Skip to main content
3 of 11
added 27 characters in body
Ta Thanh Dinh
  • 1.4k
  • 8
  • 12

Debugging an elf shared object

I am trying to follow the write-up about hackercalc (a challenge for DEFCON 2015 quals). First, by loading the challenge into gdb, I observe that:

(gdb) info files
...
Entry point: 0xcf8
...

So I set a breakpoint at the entry point and run the program:

(gdb) break *0xcf8
Breakpoint 1 at 0xcf8
(gdb) run
Starting program: /home/tathanhdinh/CTFs/hackercalc
Error in re-setting breakpoint 1: Warning:
Cannot insert breakpoint 1.
Cannot access memory at address 0xcf8

Warning:
Cannot insert breakpoint 1.
Cannot access memory at address 0xcf8

That seems this breakpoint does not work. I do not understand why it says Cannot access memory at address 0xcf8 but I guess that there was some code which runs before has made some interference (so the program cannot reach this entry point), this code must be the elf interpreter of the program.

Next, I look into segments of the programm, all seems to be normal (except that it says the program is a shared object file, but I think this is not important):

readelf --segments hackercalc

Elf file type is DYN (Shared object file)
Entry point 0xcf8
There are 8 program headers, starting at offset 52

Program Headers:
  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align
  PHDR           0x000034 0x00000034 0x00000034 0x00100 0x00100 R E 0x4
  INTERP         0x000154 0x00000154 0x00000154 0x00013 0x00013 R   0x1
      [Requesting program interpreter: /lib/ld-linux.so.2]
  LOAD           0x000000 0x00000000 0x00000000 0x16b4a 0x16b4a R E 0x1000
  LOAD           0x016eac 0x00017eac 0x00017eac 0x001e4 0x001ec RW  0x1000

Now, I try to get again information about this process:

(gdb) info files
Symbols from "/home/tathanhdinh/CTFs/hackercalc".
Native process:
        Using the running image of child process 10545.
        While running this, GDB does not access memory from...
Local exec file:
        `/home/tathanhdinh/CTFs/hackercalc', file type elf32-i386.
        Entry point: 0x56555cf8

And I am totally lost here, why the elf interpreter (which is ld-linux.so.2) can create a new process in this case?

I try another approach by loading the challenge into IDA, set a breakpoint at the entry point, then run but IDA simply hangs up!!!

So my question is: how can this happen? Am I totally wrong about the code executed before the entry point? Does the challenge use some special tricks to bypass debugging?

Ta Thanh Dinh
  • 1.4k
  • 8
  • 12