this qemu -strace XXXXX . I saw that the first 2 system calls of this process were TCGETS to stdin and stdout. From man pages Get and set terminal attributes ...
user avatar
1 vote
0 answers
107 views

What do you think is the optimum environment for reverse engineering dynamically-linked aarch64 Golang binaries developed in Alpine Linux?

Direct quote from Golang's website: "GDB does not understand Go programs well. The stack management, threading, and runtime contain aspects that differ enough from the execution model GDB expects ...
user avatar
  • 257
1 vote
0 answers
145 views

Dynamic Analysis with gdb on ELF binaries with no compilation/linking information

I am trying to do some dynamic analysis on a couple of ELF binaries with gdb. However, since those two are directly downloaded (ELF binary file only) with no additional information related to ...
user avatar
  • 11
1 vote
0 answers
74 views

Debug only one thread with ida-gdb server

If I want to debug process in embedded that running linux , I can run gdb-server in embedded and attach to process with Ida. The problem is if this process has 1 thread that can't stop over than x ...
user avatar
  • 21
1 vote
0 answers
190 views

Strange behaviour debugging Android ARM binary with gdbserver

I'm trying to run this armv5 binary from OWASP's mobile security guide (validate) using Android Studio's emulator on my x86_64 machine. I'm seeing very weird behaviour and would appreciate any ...
user avatar
1 vote
0 answers
584 views

Illegal instruction fault in stack based buffer overflow

I wrote this short C program to practice buffer overflow exploits: #include <stdio.h> #include <string.h> #include <stddef.h> #include <inttypes.h> char *decode(char *s){ ...
user avatar
1 vote
0 answers
410 views

How to use "handle SIGILL nostop noprint" with a gdbserver?

I have a program linked against libcrypto.so. If i run the program in gdb i'll get the following error: "Program received signal SIGILL, Illegal instruction." I researched a bit and found out that it ...
user avatar
1 vote
0 answers
223 views

How can a segfault happen during the libc exit call on Linux?

I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge. While testing, I have noticed ...
user avatar
1 vote
0 answers
2k views

Reverse Engineering Linux Core Dump

I have a Linux Core Dump file for a binary (which apparently crashed during execution) file command on the core dump: core.123: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from '/...
user avatar
1 vote
0 answers
129 views

Techniques for reversing (basic) hash function

Hi I'm relatively new to RE, and I'm using GDB and Radare2. As part of a crackme I'm trying to reverse a weak hash function that's a little too complicated for me to undo by hand. I've been trying to ...
user avatar
1 vote
0 answers
311 views

Stack buffer overflow SIGSEGV help

I've been going at this for a couple of days now working through trial and error but I can't seem to pinpoint exactly why I'm still getting a SIGSEGV. Here's the stdout of me stepping through the ...
user avatar
1 vote
0 answers
1k views

My core dump's backtrace stops to a signal handler, what can I do?

I obtained an ELF core dump that was provoked by fuzzing a proprietary server. As I do not have access anymore to the machine that hosted this server, and the server is part of a tightly coupled set ...
user avatar
1 vote
0 answers
190 views

What does 'mapped' memory region mean in gdb-peda?

I was reading a write-up of a binary exploitation where I came across the following: What does the mapped keyword listed under Name column mean? What sort of memory region does it refer to?
user avatar
  • 1,271
1 vote
0 answers
355 views

Find string in stripped binary file use gdb

Does this debugger support this feature? Through find it is impossible, as the file stripped.
user avatar
1 vote
0 answers
181 views

How to dump PHP backtrace on live running script in lldb?

I'm trying to print PHP backtrace of the live running script using the following 2 simple steps: Run PHP script as: php -r "sleep(1000);" On another console, I've called directly ...
user avatar
  • 445
1 vote
0 answers
297 views

gdbserver doesn't trigger breakpoints

I'm debugging a vulnerable app on a remote host. I've set up gbserver on the host with: gdbserver host:1234 /my/target/app On my local host I've connected with: $ gdb /same/target/app gdb$ target ...
user avatar
  • 265
1 vote
0 answers
132 views

How to find maximum and minimum process boundaries while debugging?

If I'm using GDB or any other debugger, I just want to know where the respective images are loaded for a given process. Say I create an executable HelloWorld, and it just prints hello. It has a ...
user avatar
1 vote
0 answers
3k views

Debug Android Native Code without source

Id like to debug (to log function calls) native ARM Android Code in a shared library. So far I got no source and tried to disassemble it with IDA, but its hard to track all the calls down to a ...
user avatar
1 vote
0 answers
371 views

qemu and gdb error: could not load xml document

I'm trying to debug an application using Qemu for AARCH64 ./qemu-arm64-static -g 1234 file.bin When running GDB and connecting to the remote host, I get the following error message: $ ./aarch64-...
user avatar
  • 456
1 vote
1 answer
40 views

Define operations to do in specific breakpoints using GDB

In gdbinit I defined some breakpoints. How can I do that when specific breakpoint called I want to run x/s $r1 ?
user avatar
  • 33
0 votes
2 answers
210 views

Run a python in command (kali) with "run" on gdb-peda$

While debugging a program under gdb with gdb-peda installed, I need to pass args to the binary using output from something like python. Why I am not getting AAAAA? gdb-peda$ b doSomthing gdb-peda$ run ...
user avatar
  • 11
0 votes
0 answers
16 views

Print CMarkupSTL object with GDB

CMarkupSTL is contain XML. How can I print that XML with GDB while I debug process? I run on Arm Linux
user avatar
0 votes
0 answers
77 views

Debugging a security camera with gdbserver

I am just starting in reverse engineering and I have been stuck for a couple of weeks on this problem. It probably is a very basic question but I don't seem to be able to find an answer and I hope ...
user avatar
0 votes
0 answers
38 views

Unable to redirect program because function address is not correctly written to the heap

I have a heap overflow example program (heap0.c)compiled as follows: gcc heap0.c -w -g -no-pie -z execstack -o heap0 In order to overwrite the instruction pointer with (BBBB = \x42\x42\x42\x42), I ...
user avatar
0 votes
0 answers
149 views

Remote debugging with Binary Ninja on Windows possible?

Quick background -- I cannot start the .exe from a debugger; I need to attach after the fact. Binary Ninja's debugging plugin only allows attaching to a remote debug server and not a process. The ...
user avatar
  • 101
0 votes
0 answers
94 views

/bin/sh shell not execute when performing ret2libc attack

I have attempted to do a ret2libc attack. It's a simple buffer overflow with the return address pointed to the system call with the string "/bin/sh" on the stack. For some reason, when I try ...
user avatar
0 votes
0 answers
202 views

Using GDB to find the address of a buffer in a stripped C binary

I am working with a crackmes binary called Simple Overflow. It has two buffers with sizes 0x10 and 0x8, and it uses malloc to allocate two contiguous memory blocks (see <+25> and <+39> on ...
user avatar
0 votes
0 answers
470 views

Print write and comment into .gdbinit file

Is there any way how to write comment into gdb file? b*0x1111 # break point at function or b*0x1111 // break point at function or b*0x1111 ; break point at function That return an error . Or maybe is ...
user avatar
  • 33
0 votes
0 answers
468 views

Remote Debugging an Aarch64 ELF File on Multiarch/Qemu-user-static (arm64v8/alpine) Docker Container

My goal is stated in the title. However, I think there is a fundamental issue with gdbserver. In particular, I create an aarch64 alpine docker container on a x86_64 Ubuntu 16.04 host using sudo docker ...
user avatar
  • 257
0 votes
0 answers
83 views

ret2libc exploit issue

i have some code in c i am working to write exploit for it: #include <stdio.h> void secretFunction() { printf("Congratulations!\n"); printf("You have ...
user avatar
0 votes
0 answers
89 views

Disassembly - First steps

I decided that I need to understand this more thoroughly, so am working in parallel with two resources: one more modern and one original from @Aleph1. In the essay, there is a basic code snippet, ...
user avatar
0 votes
0 answers
169 views

<error sending command to monitor>

I'm trying to debug a backtrace created with rr so I type: rr replay -s 50505 -k it displays out: gdb '-l' '10000' '-ex' 'set sysroot /' '-ex' 'target extended-remote 127.0.0.1:50505' target Then ...
user avatar
  • 415