Questions tagged [gdb]

A source level debugger based on `ptrace` for *NIX systems and developed by the GNU project.

Filter by
Sorted by
Tagged with
1
vote
1answer
310 views

Break anywhere when $r1 equals to string GDB

Is there anyway to break on gdb where $r1 equals to a certain string I know there is : break [addr] if ((int)strcmp($r1, "hello")) == 0 But what to set in addr when I just wanna break when the r1 is ...
1
vote
1answer
561 views

How to set breakpoints in GDB on remote target without an executable?

I'm trying to use a gdb client running on my host machine to talk to a GDB server running on a debug probe. I can connect using the "target remote" command, and I can single step, use monitor ...
1
vote
0answers
220 views

Stack buffer overflow SIGSEGV help

I've been going at this for a couple of days now working through trial and error but I can't seem to pinpoint exactly why I'm still getting a SIGSEGV. Here's the stdout of me stepping through the ...
2
votes
1answer
253 views

Debugging Binary using Far Ret to switch Code Segment

It appears that GDB is unable to handle binaries which switch code segments. Using pwntools*, it's trivial to generate a 32-bit intel binary which uses retf to switch to the 64-bit code segment. ...
2
votes
2answers
708 views

Password Bruteforce using angr

I am having a binary which takes an input from user and checks every bit of our character using the check_value function which does some stuff. The disassembly of the interested function is: .text:...
5
votes
0answers
723 views

Generating symbol file for closed-source binary by hand

I have a closed-source binary (minecraft-pi). For a given section of the assembly like so: a2ed4: e92d45f8 push {r3, r4, r5, r6, r7, r8, sl, lr} a2ed8: e1a04000 mov ...
6
votes
2answers
1k views

what is radare2's equivalent to GDB's 'find &system,+9999999,“/bin/sh”'

What is radare2's equivalent to GDB's find &system,+9999999,"/bin/sh"?
1
vote
0answers
599 views

My core dump's backtrace stops to a signal handler, what can I do?

I obtained an ELF core dump that was provoked by fuzzing a proprietary server. As I do not have access anymore to the machine that hosted this server, and the server is part of a tightly coupled set ...
2
votes
2answers
2k views

Why does my shellcode work in gdb but not on the command line

So I just started with reverse engineering and have run into some issues until I recently noticed something strange. I wrote an extremely simple shellcode (exit system call) for practice and I played ...
6
votes
1answer
1k views

Understanding gdb output

So I was messing with gdb and came across something rather interesting. I ran the following code into gdb: int i, g = 1; for (i = 0; i < 100; i++) g++; Before execution, disas main ...
1
vote
1answer
425 views

Debugging EXE File in Windbg and How to set Breakpoints in Assembly

I am trying to set a breakpoint (created in assembly) and step into an EXE file line by line to watch registers and memory behavior. I have done this easily with gdb under Linux like this. gdb -q ./...
1
vote
2answers
285 views

Added instruction to shellcode

I have the following shellcode: xor eax, eax ; eax = 0 push eax ; 0 (end of the string) push 0x68732f2f ; //sh push 0x6e69622f ; /bin mov ebx, esp ; ebx = &(/bin//sh) xor ecx, ecx ...
1
vote
1answer
472 views

gdb-multiarch Segmentation fault

I've followed the guide from Cross debugging for MIPS ELF with QEMU/toolchain to cross compile a simple hello world application, but for some reason I get a segmentation fault when opening it with gdb-...
4
votes
2answers
493 views

ASM working as is, but not in a C program

I have this piece of ASM: section .text global _start _start: xor eax, eax push eax ; 0 to finish the /bin//sh string push 0x68732f2f ; //sh push 0x6e69622f ; /bin ...
2
votes
0answers
901 views

IDA Pro GDB QEMU Tricore setup

I have added the lines below to IDA 6.95\cfg\gdb_arch.cfg to try to get QEMU Tricore debugging in IDA Pro, using an ARM tutorial as the basis (page 2): https://www.hex-rays.com/products/ida/support/...
1
vote
2answers
556 views

Understanding an if statement in assembly

I have written two simple C programs (one with an if and one without). Looking at the assembly differences there are a few lines that I can't manage to explain and was hoping to get some assistance. ...
1
vote
1answer
755 views

Loading user specified IDA symbols in GDB

While reversing a binary, whatever symbols we name inside IDA IDB database, is it possible to load the same in GDB while debugging? e.g. I tried wsym which attempts to inject those as symbols. However,...
-1
votes
1answer
287 views

Practicing what SHOULD be a simple crackme. Program calls strlen() but never returns

I'm trying out a crackme from the "LSE CTF" called "Blue Box" worth only 10 points. I've attempted this inside GDB and radare2... It is very simple, takes one argument and first checks to make sure ...
-1
votes
1answer
308 views

Disassembling code with Hopper

I'm trying to figure out what this code is doing. The first thing that I don't understand is the condition that tests if arg0's value is 0x2. I read that 0x2 in ASCII is STX (Start of text). Here's ...
2
votes
1answer
2k views

How to read canary value in gdb?

In a program I am debugging, the canary value is read to eax from gs:0x14 memory location. I am attaching gdb to the process late enough to break on the mov reading the canary to eax. Therefore, ...
1
vote
0answers
135 views

What does 'mapped' memory region mean in gdb-peda?

I was reading a write-up of a binary exploitation where I came across the following: What does the mapped keyword listed under Name column mean? What sort of memory region does it refer to?
2
votes
1answer
955 views

Why can't gdb read memory if pwntools is used to send input?

Here is the program which gdb is attached to: prog.c #include <stdio.h> void dummy(char* s) { } int main() { char buf[512]; scanf("%s", buf); printf("%s\n", buf); dummy(buf);...
3
votes
2answers
2k views

Changing Entrypoint in ELF executable

I wrote some code that does the following: Searches for and finds an offset in a binary file to add code (looks for a sequence of 00s I can overwrite). Then, I change the entrypoint of the ELF to ...
1
vote
0answers
225 views

Find string in stripped binary file use gdb

Does this debugger support this feature? Through find it is impossible, as the file stripped.
2
votes
2answers
732 views

Why is there a difference in offset between ida and gdb?

A PIE binary, when loaded in IDA shows an offset (0x202010) different from gdb (0x2013a1) for instruction located at 0x555555554c68 in (gdb) and 0xc68 (in IDA). How can I explain this discrepancy?
2
votes
0answers
259 views

Solve problem with debugging Linksys-wrt54gl with JTAG using BusPirate programmer

I am getting this output when I am issuing this command: $ sudo openocd -f board/MyBuspirate.cfg -f board/linksys-wrt54gl.cfg Open On-Chip Debugger 0.10.0+dev-00092-g77189db (2017-02-25-13:44) ...
4
votes
1answer
550 views

QEMU gdb server thread problem

I am having a problem using a statically compiled QEMU arm version. I am trying to debug an application from an embedded device. Everything seems to work fine except breakpoints on other threads. I am ...
2
votes
1answer
585 views

Buffer overflow on server

I have a server (for reference: pastebin.com/ghJX69uH) that I can netcat to and it will ask to input a message. I know it is vulnerable to buffer overflow, but I can't seem to get the shellcode to ...
1
vote
1answer
475 views

How can I change the values in esp?

0x08048785 <+344>: movl $0x0,0xc(%esp) 0x0804878d <+352>: movl $0x804896c,0x8(%esp) 0x08048795 <+360>: movl $0x8048973,0x4(%esp) 0x0804879d <+368>: movl ...
0
votes
1answer
448 views

Given a heap address, can gdb show which function allocated the heap at this address?

In windbg, we can use "!heap -p -a [address]" to show the stacktrace when the heap was allocated. In gdb, especially for kernel debugging, there is any way to achieve the same thing in linux?
3
votes
0answers
806 views

GDB find string strange results

I'm playing with gdb and strange things are happening. I wanted to find some address in memory where string "/bin/sh" is located, and gdb says it found it. But when I examine the memory there, the ...
1
vote
1answer
332 views

I have a problem with understanding the register %bl

0x080484ad <+0>: xor %ebx,%ebx 0x080484af <+2>: mov (%eax),%bl ***** 0x080484b1 <+4>: xor $0x52,%bl 0x080484b4 <+7>: cmp $0x11,%bl ...
2
votes
1answer
1k views

GCC change the order of variable declaration

I have this very simple piece of code: // test.c int main(){ int a = 0; char b[10]; int c = 0; return 0; } Compiled with gcc (6.2.1): $ gcc -g -o test test.c And analysed with gdb: $ gdb ...
2
votes
1answer
1k views

Why doesn't the breakpoint get hit in gdb?

I was following the writeup of the challenge tehran. If I set a breakpoint 0x804bade, it never gets hit for the following input. begin() { fillout(0x8048000, 16384, 7); puts("%144c%n", 42, ...
0
votes
1answer
349 views

Why can't gdb find symbol which IDA can?

I was reversing this binary. While I tried to set a breakpoint in gdb on main function, it couldn't find its definition. Loading up the same binary in IDA shows up main method in the Function pane. ...
1
vote
1answer
3k views

Passing argument through registers instead of the stack

I'm learning (and re-learning) C and assembly, and I came across a difference between what I've been taught and the actual result I have. Some code: int test(int a, int b){ return a + b; } int ...
0
votes
1answer
117 views

why 'ni' goes into function in Android gdb debugging?

I'm debugging android JNI with gdb without source code. I use ni command to step over arm asm instructions. I suppose ni is step over, but it still goes into function like BL xxxx, and I have to use ...
1
vote
1answer
778 views

gdb shows wrong instruction

I'm debugging android jni with gdb. There's a jni function A(), I need to set breakpoint there and step through. I calculated the address with module_base+offset, which is 0x99B62C7A, then I tried to ...
1
vote
1answer
486 views

Call Android method without running whole Android-App

I want to ask if somebody is aware of tools/projects which are similar to the Appcall feature of IDA Pro[1] for Android Apps? I'm looking for the possibility to run certain methods detected in the ...
0
votes
1answer
40 views

Is there a predictable interval between instructions of main methods in carbon?

Let's say I have a carbon objective-c executable, and a crash report. From the crash report, it is apparent that the main method is located at 0x00002639, and the NSApplicationMain method from the ...
2
votes
0answers
163 views

Giving labels to local variables with GDB

In the GDB debugger of Linux, is it possible to give a local variable (at specific offset from the %esp register) a constant name, which I will see everytime I call disassemble instead of seeing the ...
5
votes
1answer
5k views

Fixing corrupt ELF header field “e_shnum” for use in GDB

If the ELF header which usually can be read using readelf has been manually manipulated, let's say by increasing the value for the "Size of section headers" the binary still can be executed and works ...
-1
votes
1answer
700 views

How do you effectively use gdb and IDA together?

When dealing with linux binaries, I like IDA as my static analysis tool and gdb as my debugger. However I have not found an effective way to integrate the two with each other. To give an example, let'...
0
votes
2answers
678 views

Recovering variable name in debugger

This question somehow relates to my previous question, but now I have a binary which is not stripped. Let's say I have the following code snippet QString my_variable("almafa"); qDebug() << ...
2
votes
1answer
1k views

Reversing Qt application

I want to reverse-engineer a Qt crackme written for linux. I would like to follow where introduced text gets. I have found this gdb macro to print QStrings (Qt5). To test it I wrote a simple ...
2
votes
2answers
443 views

Call function in remote (OpenOCD) target from gdb

Is there any way to call a function on a remote target that's attached via JTAG? Currently I have OpenOCD hooked up to a target and I'm attached with gdb, and I know the address of the function I want ...
4
votes
1answer
869 views

Different disassembly for the same function?

I have this code: #include <stdio.h> int main() { printf("a=%d; b=%d; c=%d", 1, 2, 3); return 0; }; I compile it with gcc -g 3arg.cpp. Disassemble with objdump -d -M intel a.out. In the output ...
4
votes
3answers
8k views

How to effectively bypass GCC stack smashing detection

I was solving bof challenge on http://pwnable.kr/play.php it is required to smash the stack of the following code #include <stdio.h> #include <string.h> #include <stdlib.h> void ...
0
votes
1answer
117 views

Reverse engineering parameter value on subroutine call

I'm trying to find out what value a certain parameter has when it's called (I know "parameters" are gone after compiled, but you get the idea). The pseudo-C and assembly code are: sub_171F4A0(ctx, ...
3
votes
1answer
371 views

How to test if register value is unavailable in gdb?

I'm using a .gdbinit file that is supposed to print the values of all registers at every hook_stop, followed by the stack and data frames. However, when running many programs, there are often segment ...