Questions tagged [gdb]

A source level debugger based on `ptrace` for *NIX systems and developed by the GNU project.

Filter by
Sorted by
Tagged with
2
votes
2answers
876 views

Why is there a difference in offset between ida and gdb?

A PIE binary, when loaded in IDA shows an offset (0x202010) different from gdb (0x2013a1) for instruction located at 0x555555554c68 in (gdb) and 0xc68 (in IDA). How can I explain this discrepancy?
2
votes
0answers
312 views

Solve problem with debugging Linksys-wrt54gl with JTAG using BusPirate programmer

I am getting this output when I am issuing this command: $ sudo openocd -f board/MyBuspirate.cfg -f board/linksys-wrt54gl.cfg Open On-Chip Debugger 0.10.0+dev-00092-g77189db (2017-02-25-13:44) ...
4
votes
1answer
726 views

QEMU gdb server thread problem

I am having a problem using a statically compiled QEMU arm version. I am trying to debug an application from an embedded device. Everything seems to work fine except breakpoints on other threads. I am ...
2
votes
1answer
656 views

Buffer overflow on server

I have a server (for reference: pastebin.com/ghJX69uH) that I can netcat to and it will ask to input a message. I know it is vulnerable to buffer overflow, but I can't seem to get the shellcode to ...
1
vote
1answer
580 views

How can I change the values in esp?

0x08048785 <+344>: movl $0x0,0xc(%esp) 0x0804878d <+352>: movl $0x804896c,0x8(%esp) 0x08048795 <+360>: movl $0x8048973,0x4(%esp) 0x0804879d <+368>: movl ...
0
votes
1answer
506 views

Given a heap address, can gdb show which function allocated the heap at this address?

In windbg, we can use "!heap -p -a [address]" to show the stacktrace when the heap was allocated. In gdb, especially for kernel debugging, there is any way to achieve the same thing in linux?
4
votes
0answers
1k views

GDB find string strange results

I'm playing with gdb and strange things are happening. I wanted to find some address in memory where string "/bin/sh" is located, and gdb says it found it. But when I examine the memory there, the ...
1
vote
1answer
381 views

I have a problem with understanding the register %bl

0x080484ad <+0>: xor %ebx,%ebx 0x080484af <+2>: mov (%eax),%bl ***** 0x080484b1 <+4>: xor $0x52,%bl 0x080484b4 <+7>: cmp $0x11,%bl ...
2
votes
1answer
2k views

GCC change the order of variable declaration

I have this very simple piece of code: // test.c int main(){ int a = 0; char b[10]; int c = 0; return 0; } Compiled with gcc (6.2.1): $ gcc -g -o test test.c And analysed with gdb: $ gdb ...
2
votes
1answer
2k views

Why doesn't the breakpoint get hit in gdb?

I was following the writeup of the challenge tehran. If I set a breakpoint 0x804bade, it never gets hit for the following input. begin() { fillout(0x8048000, 16384, 7); puts("%144c%n", 42, ...
0
votes
1answer
456 views

Why can't gdb find symbol which IDA can?

I was reversing this binary. While I tried to set a breakpoint in gdb on main function, it couldn't find its definition. Loading up the same binary in IDA shows up main method in the Function pane. ...
1
vote
1answer
4k views

Passing argument through registers instead of the stack

I'm learning (and re-learning) C and assembly, and I came across a difference between what I've been taught and the actual result I have. Some code: int test(int a, int b){ return a + b; } int ...
0
votes
1answer
154 views

why 'ni' goes into function in Android gdb debugging?

I'm debugging android JNI with gdb without source code. I use ni command to step over arm asm instructions. I suppose ni is step over, but it still goes into function like BL xxxx, and I have to use ...
1
vote
1answer
1k views

gdb shows wrong instruction

I'm debugging android jni with gdb. There's a jni function A(), I need to set breakpoint there and step through. I calculated the address with module_base+offset, which is 0x99B62C7A, then I tried to ...
1
vote
1answer
568 views

Call Android method without running whole Android-App

I want to ask if somebody is aware of tools/projects which are similar to the Appcall feature of IDA Pro[1] for Android Apps? I'm looking for the possibility to run certain methods detected in the ...
0
votes
1answer
40 views

Is there a predictable interval between instructions of main methods in carbon?

Let's say I have a carbon objective-c executable, and a crash report. From the crash report, it is apparent that the main method is located at 0x00002639, and the NSApplicationMain method from the ...
2
votes
0answers
201 views

Giving labels to local variables with GDB

In the GDB debugger of Linux, is it possible to give a local variable (at specific offset from the %esp register) a constant name, which I will see everytime I call disassemble instead of seeing the ...
5
votes
2answers
7k views

Fixing corrupt ELF header field “e_shnum” for use in GDB

If the ELF header which usually can be read using readelf has been manually manipulated, let's say by increasing the value for the "Size of section headers" the binary still can be executed and works ...
-1
votes
1answer
850 views

How do you effectively use gdb and IDA together?

When dealing with linux binaries, I like IDA as my static analysis tool and gdb as my debugger. However I have not found an effective way to integrate the two with each other. To give an example, let'...
0
votes
2answers
872 views

Recovering variable name in debugger

This question somehow relates to my previous question, but now I have a binary which is not stripped. Let's say I have the following code snippet QString my_variable("almafa"); qDebug() << ...
3
votes
1answer
1k views

Reversing Qt application

I want to reverse-engineer a Qt crackme written for linux. I would like to follow where introduced text gets. I have found this gdb macro to print QStrings (Qt5). To test it I wrote a simple ...
2
votes
2answers
501 views

Call function in remote (OpenOCD) target from gdb

Is there any way to call a function on a remote target that's attached via JTAG? Currently I have OpenOCD hooked up to a target and I'm attached with gdb, and I know the address of the function I want ...
4
votes
1answer
957 views

Different disassembly for the same function?

I have this code: #include <stdio.h> int main() { printf("a=%d; b=%d; c=%d", 1, 2, 3); return 0; }; I compile it with gcc -g 3arg.cpp. Disassemble with objdump -d -M intel a.out. In the output ...
6
votes
3answers
10k views

How to effectively bypass GCC stack smashing detection

I was solving bof challenge on http://pwnable.kr/play.php it is required to smash the stack of the following code #include <stdio.h> #include <string.h> #include <stdlib.h> void ...
0
votes
1answer
122 views

Reverse engineering parameter value on subroutine call

I'm trying to find out what value a certain parameter has when it's called (I know "parameters" are gone after compiled, but you get the idea). The pseudo-C and assembly code are: sub_171F4A0(ctx, ...
3
votes
1answer
487 views

How to test if register value is unavailable in gdb?

I'm using a .gdbinit file that is supposed to print the values of all registers at every hook_stop, followed by the stack and data frames. However, when running many programs, there are often segment ...
4
votes
1answer
1k views

How Can I Debug A Bios Better

I am trying to reverse engineer a firmkit in a bios, but in general I would like to know how can I debug a bios better. I found a way to attach IDA to a vmware instance usign a GDB session GDB ...
2
votes
2answers
1k views

Help with IOLI crackme0x02

I am studying IOLI crackme0x02. It is clear to me that rewriting the jump at 0x8048451 with no instructions the crackme can be patched. However, I want to understand better what the code does. My ...
6
votes
1answer
3k views

How to get a full execution trace with Python gdb?

While trying to answer another question, I tried to set-up a Python script to automatize the extraction of an assembly execution trace. But, I am really not satisfied of this script and I would like ...
3
votes
1answer
11k views

how to setup IDA pro linux GDB server

I have Ubuntu 14.04 x64 and I am running Ida pro V6.6 in virtual box in windows 8 ... currently I want to debug some Linux elf's using Ida either via IDA linux remote server or gdbserver but I don't ...
2
votes
1answer
615 views

Unpacking and the ESP trick

I recently heard about the esp trick: some packers push all registers on the stack, and when unpacking is done, they are restored. Placing a hardware breakpoint on esp we can stop there and get the ...
0
votes
1answer
302 views

buffer overflow-seg fault

I am trying to overflow a buffer, which has a size of 0x201 bytes, and get a shellcode. The program that contains the buffer,there is a call to ptrace() (on itself), therefore the shellcode I'm using ...
0
votes
2answers
1k views

Detecting debugger with `rdtsc`

I am reading Eldad Eilam's book titled Reversing. In Chapter 11: Breaking Protections, there is a crackme called Defender, which creates a dedicated thread, which repeats the following steps: 1. ...
1
vote
0answers
351 views

An anti debug method on Linux [duplicate]

I have found this question (linux) How to debug a "debugger"? It is an anti debug technique, the parent creates a forked process and ptrace it. Now gdb can not attach top the child process. ...
0
votes
1answer
800 views

Hiding call to ptrace [duplicate]

I am trying to detect whether my executable is running in a debugger. Here is a solution using ptrace. My problem is that even if my executable is stripped (strip a.out) I am able to find with gdb the ...
2
votes
2answers
441 views

Reverse engineering self-checking binary

I have linux binary, written in C. During runtime I calculate the checksum of the binary, and it seems that this prevents setting up gdb software breakpoints in it. How safe is this from a reverse ...
3
votes
1answer
883 views

using GDB and dealing with breakpoint detection

I am trying to solve a reverse engineering challenge using using gdb. I can run the program inside it but when I set a breakpoint at main then I get Program received signal SIGSEGV, Segmentation ...
2
votes
1answer
682 views

Set Breakpoint at Entry point fails (GDB)

I'm currently practicing some RE w/ GDB and am having issues simply stopping the run/start on the first/second instruction. I am new to GDB/RE and have a limited knowledge of some of GDB's inner ...
0
votes
1answer
3k views

Strcpy BufferOverflow get shellcode location for EIP

I am trying to get a shellcode, exploiting a C program with a strcpy() function. I have found out that I need 68 bytes to start writing on the EIP. So, if I write 72's by EIP register is 0x41414141. ...
5
votes
1answer
2k views

Writing an exploit for sample-application

I understand the principles of exploiting a classical stack-based buffer-overflow, and now I want to practice it. Therefore I wrote the following test-application: #include <stdio.h> #include &...
0
votes
1answer
3k views

How To Set Breakpoints On An Assembly Program Not Compiled With Debugging Symbols?

I have an executable file I put together from an demo powerpc assembly program I whipped together. AssemblyProgram.s .global _Start .text _Start: addi 3, 0, 0xa addi 4, 0, 0xb addi 5, 0,...
2
votes
0answers
1k views

Debugging a position independent executable ELF

I am trying to follow the write-up about hackercalc (a challenge for DEFCON 2015 quals). First, by loading the challenge into gdb, I observe that: (gdb) info files ... Entry point: 0xcf8 ... So I ...
1
vote
1answer
626 views

Variable's position on stack

I wanna create a script/program that will modify value in memory of another process. With GDB I've discovered that variable I want modify is located on heap. Because this variable is create ...
3
votes
2answers
2k views

How to stop debugger right after the execution?

I'm using /bin/true as my sample binary (without available main method): $ lldb /bin/true (lldb) target create "/bin/true" Current executable set to '/bin/true' (x86_64). (lldb) break main invalid ...
1
vote
0answers
155 views

How to dump PHP backtrace on live running script in lldb?

I'm trying to print PHP backtrace of the live running script using the following 2 simple steps: Run PHP script as: php -r "sleep(1000);" On another console, I've called directly ...
5
votes
1answer
3k views

How to get current PHP function name in gdb?

I'm following these steps to locate the current PHP function call as below: Run dummy script: $ gdb -ex run --args php -r "sleep(10);" Pressed Ctrl+C to get back to gdb to run: (gdb) bt full #1 ...
2
votes
1answer
454 views

lldb - breakpoint not reached when attach do process (but executing when set before app running)

I am trying to set breakpoint to existing processes, but when i am trying to do it breakpoint is not reached, but when i am running app directly in lldb and set breakpoint before it runs all ...
1
vote
0answers
247 views

gdbserver doesn't trigger breakpoints

I'm debugging a vulnerable app on a remote host. I've set up gbserver on the host with: gdbserver host:1234 /my/target/app On my local host I've connected with: $ gdb /same/target/app gdb$ target ...
2
votes
2answers
6k views

Debug binary with GDB & disassembly: File format not recognized (elf headers corrupted)

I'm trying to reverse engineer a binary file using GDB and objdump. I can execute the binary in my linux shell, however the file seems to be changed in a way that it can't be debugged / reverse ...
3
votes
1answer
5k views

Output of gdb `info registers`

Upon running info registers in gdb, we get an output similar to the following: rax 0x1c 28 rbx 0x0 0 rcx 0x400a60 4196960 rdx 0x7fffffffde88 ...