Feeds:
Posts
Comments

Archive for the ‘debugger’ Category

The other function of GDB is Text User Interface (TUI). GDB use curses library to show the source file, assembly output, program registers and gdb command in separate windows. The TUI mode is supported only where version of the curses library is available.

Before we start, type the code below and save it to ‘mycode.asm’.

1 section .text
2
3 global _start
4
5 _start:
6
7 mov eax,10
8 mov ebx,20
9 mov ecx,30
10 mov edx,40
11
12 ;exit
13 mov eax,0
14 int 0x80

Then compile with debugger function (-gstab)

$ nasm -f elf32 -gstab mycode.asm -o mycode.o
$ ld mycode.o -o mycode
$

There are few ways to activate TUI.

First you when you open gdb and start TUI directly.

$ gdb -tui

tui03
(more…)

Read Full Post »

Although I prefer the command line interface if I work with gdb, but gdb can be operated in GUI (graphical user interface) mode via front end application DDD (Data Display Debugger).

To install DDD, open your linux terminal and type the command below:

$ sudo apt-get install ddd
[sudo] password for darklinux:
Reading package lists... Done
Building dependency tree
Reading state information... Done
Suggested packages:
ddd-doc pydb glibc-doc gnuplot
The following NEW packages will be installed:
ddd
0 upgraded, 1 newly installed, 0 to remove and 310 not upgraded.
Need to get 1,428 kB of archives.
After this operation, 3,920 kB of additional disk space will be used.
Get:1 http://old-releases.ubuntu.com/ubuntu/ oneiric/universe ddd i386 1:3.3.12-2.1 [1,428 kB]
Fetched 1,428 kB in 5s (270 kB/s)
Selecting previously deselected package ddd.
(Reading database ... 152578 files and directories currently installed.)
Unpacking ddd (from .../ddd_1%3a3.3.12-2.1_i386.deb) ...
Processing triggers for man-db ...
Processing triggers for doc-base ...
Processing 2 added doc-base files...
Registering documents with scrollkeeper...
Processing triggers for install-info ...
Processing triggers for gnome-menus ...
Processing triggers for desktop-file-utils ...
Setting up ddd (1:3.3.12-2.1) ...
$

To run the program, type ddd.

$ddd

If installation is correct, you will get this welcome screen.


(more…)

Read Full Post »

When you frequently work with the same file and do repeating the same process after you load your program, gdb provide easier solution for you.

I will give you an example.
Type the code below and save it to ‘keypress.c’.

1 #include
2 main()
3 {
4 printf("Press any key to continue.\n");
5 getchar();
6 }

Compile the program with debugging function.

$ gcc keypress.c -g -o keypress
$

I will show you if you do normal debugging. There few commands that I run here. One by one.

$ gdb keypress -silent
Reading symbols from /home/darklinux/keypress...done.
(gdb) set disassembly-flavor intel
(gdb) break main
Breakpoint 1 at 0x804841d: file keypress.c, line 4.
(gdb) run
Starting program: /home/darklinux/keypress

Breakpoint 1, main () at keypress.c:4
4 printf("Press any key to continue.\n");
(gdb) list 1,6
1 #include
2 main()
3 {
4 printf("Press any key to continue.\n");
5 getchar();
6 }
(gdb) disassemble /m main
Dump of assembler code for function main:
3 {
0x08048414 <+0>: push ebp
0x08048415 <+1>: mov ebp,esp
0x08048417 <+3>: and esp,0xfffffff0
0x0804841a <+6>: sub esp,0x10

4 printf("Press any key to continue.\n");
=> 0x0804841d <+9>: mov DWORD PTR [esp],0x8048500
0x08048424 <+16>: call 0x8048330 <puts@plt>

5 getchar();
0x08048429 <+21>: call 0x8048320 <getchar@plt>

6 }
0x0804842e <+26>: leave
0x0804842f <+27>: ret

End of assembler dump.
(gdb)

(more…)

Read Full Post »

Gnu Debugger not only can debug a program file but it can also do debugging with a running program.

Type the codes below and save it to ‘keypress.c’.

1 #include
2 main()
3 {
4 printf("Press any key to continue.\n");
5 getchar();
6 }

Compile and run the program

$ gcc keypress.c -g -o keypress
$ ./keypress
Press any key to continue.

Open another Linux Terminal and type: ps -aux | grep keypress to find the PID number.

$ ps -aux | grep keypress
Warning: bad ps syntax, perhaps a bogus '-'? See http://procps.sf.net/faq.html
1000 3392 0.0 0.0 1820 244 pts/0 S+ 08:56 0:00 ./keypress
1000 3457 0.0 0.0 4188 788 pts/1 S+ 08:57 0:00 grep --color=auto keypress
$

Debug the program with gdb. In order to do that, you have to be root otherwise you will get the error below.

$ gdb -pid 3392 -silent
Attaching to process 3392
Could not attach to process. If your uid matches the uid of the target
process, check the setting of /proc/sys/kernel/yama/ptrace_scope, or try
again as the root user. For more details, see /etc/sysctl.d/10-ptrace.conf
ptrace: Operation not permitted.
(gdb)

Now, you can debug the program with gdb.

$ sudo gdb --pid 3392 -silent
[sudo] password for darklinux:
Attaching to process 3392
Reading symbols from /home/darklinux/keypress...done.
Reading symbols from /lib/i386-linux-gnu/libc.so.6...(no debugging symbols found)...done.
Loaded symbols for /lib/i386-linux-gnu/libc.so.6
Reading symbols from /lib/ld-linux.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/ld-linux.so.2
0x00ba5416 in __kernel_vsyscall ()
(gdb) list
1 #include
2 main()
3 {
4 printf("Press any key to continue.\n");
5 getchar();
6 }
(gdb)

Read Full Post »

The basic idea of using debugger is that you can stop the program and continue the process before it terminates so you examine and identify if there is a problem with program.

In this tutorial, I will show few stepping process after breakpoints.

  1. Continue or c
  2. Next or n
  3. Step or s
  4. Nexti or ni
  5. Stepi or si

To check if the program has already run or not, type: info program.

(gdb) info program
The program being debugged is not being run.

1. Continue
It will resume the program execution until complete or stop at next breakpoint.

Before we start, type the code below and save it to ‘break.asm’.

1 section .text
2 global _start
3 _start:
4
5 mov eax,1111
6 mov ebx,2222
7 call do_nothing1
8 call do_nothing2
9 call do_nothing3
10 mov ecx,3333
11 mov edx,4444
12 call exit
13
14
15 do_nothing1:
16 nop
17 nop
18 ret
19
20 do_nothing2:
21 nop
22 nop
23 ret
24
25 do_nothing3:
26 nop
27 nop
28 ret
29
30 exit:
31 mov eax,1
32 int 0x80

Compile the program without debug function.

$ nasm -f elf32 break.asm -o break.o
$ ld break.o -o break
$ gdb ./break --silent
Reading symbols from /home/darklinux/break...(no debugging symbols found)...done.

(more…)

Read Full Post »

Reverse the program process is very useful when you are debugging and realize that you need to go backward. Instead of re-run the whole process, starting GDB version 7, you can go to the previous process.

There are few reverse that you can do:

  1. reverse-continue or rc
  2. reverse-step or reverse-step count
  3. reverse-stepi
  4. next or reverse-next count
  5. reverse-nexti

Before you use ‘reverse’ command, you need to activate the recording process otherwise you will get an error below:
“Target child does not support this command”.

Let’s try.
Type the code below and save it to ‘break.asm’.

1 section .text
2 global _start
3 _start:
4
5 mov eax,1111
6 mov ebx,2222
7 call do_nothing1
8 call do_nothing2
9 call do_nothing3
10 mov ecx,3333
11 mov edx,4444
12 call exit
13
14
15 do_nothing1:
16 nop
17 nop
18 ret
19
20 do_nothing2:
21 nop
22 nop
23 ret
24
25 do_nothing3:
26 nop
27 nop
28 ret
29
30 exit:
31 mov eax,1
32 int 0x80

reverse01
(more…)

Read Full Post »

In this tutorial, I will show you how to set break point in gnu debugger. Break point is very useful if you want to observe a program flow, find a debug in it or do reverse engineering. Using break point, you can jump the process directly to your pointer and stop the program.

Let’s find out more details about it.
Type the code below and save it to ‘break.asm’.

1 section .text
2 global _start
3 _start:
4
5 mov eax,1111
6 mov ebx,2222
7 mov ecx,3333
8 mov edx,4444
9
10 push eax
11 push ebx
12 push ecx
13 push edx
14
15
16 mov eax,1
17 int 0x80

To activate the debugging function, you have to add option -gstabs when you compile a program.

$ nasm -f elf32 -gstabs break.asm -o break.o && ld break.o -o break
$

Run with program with gdb (gnu debugger).

$ gdb ./break
GNU gdb (Ubuntu/Linaro 7.3-0ubuntu2) 7.3-2011.08
Copyright (C) 2011 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "i686-linux-gnu".
For bug reporting instructions, please see:
<http://bugs.launchpad.net/gdb-linaro/>...
Reading symbols from /home/darklinux/break...done.
(gdb)

Display the source code from line 1 to 20.

(gdb) list 1,20
1 section .text
2 global _start
3 _start:
4
5 mov eax,1111
6 mov ebx,2222
7 mov ecx,3333
8 mov edx,4444
9
10 push eax
11 push ebx
12 push ecx
13 push edx
14
15
16 mov eax,1
17 int 0x80
(gdb)

(more…)

Read Full Post »

Older Posts »