Skip to main content
74 votes
Accepted

Decent GUI for GDB

I started my own gdb frontend called gdbgui which is a server (in python) that lets you access a full-featured frontend in your browser. Install pip install gdbgui --upgrade or download at gdbgui....
cs01's user avatar
  • 856
12 votes

Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR

Starting with GDB 8.1, there's a special command for this: starti. Example GDB session: $ gdb /bin/true Reading symbols from /bin/true...(no debugging symbols found)...done. (gdb) starti Starting ...
Ruslan's user avatar
  • 293
10 votes
Accepted

Understanding gdb output

Seems like relocation. If you look at the addresses in your first listing, you will notice that these addresses are unusually low. That's probably because gdb displays file offsets there (although I ...
Nordwald's user avatar
  • 2,906
10 votes
Accepted

Run a python command with "run" on GDB

You do not have to use another file, it is just redundant You can do this by using "Here strings". In your example you can do : r <<< $(python -c "print '\x90'*52") You can read about "...
yehuda corsia's user avatar
10 votes

How can breakpoint be set using offset in ELF file, not virtual address?

The basic problem is that the load address is not known until the file is actually mapped by the OS, and by that time it may be too late if the program is already running. Several workarounds for this ...
Igor Skochinsky's user avatar
  • 36.8k
9 votes
Accepted

How to get current PHP function name in gdb?

According to this link, it should be possible to find the function in use with the following steps: Attach gdb to the currently-running PHP process: gdb -p <processid> Load in the PHP .gdbinit ...
Moshe's user avatar
  • 218
9 votes
Accepted

Correct way to understand local_ in ghidra disassembly

Since local variables are usually placed on the stack in x86 and esp register can change during function execution, it is more convenient to save the value of esp register on function entry and access ...
bart1e's user avatar
  • 3,409
8 votes
Accepted

How to effectively bypass GCC stack smashing detection

The answer from Jason is the correct solution. However, I wanted to give an alternative answer without Python, but from the terminal. IMO Python is always preferred for better automation, but ...
BitParser's user avatar
  • 196
8 votes
Accepted

what is radare2's equivalent to GDB's 'find &system,+9999999,"/bin/sh"'

First and foremost we should open the binary in debug mode with radare2 $ r2 -d file The string /bin/sh resides in the system function of libc so the library should first be loaded to the memory in ...
Megabeets's user avatar
  • 9,009
8 votes

How can breakpoint be set using offset in ELF file, not virtual address?

No, in fact you misunderstood something. :-) The address 0x0000000000000520 is the offset from the beginning of the ELF file from the section .text where the _start procedure lies. And, the address ...
perror's user avatar
  • 19.2k
8 votes

GDB hangs when I try to run and debug a binary

It looks like the problem is partially fixed by running set startup-with-shell off inside the gdb. Why? I don't know, no clue, I just read it somewhere. If anyone has a different solution or know why ...
user3732445's user avatar
6 votes
Accepted

gdb shows wrong instruction

Your instructions shown by Ida are Thumb-mode instructions. The easiest way to verify this is by checking the addresses - each instruction has 2 bytes. Gdb doesn't know this however, and assumes 4 ...
Guntram Blohm's user avatar
6 votes

Decent GUI for GDB

VisualStudio.Code (VS.Code) runs on Linux and has a "Native Debug" extension that lets you use gdb. It has very responsive UI. It's extremely light on resources. The experience somewhat approximates ...
Sergiy Migdalskiy's user avatar
6 votes
Accepted

ASM working as is, but not in a C program

The problem with you shellcode and the why it differs if you run from C program or not is the initial values. The registers that are used when executing execv (second page) are: eax = 0x0b ebx = ptr ...
Paweł Łukasik's user avatar
6 votes
Accepted

How to set breakpoint with gdb on arbitrary memory location?

You need to use syntax like *0x12345 with raw addresses, otherwise gdb tries to resolve it as a symbol.
Igor Skochinsky's user avatar
  • 36.8k
6 votes
Accepted

Dumping the GOT with gdb at run time

There are a couple of options for this. Use pwndbg or gef. They have a command called got which looks like this gef➤ got GOT protection: Partial RelRO | GOT functions: 4 [0x555555755018] free@...
sudhackar's user avatar
  • 2,709
6 votes
Accepted

startup program exits with code 126 when executing program at entrypoint

The program exiting with code 126 in GDB occurs when the current user does not have execute permissions for the binary being debugged: $ ls -l test -rw-r--r-- 1 user01 user01 110080 May 1 22:18 test ...
julian's user avatar
  • 7,186
5 votes

Decent GUI for GDB

There's Voltron, which is an extensible Python debugger UI that supports LLDB, GDB, VDB, and WinDbg/CDB (via PyKD) and runs on macOS, Linux and Windows. For the first three it supports x86, x86_64, ...
atdre's user avatar
  • 249
5 votes
Accepted

GCC change the order of variable declaration

My best guess : memory alignment. An integer in C is 4 bytes and a char 1 byte. Therefore, your declarations go like this : 4B & 1x10=10B & 4B. This order means that the 10B won't be aligned ...
yaspr's user avatar
  • 2,673
5 votes
Accepted

Why is there a difference in offset between ida and gdb?

For "Position Independent Executable" binaries, the loader is free to relocate the binary using some base address. In the case of GDB, the binary is mapped already into memory, the offset 0x2013a1 in ...
Ta Thanh Dinh's user avatar
5 votes
Accepted

Why can't gdb read memory if pwntools is used to send input?

The process dies before/while gdb connects to it, as your python script finishes. Use the following line at the end of your script to keep it running. p.interactive()
user23263's user avatar
5 votes
Accepted

How to assemble and inject an instruction with GDB?

GDB doesn't seem to have any native command to assemble instructions. But we can use its Python scripting facility to create a custom command, which would prepare an assembly source file, feed it to ...
Ruslan's user avatar
  • 293
5 votes

How can breakpoint be set using offset in ELF file, not virtual address?

You can't do this in vanilla gdb but if you are using pwndbg you can. The command is called breakrva or brva for short. You can use it like this: brva 0x520 but the program has to run.
Paweł Łukasik's user avatar
5 votes

Find base address and memory size of program debugged in gdb

info file shows the memory map of the current process: Local exec file: `/bin/less', file type elf64-x86-64. Entry point: 0x402080 0x0000000000400238 - 0x0000000000400254 is ....
Igor Skochinsky's user avatar
  • 36.8k
5 votes

Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll

One approach you might consider involves compiling different versions of metsrv.dll from source and then observing which ones are detected and which ones are not. For instance: Comment out half the ...
Lisbeth's user avatar
  • 73
5 votes
Accepted

Confused about the use of the shl instruction in this disassembly

Let's break it down line by line. Assuming x is the thing you want to multiply by 21 and it's stored in eax (as it is in this example after line 34). <39>: mov edx, eax ; so copy the x to edx &...
Paweł Łukasik's user avatar
4 votes

How to predict address space layout differences between real and gdb-controlled executions?

Just to add to the answers, I can tell how to get close to a clean environment despite gdb. In fact, there are two methods to reach this: We can get rid of the extra environment variables added by ...
perror's user avatar
  • 19.2k
4 votes

Decent GUI for GDB

You can use GDBFrontend that I develop for a while.
Oğuzhan Eroğlu's user avatar
4 votes
Accepted

Call Android method without running whole Android-App

You should be able to write a separate application that dynamically loads the dex file from the app that you are interested in using DexClassLoader, allowing you to construct classes and call methods ...
JesusFreke's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible