Questions tagged [gdb]
A source level debugger based on `ptrace` for *NIX systems and developed by the GNU project.
267
questions
119
votes
2
answers
93k
views
How to handle stripped binaries with GDB? No source, no symbols and GDB only shows addresses?
I have GDB but the binary I want reverse engineer dynamically has no symbols, that is when I run the file utility it shows me stripped:
ELF 64-bit LSB executable, x86-64, version 1 (SYSV), ...
- 10.6k
98
votes
20
answers
132k
views
Decent GUI for GDB
Learning the GDB commands is on my bucket-list, but in the meantime is there a graphical debugger for *nix platforms that accepts Windbg commands, and has similar functionality? For example, the ...
- 4,006
29
votes
4
answers
41k
views
Cross debugging for ARM / MIPS ELF with QEMU/toolchain
as i'm new about cross-debugging and cross-compilation i need some help because i feel so confused. I have a MIPS elf file, [myelf][1] .You can see bellow the output of file myelf:
myelf: ELF 32-bit ...
- 465
28
votes
1
answer
101k
views
Reversing ELF 64-bit LSB executable, x86-64 ,gdb
I'm a newbie and just got into RE.
I got a ELF 64-bit LSB executable, x86-64. I'm trying to reverse it.
First I tried to set a break point on line 1 using
gdb ./filename
break 1
The gdb says
No ...
- 433
19
votes
4
answers
23k
views
Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR
Given a position-independent, statically-linked, stripped binary, there does not appear to be a way in GDB to set a breakpoint at the entry point without disabling ASLR.
break start and similar ...
- 2,307
18
votes
2
answers
14k
views
How to predict address space layout differences between real and gdb-controlled executions?
It's something that puzzle me for a long time. I can observe that there is a difference between the real execution of a program and the gdb-controlled one.
But, here is an example:
First, here is ...
- 18.5k
12
votes
2
answers
3k
views
Encrypted Mach-o binary cannot be disassembled/traced with GDB
I'm trying to analyze an encrypted Mach-O binary (non-iPhone one), and I am observing the following strange behaviors:
when I load this binary into GDB and try to disassemble the code at the address ...
- 311
11
votes
4
answers
10k
views
How can breakpoint be set using offset in ELF file, not virtual address?
First, generate a simple executable. (ignore the warnings, the executable runs anyway)
echo 'main(){puts("123");}'|gcc -x c - -o a
Load it with gdb a, then:
(gdb) info file
Symbols from "/home/...
- 655
11
votes
1
answer
13k
views
What is the difference between step into and step over when debugging?
I am using EDB and stepping through the program but I do not even know what the difference in behavior is when doing this. I feel like this is something I should know if I ever have hope of reverse ...
- 385
10
votes
3
answers
1k
views
Trying to reverse engineer C code that is 64bit assembly
This is the code I am looking at
0x0000000000401048 <+70>: mov 0x401ba0(,%rax,4),%eax
This is an array of 15 integers. Just wondering how I can access indices 0 to 15 in gdb
Thanks
user2303586
10
votes
2
answers
3k
views
Attaching GDB to a specific fork
I am trying to reverse engineer a Linux binary that makes several fork() calls. I am using GDB 7.5 on Ubuntu. What I am trying to do with GDB is attach to a certain fork() (say the second call). Is ...
- 369
10
votes
2
answers
1k
views
Connecting to jtag-openocd-gdb to arm11 device with IDA gets no control
I have a binary chunk from a piece of hardware I've been deciphering with IDA for a couple days now. Today I finally got a probe connected via JTAG and have openocd start up a GDB server. IDA is ...
- 151
9
votes
2
answers
15k
views
Why does `ldd` and `(gdb) info sharedlibrary` show a different library base address?
I see three different outputs for where libc should be loaded.
ldd shows the loading address of libc at 0xf7e9e000
$ ldd ~/my_tool
linux-gate.so.1 => (0xf7ffe000)
libc.so.6 => /lib/...
- 3,009
9
votes
1
answer
916
views
Understanding segment prefixes in assembly for Linux
In looking at some assembly, I have come across a few instructions using segment prefixes. For example
<address>: .... mov eax,DWORD PTR gs:0x20
I understand the basics of memory segments, ...
- 91
9
votes
1
answer
3k
views
Run command on breakpoint without stopping
I'd like to automate the following in my .gdbinit:
break boost::uuids::detail::sha1::process_bytes
# When execution stops at the above breakpoint,
# I want to display the contents of `rcx` as a ...
- 193
9
votes
1
answer
619
views
How does GDB's process recording work?
A curious and useful feature of GDB is process recording, allowing an analyst to step forwards and backwards through execution, writing a continuous log of the changes to program state that allow for ...
- 1,203
9
votes
1
answer
441
views
Equivalent of IDA FLIRT signatures for GDB?
Are there equivalent tools/procedures to IDA's FLIRT signatures, when working on statically linked binaries, with other disassemblers?
Is it at all possible with GDB/objdump?
- 283
9
votes
1
answer
2k
views
GDB via JTAG on ARM Hardware target without source code
Does anyone have other solutions for connecting to a remote ARM target without IDA? This is the question and below I give examples of setup's i have tried, should anyone be interested.
Update: ...
- 91
8
votes
3
answers
6k
views
windows kernel debugging on Mac host (using VMware fusion)
in windows host we can use WinDBG and serial port communication for connection to windows kernel and the most easiest way is using VirtualKD.
now the question is, is there any possibility of doing ...
- 581
8
votes
1
answer
3k
views
Getting IDAPro to analyse part of memory as PE-File
I am using Qemu with its internal GDB server to attach IDA Pro to an instance of Windows 8 x64.
There are some problems to solve, because when I am connecting to the GDB server, I am just seeing a ...
- 536
8
votes
1
answer
1k
views
GDB issues: Can't set breakpoint on Obj-C method
I'm a beginner to reverse engineering, I've read through a few tutorials and know my way around some basic GDB and assembly code. After working my way through a few trivial examples I'd like to try ...
- 81
8
votes
2
answers
3k
views
Hopper on Linux -- how to use GDBserver
I'm looking for a good front-end to GDB and looks like Hopper is a good alternative. Unfortunately, I wasted several hours but still couldn't make it working with gdbserver. Here are the steps I'm ...
- 233
7
votes
2
answers
8k
views
How do I view external function calls in dynamically linked ELF binary in linux?
I used the file command in Linux to get information about a binary file. I am also looking for the addresses that these calls are located at. I think I can get this information from GDB or objdump but ...
- 385
7
votes
1
answer
2k
views
Understanding gdb output
So I was messing with gdb and came across something rather interesting. I ran the following code into gdb:
int i, g = 1;
for (i = 0; i < 100; i++)
g++;
Before execution, disas main ...
- 387
7
votes
2
answers
1k
views
Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll
As a pentester for a consulting agency, it is part of our job to "evade" antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, ...
- 133
7
votes
1
answer
2k
views
GDB Error "Too many array elements"
I'm trying to understand very basic stack-based buffer overflow
I'm running Debian wheezy on a x86_64 Macbook Pro.
I have the following unsafe program:
#include <stdlib.h>
#include <stdio.h&...
- 173
7
votes
1
answer
903
views
How to perform SIGTRAP emulation with GDB?
I am trying to analyze a crackme file.
When I open it with gdb, I firstly set its SIGTRAP handler with, e.g., int80.SIGTRAP handler address 0x8011111.
I caught it through catch syscall signal in gdb....
- 171
7
votes
2
answers
12k
views
Fixing corrupt ELF header field "e_shnum" for use in GDB
If the ELF header which usually can be read using readelf has been manually manipulated, let's say by increasing the value for the "Size of section headers" the binary still can be executed and works ...
- 125
7
votes
1
answer
926
views
Annotating the Stack in GDB?
Is there a GUI (or even a script for the CLI) for GDB that will annotate views of the stack with saved registers, each of the frames, etc? It should be possible to gather this information on each ...
- 265
7
votes
1
answer
7k
views
Problem while debugging with gdbserver in IDA Pro
I'm new to debugging with IDA Pro and I ran into the problem that my breakpoint is not hit while attempting to debug with gdbserver. The program is written by myself and it is simple to debug with gdb....
- 828
7
votes
1
answer
2k
views
Setting GDB watchpoint on a string
I am attempting to reverse engineer a 32-bit stripped, dynamically linked ELF executable. I want to know when a specific string is printed to the console. I ran the following command:
root@testbox>...
- 369
7
votes
1
answer
395
views
Attaching gdb to hidden library/process
On OSX I'm trying to debug/attach to a framework that the application unarchives at runtime. The frame work normally resides in the /Resources folder within the application bundle as .gz file.
The ...
- 171
6
votes
3
answers
16k
views
How to effectively bypass GCC stack smashing detection
I was solving bof challenge on http://pwnable.kr/play.php
it is required to smash the stack of the following code
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
void ...
- 335
6
votes
2
answers
14k
views
Run a python command with "run" on GDB
Hi I'd like to run a python command python -c 'print "\x90"*52' when the program start in GDB, as I would do when I execute : python -c 'print "\x90"*52' | ./myProg . Does anyone knows any way to ...
- 281
6
votes
1
answer
244
views
Strange GDB behavior in OSX
I'm reversing some malware on an OSX VM when I noticed something peculiar. While stepping through the instructions, the instruction just after a int 0x80 gets skipped i.e. gets executed without me ...
user1743
6
votes
2
answers
3k
views
what is radare2's equivalent to GDB's 'find &system,+9999999,"/bin/sh"'
What is radare2's equivalent to GDB's find &system,+9999999,"/bin/sh"?
- 263
6
votes
1
answer
4k
views
How to get current PHP function name in gdb?
I'm following these steps to locate the current PHP function call as below:
Run dummy script:
$ gdb -ex run --args php -r "sleep(10);"
Pressed Ctrl+C to get back to gdb to run:
(gdb) bt full
#1 ...
- 455
6
votes
2
answers
16k
views
Remote debugging with IDA and GDB
Recently I've run across an ELF file that I would like to debug using IDA. I've used GDB for basic debugging but I would like to utilize IDA. I've been researching for a while and can't seem to find ...
- 61
6
votes
1
answer
4k
views
How to get a full execution trace with Python gdb?
While trying to answer another question, I tried to set-up a Python script to automatize the extraction of an assembly execution trace. But, I am really not satisfied of this script and I would like ...
- 18.5k
6
votes
2
answers
2k
views
(linux) How to debug a "debugger"?
I'm trying to understand a program. This programm implements an antidebug technique.
From what I've understand so far, the father ptrace a forked process.
An the child does something like that:
...
- 121
6
votes
1
answer
4k
views
Printing Unicode strings in Gdb in OSX
Are there any useful snippets or Gdb functions that you guys normally use to print out Unicode strings? I'm trying to debug Mach-O binaries and x/s seems to be printing out junk. I believe the default ...
user1743
6
votes
1
answer
3k
views
Can I send gdb command from IDA Debugger to gdbserver?
I want to send gdb command (like "backtrace", "b *0xAAAAAAA", "i b", ...) from IDA debugger to gdbserver over gdb remote debugging and receive result and print it to output view of IDA, can I do it? ...
- 61
6
votes
0
answers
1k
views
Generating symbol file for closed-source binary by hand
I have a closed-source binary (minecraft-pi). For a given section of the assembly like so:
a2ed4: e92d45f8 push {r3, r4, r5, r6, r7, r8, sl, lr}
a2ed8: e1a04000 mov ...
- 161
5
votes
2
answers
19k
views
Find base address and memory size of program debugged in gdb
I want to find out the base address and the imagesize of the program being debugged in gdb. As in, where it got loaded in memory. For shared libraries I can do "info sharedlibrary" and I get very ...
- 423
5
votes
2
answers
283
views
Returning a C function to its grandfather
This is a homework assignment, so I'd appreciate it if I would get a hint only, not a full answer. I wrote this program which is supposed to print the following:
Executing function_a
Executing ...
user187
5
votes
1
answer
3k
views
Writing an exploit for sample-application
I understand the principles of exploiting a classical stack-based buffer-overflow, and now I want to practice it. Therefore I wrote the following test-application:
#include <stdio.h>
#include &...
- 63
5
votes
1
answer
2k
views
GDB find string strange results
I'm playing with gdb and strange things are happening. I wanted to find some address in memory where string "/bin/sh" is located, and gdb says it found it. But when I examine the memory there, the ...
4
votes
2
answers
3k
views
How to stop debugger right after the execution?
I'm using /bin/true as my sample binary (without available main method):
$ lldb /bin/true
(lldb) target create "/bin/true"
Current executable set to '/bin/true' (x86_64).
(lldb) break main
invalid ...
- 455
4
votes
3
answers
10k
views
GDB hangs when I try to run and debug a binary
When I type gdb a.out and then run inside the gdb itself I get stuck on the empty line:
jericho-laptop:exploit.education jericho$ gdb a.out
GNU gdb (GDB) 9.1
...
Reading symbols from a.out...
(No ...
- 191
4
votes
1
answer
1k
views
Different disassembly for the same function?
I have this code:
#include <stdio.h>
int main()
{
printf("a=%d; b=%d; c=%d", 1, 2, 3);
return 0;
};
I compile it with gcc -g 3arg.cpp. Disassemble with objdump -d -M intel a.out. In the output ...
- 41
Hot Network Questions
- Submitting fingerprints for Schengen visa: determine whether 5 years have passed?
- Source for the four questions you're asked at the gates
- How to evaluate the stability of a full wave precision rectifier
- Is the saying that "cops can use anything you say against you" overstated or understated?
- What happens when a fault occurs inside a electrical panel?
- Why are there many hidden holes in 'Monkie Kid’s Team Van' 80038?
- Detect sonar imposters
- How to Create Multiple Files (different names) to a specific directories at Once in a Linux Terminal
- How feasible would it be if cockroaches no bigger than an inch/2.5 centimeters took fall damage from around 6-7 feet in the air or less?
- What are the most precise measurements in science?
- How do I keep a dash shell script running despite any error?
- When did the expression “hustle culture” emerge?
- On the (non)linearity of electromagnetism
- Searching title of a dystopian story: In the future people are forced to sit in front of giant screens and must watch TV or movies as a punishment
- Table Alignment First Row Level
- What is the burning city referred to in the song "I'll Try" from the Tinkerbelle and the Lost Treasure soundrack?
- Integral calculus with Gamma function
- How does 60:8 reconcile with (offensive) Jihad?
- Is it 日本人 or にほんじん?
- Why are most of KBOS's instrument departures and arrivals jet-only?
- Why does the focus point of the eye does not burn the retina?
- Can Titania, Voice of Gaea be melded on the same turn that she is brought into play with Oath of Druids?
- Find out students max no of times not enrolled consecutively in a subject
- Field calculator formula converting DMS coordinate to decimal