Feeds:
Posts
Comments

Archive for the ‘debugger’ Category

You can set breakpoint with a condition. This is very useful if want to observe a certain location and stop it if the condition is reach.

In this tutorial I use:
-Xubuntu 18.04
-GNU gdb (Ubuntu 8.1-0ubuntu3.2) 8.1.0.20180409-git
-NASM version 2.13.02
-GNU ld (GNU Binutils for Ubuntu) 2.30

Use the simple assembly code below:

1  section .text
2  global _start
3
4  _start:
5
6      mov rax,3
7      mov rbx,2
8      add rax,rbx
9      sub rbx,1
10
11     ;Exit
12     mov eax,1
13     mov ebx,0
14     int 0x80

(more…)

Read Full Post »

This is one of my favorite function in gdb. It will make your life easier instead of typing repetition commands. Hook is a user defined command but you have to combine with a pseudo-command that already exist.

For example, you want to disassemble a program code and display the value of the program register every time you stop the process. Instead of typing 2 commands every time its stop, you can define it into one command with hook.

(gdb) define hook-stop

Type commands for definition of “hook-stop”.
End with a line saying just “end”.
>disassemble _start
>info reg $rax $rbx
>end

Let’s try.
In this tutorial I use:
-Xubuntu 18.04
-GNU gdb (Ubuntu 8.1-0ubuntu3.2) 8.1.0.20180409-git
-NASM version 2.13.02
-GNU ld (GNU Binutils for Ubuntu) 2.30

Use the simple assembly code below:

1 section .text
2 global _start
3
4 _start:
5
6      mov rax,3
7      mov rbx,2
8      add rax,rbx
9      sub rbx,1
10
11     ;Exit
12     mov eax,1
13     mov ebx,0
14     int 0x80

Compile it with nasm.

darklinux@darklinuxpc:~$ nasm -f elf64 -g reg.asm -o reg.o
darklinux@darklinuxpc:~$ ld reg.o -o reg
darklinux@darklinuxpc:~$ gdb -silent reg

Reading symbols from reg…done.

(gdb) break _start
Breakpoint 1 at 0x400080
(gdb) set disassembly-flavor intel

Define the hook-stop with 2 commands, disassemble _start and info reg $rax $rbx, close with ‘end’.
(gdb) define hook-stop
Type commands for definition of “hook-stop”.
End with a line saying just “end”.
>disassemble _start
>info reg $rax $rbx
>end

(more…)

Read Full Post »

You can use Watchpoint to watch variable’s value changes by single stepping your program.
In this tutorial I use:
-Xubuntu 18.04
-GNU gdb (Ubuntu 8.1-0ubuntu3.2) 8.1.0.20180409-git
-NASM version 2.13.02
-GNU ld (GNU Binutils for Ubuntu) 2.30

Let’s try with a simple assembly code.

1 section .text
2 global _start
3
4 _start:
5
6      mov rax,3
7      mov rbx,2
8      add rax,rbx
9      sub rbx,1
10
11     ;Exit
12     mov eax,1
13     mov ebx,0
14     int 0x80

This program will add 3 to rax register, 2 to rbx register, so rax value will be 3 and rax value will be 2.

Then add rbx register value to rax register value, mean 2+3 =5. The rax register value will be 5.

Subtract rabx register with 1. The rbx register value will be 1 (2-1=1).
Finally, exit the program normally.

Compile it with nasm.

darklinux@darklinuxpc:~$ nasm -f elf64 -g reg.asm -o reg.o
darklinux@darklinuxpc:~$ ld reg.o -o reg

(more…)

Read Full Post »

In this tutorial, I will explain how to install gdb (gnu debugger) in Docker container. If you are using ubuntu, you can install it using below command (don’t try, this is for sample only):

darklinux@darklinuxpc:~$ sudo docker run -it --name ubuntu-gdb ubuntu:bionic /bin/bash
root@55e461812aff:/# apt-get update
Get:1 http://security.ubuntu.com/ubuntu bionic-security InRelease [88.7 kB]
Get:2 http://archive.ubuntu.com/ubuntu bionic InRelease [242 kB]
Get:3 http://security.ubuntu.com/ubuntu bionic-security/multiverse amd64 Packages [8815 B]
Get:4 http://archive.ubuntu.com/ubuntu bionic-updates InRelease [88.7 kB]
Get:5 http://security.ubuntu.com/ubuntu bionic-security/restricted amd64 Packages [59.3 kB]
Get:6 http://archive.ubuntu.com/ubuntu bionic-backports InRelease [74.6 kB]
Get:7 http://security.ubuntu.com/ubuntu bionic-security/main amd64 Packages [930 kB]
Get:8 http://archive.ubuntu.com/ubuntu bionic/main amd64 Packages [1344 kB]
Get:9 http://security.ubuntu.com/ubuntu bionic-security/universe amd64 Packages [852 kB]
Get:10 http://archive.ubuntu.com/ubuntu bionic/restricted amd64 Packages [13.5 kB]
Get:11 http://archive.ubuntu.com/ubuntu bionic/universe amd64 Packages [11.3 MB]
Get:12 http://archive.ubuntu.com/ubuntu bionic/multiverse amd64 Packages [186 kB]
Get:13 http://archive.ubuntu.com/ubuntu bionic-updates/universe amd64 Packages [1385 kB]
Get:14 http://archive.ubuntu.com/ubuntu bionic-updates/main amd64 Packages [1226 kB]
Get:15 http://archive.ubuntu.com/ubuntu bionic-updates/restricted amd64 Packages [73.6 kB]
Get:16 http://archive.ubuntu.com/ubuntu bionic-updates/multiverse amd64 Packages [20.1 kB]
Get:17 http://archive.ubuntu.com/ubuntu bionic-backports/universe amd64 Packages [8158 B]
Get:18 http://archive.ubuntu.com/ubuntu bionic-backports/main amd64 Packages [8286 B]
Fetched 17.9 MB in 19s (933 kB/s)
Reading package lists... Done
 (more…)

Read Full Post »

What is Little Endian?
It’s a way of bytes are stored in Computer Memory.

Then what is Little Endian? It’s bytes stored in computer memory where the least significant byte byte occupies the lower memory address.

It will be easier if I show you the sample below:

For Example I have data: abcdefgh or 61,62,63,64,65,66,67,68 in hexadecimal number (a=61 in Ascii table). If it’s loaded in memory, it the order will be:

 d, c, b,a      h, g, f,e
64,63,62,61    68,67,66,65

The easier way, read from right to left per 4 bytes.
endian-mem

(more…)

Read Full Post »

The other function of GDB is Text User Interface (TUI). GDB use curses library to show the source file, assembly output, program registers and gdb command in separate windows. The TUI mode is supported only where version of the curses library is available.

Before we start, type the code below and save it to ‘mycode.asm’.

1 section .text
2
3 global _start
4
5 _start:
6
7 mov eax,10
8 mov ebx,20
9 mov ecx,30
10 mov edx,40
11
12 ;exit
13 mov eax,0
14 int 0x80

Then compile with debugger function (-gstab)

$ nasm -f elf32 -gstab mycode.asm -o mycode.o
$ ld mycode.o -o mycode
$

There are few ways to activate TUI.

First you when you open gdb and start TUI directly.

$ gdb -tui

tui03
(more…)

Read Full Post »

Although I prefer the command line interface if I work with gdb, but gdb can be operated in GUI (graphical user interface) mode via front end application DDD (Data Display Debugger).

To install DDD, open your linux terminal and type the command below:

$ sudo apt-get install ddd
[sudo] password for darklinux:
Reading package lists... Done
Building dependency tree
Reading state information... Done
Suggested packages:
ddd-doc pydb glibc-doc gnuplot
The following NEW packages will be installed:
ddd
0 upgraded, 1 newly installed, 0 to remove and 310 not upgraded.
Need to get 1,428 kB of archives.
After this operation, 3,920 kB of additional disk space will be used.
Get:1 http://old-releases.ubuntu.com/ubuntu/ oneiric/universe ddd i386 1:3.3.12-2.1 [1,428 kB]
Fetched 1,428 kB in 5s (270 kB/s)
Selecting previously deselected package ddd.
(Reading database ... 152578 files and directories currently installed.)
Unpacking ddd (from .../ddd_1%3a3.3.12-2.1_i386.deb) ...
Processing triggers for man-db ...
Processing triggers for doc-base ...
Processing 2 added doc-base files...
Registering documents with scrollkeeper...
Processing triggers for install-info ...
Processing triggers for gnome-menus ...
Processing triggers for desktop-file-utils ...
Setting up ddd (1:3.3.12-2.1) ...
$

To run the program, type ddd.

$ddd

If installation is correct, you will get this welcome screen.


(more…)

Read Full Post »

When you frequently work with the same file and do repeating the same process after you load your program, gdb provide easier solution for you.

I will give you an example.
Type the code below and save it to ‘keypress.c’.

1 #include
2 main()
3 {
4 printf("Press any key to continue.\n");
5 getchar();
6 }

Compile the program with debugging function.

$ gcc keypress.c -g -o keypress
$

I will show you if you do normal debugging. There few commands that I run here. One by one.

$ gdb keypress -silent
Reading symbols from /home/darklinux/keypress...done.
(gdb) set disassembly-flavor intel
(gdb) break main
Breakpoint 1 at 0x804841d: file keypress.c, line 4.
(gdb) run
Starting program: /home/darklinux/keypress

Breakpoint 1, main () at keypress.c:4
4 printf("Press any key to continue.\n");
(gdb) list 1,6
1 #include
2 main()
3 {
4 printf("Press any key to continue.\n");
5 getchar();
6 }
(gdb) disassemble /m main
Dump of assembler code for function main:
3 {
0x08048414 <+0>: push ebp
0x08048415 <+1>: mov ebp,esp
0x08048417 <+3>: and esp,0xfffffff0
0x0804841a <+6>: sub esp,0x10

4 printf("Press any key to continue.\n");
=> 0x0804841d <+9>: mov DWORD PTR [esp],0x8048500
0x08048424 <+16>: call 0x8048330 <puts@plt>

5 getchar();
0x08048429 <+21>: call 0x8048320 <getchar@plt>

6 }
0x0804842e <+26>: leave
0x0804842f <+27>: ret

End of assembler dump.
(gdb)

(more…)

Read Full Post »

Older Posts »