Questions tagged [gdb]

A source level debugger based on `ptrace` for *NIX systems and developed by the GNU project.

Filter by
Sorted by
Tagged with
102
votes
1answer
78k views

How to handle stripped binaries with GDB? No source, no symbols and GDB only shows addresses?

I have GDB but the binary I want reverse engineer dynamically has no symbols, that is when I run the file utility it shows me stripped: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), ...
85
votes
17answers
109k views

Decent GUI for GDB

Learning the GDB commands is on my bucket-list, but in the meantime is there a graphical debugger for *nix platforms that accepts Windbg commands, and has similar functionality? For example, the ...
26
votes
1answer
72k views

Reversing ELF 64-bit LSB executable, x86-64 ,gdb

I'm a newbie and just got into RE. I got a ELF 64-bit LSB executable, x86-64. I'm trying to reverse it. First I tried to set a break point on line 1 using gdb ./filename break 1 The gdb says No ...
24
votes
4answers
33k views

Cross debugging for ARM / MIPS ELF with QEMU/toolchain

as i'm new about cross-debugging and cross-compilation i need some help because i feel so confused. I have a MIPS elf file, [myelf][1] .You can see bellow the output of file myelf: myelf: ELF 32-bit ...
18
votes
3answers
15k views

Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR

Given a position-independent, statically-linked, stripped binary, there does not appear to be a way in GDB to set a breakpoint at the entry point without disabling ASLR. break start and similar ...
17
votes
2answers
12k views

How to predict address space layout differences between real and gdb-controlled executions?

It's something that puzzle me for a long time. I can observe that there is a difference between the real execution of a program and the gdb-controlled one. But, here is an example: First, here is ...
11
votes
4answers
6k views

How can breakpoint be set using offset in ELF file, not virtual address?

First, generate a simple executable. (ignore the warnings, the executable runs anyway) echo 'main(){puts("123");}'|gcc -x c - -o a Load it with gdb a, then: (gdb) info file Symbols from "/home/...
11
votes
2answers
2k views

Encrypted Mach-o binary cannot be disassembled/traced with GDB

I'm trying to analyze an encrypted Mach-O binary (non-iPhone one), and I am observing the following strange behaviors: when I load this binary into GDB and try to disassemble the code at the address ...
9
votes
1answer
806 views

Understanding segment prefixes in assembly for Linux

In looking at some assembly, I have come across a few instructions using segment prefixes. For example <address>: .... mov eax,DWORD PTR gs:0x20 I understand the basics of memory segments, ...
9
votes
2answers
1k views

Connecting to jtag-openocd-gdb to arm11 device with IDA gets no control

I have a binary chunk from a piece of hardware I've been deciphering with IDA for a couple days now. Today I finally got a probe connected via JTAG and have openocd start up a GDB server. IDA is ...
9
votes
1answer
405 views

Equivalent of IDA FLIRT signatures for GDB?

Are there equivalent tools/procedures to IDA's FLIRT signatures, when working on statically linked binaries, with other disassemblers? Is it at all possible with GDB/objdump?
8
votes
3answers
1k views

Trying to reverse engineer C code that is 64bit assembly

This is the code I am looking at 0x0000000000401048 <+70>: mov 0x401ba0(,%rax,4),%eax This is an array of 15 integers. Just wondering how I can access indices 0 to 15 in gdb Thanks
8
votes
2answers
12k views

Why does `ldd` and `(gdb) info sharedlibrary` show a different library base address?

I see three different outputs for where libc should be loaded. ldd shows the loading address of libc at 0xf7e9e000 $ ldd ~/my_tool linux-gate.so.1 => (0xf7ffe000) libc.so.6 => /lib/...
8
votes
1answer
3k views

Run command on breakpoint without stopping

I'd like to automate the following in my .gdbinit: break boost::uuids::detail::sha1::process_bytes # When execution stops at the above breakpoint, # I want to display the contents of `rcx` as a ...
8
votes
2answers
3k views

Attaching GDB to a specific fork

I am trying to reverse engineer a Linux binary that makes several fork() calls. I am using GDB 7.5 on Ubuntu. What I am trying to do with GDB is attach to a certain fork() (say the second call). Is ...
8
votes
1answer
569 views

How does GDB's process recording work?

A curious and useful feature of GDB is process recording, allowing an analyst to step forwards and backwards through execution, writing a continuous log of the changes to program state that allow for ...
8
votes
2answers
3k views

Hopper on Linux — how to use GDBserver

I'm looking for a good front-end to GDB and looks like Hopper is a good alternative. Unfortunately, I wasted several hours but still couldn't make it working with gdbserver. Here are the steps I'm ...
8
votes
1answer
1k views

GDB via JTAG on ARM Hardware target without source code

Does anyone have other solutions for connecting to a remote ARM target without IDA? This is the question and below I give examples of setup's i have tried, should anyone be interested. Update: ...
7
votes
3answers
5k views

windows kernel debugging on Mac host (using VMware fusion)

in windows host we can use WinDBG and serial port communication for connection to windows kernel and the most easiest way is using VirtualKD. now the question is, is there any possibility of doing ...
7
votes
1answer
1k views

Understanding gdb output

So I was messing with gdb and came across something rather interesting. I ran the following code into gdb: int i, g = 1; for (i = 0; i < 100; i++) g++; Before execution, disas main ...
7
votes
1answer
9k views

What is the difference between step into and step over when debugging?

I am using EDB and stepping through the program but I do not even know what the difference in behavior is when doing this. I feel like this is something I should know if I ever have hope of reverse ...
7
votes
2answers
869 views

Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll

As a pentester for a consulting agency, it is part of our job to "evade" antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, ...
7
votes
1answer
5k views

Problem while debugging with gdbserver in IDA Pro

I'm new to debugging with IDA Pro and I ran into the problem that my breakpoint is not hit while attempting to debug with gdbserver. The program is written by myself and it is simple to debug with gdb....
7
votes
1answer
3k views

Getting IDAPro to analyse part of memory as PE-File

I am using Qemu with its internal GDB server to attach IDA Pro to an instance of Windows 8 x64. There are some problems to solve, because when I am connecting to the GDB server, I am just seeing a ...
7
votes
1answer
1k views

GDB issues: Can't set breakpoint on Obj-C method

I'm a beginner to reverse engineering, I've read through a few tutorials and know my way around some basic GDB and assembly code. After working my way through a few trivial examples I'd like to try ...
6
votes
3answers
11k views

How to effectively bypass GCC stack smashing detection

I was solving bof challenge on http://pwnable.kr/play.php it is required to smash the stack of the following code #include <stdio.h> #include <string.h> #include <stdlib.h> void ...
6
votes
2answers
6k views

How do I view external function calls in dynamically linked ELF binary in linux?

I used the file command in Linux to get information about a binary file. I am also looking for the addresses that these calls are located at. I think I can get this information from GDB or objdump but ...
6
votes
2answers
2k views

what is radare2's equivalent to GDB's 'find &system,+9999999,“/bin/sh”'

What is radare2's equivalent to GDB's find &system,+9999999,"/bin/sh"?
6
votes
1answer
1k views

GDB Error “Too many array elements”

I'm trying to understand very basic stack-based buffer overflow I'm running Debian wheezy on a x86_64 Macbook Pro. I have the following unsafe program: #include <stdlib.h> #include <stdio.h&...
6
votes
1answer
802 views

How to perform SIGTRAP emulation with GDB?

I am trying to analyze a crackme file. When I open it with gdb, I firstly set its SIGTRAP handler with, e.g., int80.SIGTRAP handler address 0x8011111. I caught it through catch syscall signal in gdb....
6
votes
1answer
832 views

Annotating the Stack in GDB?

Is there a GUI (or even a script for the CLI) for GDB that will annotate views of the stack with saved registers, each of the frames, etc? It should be possible to gather this information on each ...
6
votes
1answer
3k views

How to get a full execution trace with Python gdb?

While trying to answer another question, I tried to set-up a Python script to automatize the extraction of an assembly execution trace. But, I am really not satisfied of this script and I would like ...
6
votes
2answers
1k views

(linux) How to debug a “debugger”?

I'm trying to understand a program. This programm implements an antidebug technique. From what I've understand so far, the father ptrace a forked process. An the child does something like that: ...
6
votes
2answers
8k views

Fixing corrupt ELF header field “e_shnum” for use in GDB

If the ELF header which usually can be read using readelf has been manually manipulated, let's say by increasing the value for the "Size of section headers" the binary still can be executed and works ...
6
votes
1answer
2k views

Setting GDB watchpoint on a string

I am attempting to reverse engineer a 32-bit stripped, dynamically linked ELF executable. I want to know when a specific string is printed to the console. I ran the following command: root@testbox>...
6
votes
1answer
3k views

Can I send gdb command from IDA Debugger to gdbserver?

I want to send gdb command (like "backtrace", "b *0xAAAAAAA", "i b", ...) from IDA debugger to gdbserver over gdb remote debugging and receive result and print it to output view of IDA, can I do it? ...
6
votes
1answer
341 views

Attaching gdb to hidden library/process

On OSX I'm trying to debug/attach to a framework that the application unarchives at runtime. The frame work normally resides in the /Resources folder within the application bundle as .gz file. The ...
5
votes
1answer
232 views

Strange GDB behavior in OSX

I'm reversing some malware on an OSX VM when I noticed something peculiar. While stepping through the instructions, the instruction just after a int 0x80 gets skipped i.e. gets executed without me ...
5
votes
1answer
3k views

How to get current PHP function name in gdb?

I'm following these steps to locate the current PHP function call as below: Run dummy script: $ gdb -ex run --args php -r "sleep(10);" Pressed Ctrl+C to get back to gdb to run: (gdb) bt full #1 ...
5
votes
2answers
262 views

Returning a C function to its grandfather

This is a homework assignment, so I'd appreciate it if I would get a hint only, not a full answer. I wrote this program which is supposed to print the following: Executing function_a Executing ...
5
votes
2answers
14k views

Remote debugging with IDA and GDB

Recently I've run across an ELF file that I would like to debug using IDA. I've used GDB for basic debugging but I would like to utilize IDA. I've been researching for a while and can't seem to find ...
5
votes
1answer
2k views

Writing an exploit for sample-application

I understand the principles of exploiting a classical stack-based buffer-overflow, and now I want to practice it. Therefore I wrote the following test-application: #include <stdio.h> #include &...
5
votes
1answer
3k views

Printing Unicode strings in Gdb in OSX

Are there any useful snippets or Gdb functions that you guys normally use to print out Unicode strings? I'm trying to debug Mach-O binaries and x/s seems to be printing out junk. I believe the default ...
5
votes
0answers
942 views

Generating symbol file for closed-source binary by hand

I have a closed-source binary (minecraft-pi). For a given section of the assembly like so: a2ed4: e92d45f8 push {r3, r4, r5, r6, r7, r8, sl, lr} a2ed8: e1a04000 mov ...
4
votes
2answers
7k views

Run a python command with “run” on GDB

Hi I'd like to run a python command python -c 'print "\x90"*52' when the program start in GDB, as I would do when I execute : python -c 'print "\x90"*52' | ./myProg . Does anyone knows any way to ...
4
votes
1answer
977 views

Different disassembly for the same function?

I have this code: #include <stdio.h> int main() { printf("a=%d; b=%d; c=%d", 1, 2, 3); return 0; }; I compile it with gcc -g 3arg.cpp. Disassemble with objdump -d -M intel a.out. In the output ...
4
votes
2answers
585 views

ASM working as is, but not in a C program

I have this piece of ASM: section .text global _start _start: xor eax, eax push eax ; 0 to finish the /bin//sh string push 0x68732f2f ; //sh push 0x6e69622f ; /bin ...
4
votes
4answers
1k views

Tools to show the registers and memory locations in use during execution?

I am looking for something that is like gdb but maybe with a GUI that can show all registers current values ans the current values of memory and things on the stack? Freeware is preferred. I have a ...
4
votes
2answers
2k views

Modifying Control Flow of a running program

I am working on the binary bomb labs and i just disarmed the bomb i am planning on solving it through a debugger and work start to work on my dynamic analysis skills or i.e debugging my real question ...
4
votes
1answer
758 views

QEMU gdb server thread problem

I am having a problem using a statically compiled QEMU arm version. I am trying to debug an application from an embedded device. Everything seems to work fine except breakpoints on other threads. I am ...

1
2 3 4 5