TransWikia.com

Can I force GDB breakpoints and disassemble?

Reverse Engineering Asked by LUser on January 21, 2021

Sorry English isn’t my first language.

I noticed something when setting breakpoints in GDB. It appears that they are ignored if symbols aren’t loaded.

I have found it weird how GDB behaves when there are no symbols at all loaded and if I want to debug something I am having to set a break point at __libc_start_main@plt and nexti until I reach a the main binary. I also noticed that I cannot disassemble there in the main binary either (I receive this odd message "No function contains program counter for selected frame."), but that aside it break points are essentially ignored. I have found an odd work around and that is setting

set *0x56555878 = 0xcc 

My questions are:

  • Why does GDB behave so weirdly without symbols?
  • Why do normal for breakpoints fail to be recognized?
  • Is setting my desired breakpoints to 0xcc and then resting; Is this a good practice?
  • Is there a better way to set breakpoints?
  • Why can I not disassemble without Why can I not disassemble without symbols?

Edit: It looks like I cannot set *breakpoints in glibc but I can when I land in int main() program , But while in the int main() , I lose ability to disassemble.

One Answer

gdb is primarily a Source Level Debugger

to set a bp on an address instead of symbol use *

(gdb) break main
Breakpoint 1 at 0x100401094: file mingtest.cpp, line 4.
(gdb) break *0x100401094
Note: breakpoint 1 also set at pc 0x100401094.
Breakpoint 2 at 0x100401094: file mingtest.cpp, line 4.
(gdb)

you can disassemble using address, length at any arbitrary addresss

(gdb) disassemble 0x100401094,+0x10
Dump of assembler code from 0x100401094 to 0x1004010a4:
   0x0000000100401094 <main(int, char**)+20>:   mov    edx,DWORD PTR [rbp+0x10]
   0x0000000100401097 <main(int, char**)+23>:   lea    rcx,[rip+0x1f62]        # 0x100403000
   0x000000010040109e <main(int, char**)+30>:   call   0x100401110 <printf>
   0x00000001004010a3 <main(int, char**)+35>:   mov    DWORD PTR [rbp-0x4],0x0
End of assembler dump.
(gdb)

Answered by blabb on January 21, 2021

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP