Questions tagged [gdb]

A source level debugger based on `ptrace` for *NIX systems and developed by the GNU project.

Filter by
Sorted by
Tagged with
7
votes
1answer
4k views

Problem while debugging with gdbserver in IDA Pro

I'm new to debugging with IDA Pro and I ran into the problem that my breakpoint is not hit while attempting to debug with gdbserver. The program is written by myself and it is simple to debug with gdb....
0
votes
2answers
884 views

Hex representation of integer values in excess of FF (255)

I am learning some gdb and it is covering examining arrays. There is the following code, and I see it is 4 bytes, and how a[1] = 2 in an array int a[] = {1,2,3} (gdb) x/4xb a + 1 0x7fff5fbff570: 0x02 ...
1
vote
1answer
730 views

Why can't gdb find the address of a stack variable

I am getting the following from gdb: Below is the source of the program and the tutorial it came from. BAsed on what is going on in the tutorial, I should not be getting an error. int main() { ...
-1
votes
1answer
97 views

Learning disASM, other things

I am somewhat interested in learning how to RE but right now am learning C, and was wondering if anyone could give me a link to a good tutorial on how to use gdb Also, in reference to registers...if ...
8
votes
1answer
742 views

Understanding segment prefixes in assembly for Linux

In looking at some assembly, I have come across a few instructions using segment prefixes. For example <address>: .... mov eax,DWORD PTR gs:0x20 I understand the basics of memory segments, ...
4
votes
2answers
2k views

Modifying Control Flow of a running program

I am working on the binary bomb labs and i just disarmed the bomb i am planning on solving it through a debugger and work start to work on my dynamic analysis skills or i.e debugging my real question ...
7
votes
1answer
7k views

What is the difference between step into and step over when debugging?

I am using EDB and stepping through the program but I do not even know what the difference in behavior is when doing this. I feel like this is something I should know if I ever have hope of reverse ...
2
votes
1answer
3k views

Set breakpoint on shared library

I am a noob to the reversing world. I have a Android Java application which uses a shared library via JNI and I would like to set a breakpoint in the shared library. The shared library is stripped ...
4
votes
4answers
1k views

Tools to show the registers and memory locations in use during execution?

I am looking for something that is like gdb but maybe with a GUI that can show all registers current values ans the current values of memory and things on the stack? Freeware is preferred. I have a ...
0
votes
2answers
2k views

At which address on the stack or in memory is eax stored after the malloc call? [closed]

Here is my objdump -d snippet with the malloc call and surrounding code. This binary is stripped. dbgLab.bin: file format elf32-i386 080483d0 <malloc@plt>: 80483d0: ff 25 04 a0 04 08 ...
0
votes
2answers
556 views

What is the address of main() and how many bytes does it allocate on the stack for its frame size?

Here is my objdump -d output but I do not know where to look. I understand assembly but it is a little confusing trying to find out what the values of registers are at certain points. If anyone knows ...
5
votes
2answers
5k views

How do I view external function calls in dynamically linked ELF binary in linux?

I used the file command in Linux to get information about a binary file. I am also looking for the addresses that these calls are located at. I think I can get this information from GDB or objdump but ...
1
vote
0answers
285 views

qemu and gdb error: could not load xml document

I'm trying to debug an application using Qemu for AARCH64 ./qemu-arm64-static -g 1234 file.bin When running GDB and connecting to the remote host, I get the following error message: $ ./aarch64-...
2
votes
1answer
2k views

gdb setting fs register on Linux

I'm debugging an ELF 64-bit binary using gdb and I notice that the %fs register is set to 0x63. For some testing that I'd like to perform I'd like to set the %fs register to 0x00. I tried doing a set ...
4
votes
2answers
3k views

Can not continue debugging after SIGTRAP

I am trying to debug an iOS app with gdb and when I hit a breakpoint I get this error, and can not continue. Program received signal SIGTRAP, Trace/breakpoint trap. [Switching to process 190 thread ...
24
votes
1answer
57k views

Reversing ELF 64-bit LSB executable, x86-64 ,gdb

I'm a newbie and just got into RE. I got a ELF 64-bit LSB executable, x86-64. I'm trying to reverse it. First I tried to set a break point on line 1 using gdb ./filename break 1 The gdb says No ...
6
votes
1answer
3k views

Run command on breakpoint without stopping

I'd like to automate the following in my .gdbinit: break boost::uuids::detail::sha1::process_bytes # When execution stops at the above breakpoint, # I want to display the contents of `rcx` as a ...
2
votes
1answer
1k views

Is there something like follow-fork-mode for gdbserver?

My question is quite straight forward: is there a possibility to tell gdbserver to follow the child when forking like set follow-fork-mode child
7
votes
1answer
1k views

GDB issues: Can't set breakpoint on Obj-C method

I'm a beginner to reverse engineering, I've read through a few tutorials and know my way around some basic GDB and assembly code. After working my way through a few trivial examples I'd like to try ...
8
votes
1answer
1k views

GDB via JTAG on ARM Hardware target without source code

Does anyone have other solutions for connecting to a remote ARM target without IDA? This is the question and below I give examples of setup's i have tried, should anyone be interested. Update: ...
15
votes
2answers
10k views

How to predict address space layout differences between real and gdb-controlled executions?

It's something that puzzle me for a long time. I can observe that there is a difference between the real execution of a program and the gdb-controlled one. But, here is an example: First, here is ...
6
votes
1answer
771 views

How to perform SIGTRAP emulation with GDB?

I am trying to analyze a crackme file. When I open it with gdb, I firstly set its SIGTRAP handler with, e.g., int80.SIGTRAP handler address 0x8011111. I caught it through catch syscall signal in gdb....
2
votes
2answers
893 views

Reversing a Mac OS X binary that appears to be non encrypted, backtrace just shows mach_msg_trap ()

Currently I have a binary that I am investigating. The application is GUI / event driven, so that makes it difficult to set a break point. I would like to set a break point on a certain button click,...
9
votes
2answers
956 views

Connecting to jtag-openocd-gdb to arm11 device with IDA gets no control

I have a binary chunk from a piece of hardware I've been deciphering with IDA for a couple days now. Today I finally got a probe connected via JTAG and have openocd start up a GDB server. IDA is ...
7
votes
1answer
3k views

Getting IDAPro to analyse part of memory as PE-File

I am using Qemu with its internal GDB server to attach IDA Pro to an instance of Windows 8 x64. There are some problems to solve, because when I am connecting to the GDB server, I am just seeing a ...
6
votes
1answer
324 views

Attaching gdb to hidden library/process

On OSX I'm trying to debug/attach to a framework that the application unarchives at runtime. The frame work normally resides in the /Resources folder within the application bundle as .gz file. The ...
11
votes
2answers
2k views

Encrypted Mach-o binary cannot be disassembled/traced with GDB

I'm trying to analyze an encrypted Mach-O binary (non-iPhone one), and I am observing the following strange behaviors: when I load this binary into GDB and try to disassemble the code at the address ...
6
votes
1answer
2k views

Setting GDB watchpoint on a string

I am attempting to reverse engineer a 32-bit stripped, dynamically linked ELF executable. I want to know when a specific string is printed to the console. I ran the following command: root@testbox>...
8
votes
2answers
2k views

Attaching GDB to a specific fork

I am trying to reverse engineer a Linux binary that makes several fork() calls. I am using GDB 7.5 on Ubuntu. What I am trying to do with GDB is attach to a certain fork() (say the second call). Is ...
7
votes
3answers
5k views

windows kernel debugging on Mac host (using VMware fusion)

in windows host we can use WinDBG and serial port communication for connection to windows kernel and the most easiest way is using VirtualKD. now the question is, is there any possibility of doing ...
5
votes
2answers
13k views

Remote debugging with IDA and GDB

Recently I've run across an ELF file that I would like to debug using IDA. I've used GDB for basic debugging but I would like to utilize IDA. I've been researching for a while and can't seem to find ...
3
votes
2answers
985 views

gdb on FreeBSD and follow-fork-mode child

Long time ago I noticed that using set follow-fork-mode child in GDB on FreeBSD doesn't really work. This problem occurs very often with some challenges on various Capture The Flag contests. For ...
6
votes
1answer
1k views

GDB Error “Too many array elements”

I'm trying to understand very basic stack-based buffer overflow I'm running Debian wheezy on a x86_64 Macbook Pro. I have the following unsafe program: #include <stdlib.h> #include <stdio.h&...
6
votes
1answer
687 views

Annotating the Stack in GDB?

Is there a GUI (or even a script for the CLI) for GDB that will annotate views of the stack with saved registers, each of the frames, etc? It should be possible to gather this information on each ...
5
votes
1answer
226 views

Strange GDB behavior in OSX

I'm reversing some malware on an OSX VM when I noticed something peculiar. While stepping through the instructions, the instruction just after a int 0x80 gets skipped i.e. gets executed without me ...
8
votes
3answers
1k views

Trying to reverse engineer C code that is 64bit assembly

This is the code I am looking at 0x0000000000401048 <+70>: mov 0x401ba0(,%rax,4),%eax This is an array of 15 integers. Just wondering how I can access indices 0 to 15 in gdb Thanks
88
votes
1answer
66k views

How to handle stripped binaries with GDB? No source, no symbols and GDB only shows addresses?

I have GDB but the binary I want reverse engineer dynamically has no symbols, that is when I run the file utility it shows me stripped: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), ...
5
votes
1answer
3k views

Printing Unicode strings in Gdb in OSX

Are there any useful snippets or Gdb functions that you guys normally use to print out Unicode strings? I'm trying to debug Mach-O binaries and x/s seems to be printing out junk. I believe the default ...
3
votes
2answers
377 views

Why is this string on the stack not exactly the one I entered? [closed]

I was trying to understand buffer overflow attacks using the following C program #include"stdio.h" #include"string.h" void iwontprint() { printf("i wont be printed!"); } void ...
74
votes
16answers
92k views

Decent GUI for GDB

Learning the GDB commands is on my bucket-list, but in the meantime is there a graphical debugger for *nix platforms that accepts Windbg commands, and has similar functionality? For example, the ...
8
votes
1answer
554 views

How does GDB's process recording work?

A curious and useful feature of GDB is process recording, allowing an analyst to step forwards and backwards through execution, writing a continuous log of the changes to program state that allow for ...
9
votes
1answer
388 views

Equivalent of IDA FLIRT signatures for GDB?

Are there equivalent tools/procedures to IDA's FLIRT signatures, when working on statically linked binaries, with other disassemblers? Is it at all possible with GDB/objdump?