Playing with gdb

Hi Steemiters,

I think that most of the peoples who follow these entries understand what features gdb has and how it is installed, thus, not to mention what is already known and save time in it, merely reference will be made to some of the parameters that shall can be use in the debugging of an executable with gdb. This post has is intended to be only a practical mini guide with some examples in code, we will see some screenshot to show the output of commands executed once the process has been attacked. In the future, this document shall be used as a reference for another post.

The main motivation of this post is to give the reader a small cheatsheet or a brief introduction of this excellent tool.

This document shall may be modified in the long term, in order to add improvements and complement certain sections of it.

All these tests have been performed under a 64-bit operating system.

(gdb) b main

Assign a breakpoint in the attach process in the main function

(gdb) disas main

Gets an assembly dump from the main function

(gdb) s

Step over, execute instruction by instruction after a breakpoint

(gdb) p strEjmploVal

Print, makes a dump of the value of a variable in this case strEjmploVal, in this case it is necessary that the executable is running suspended by a breakpoint to observe the values.

Another way to see the data in an even more useful way is ...

(gdb) x /1bt &int16var1

EXamine obtains the memory address of the variable int16var1, note the &, syntax similar to that of C or C ++ in the same way obtains the value of said variable; this command will can be decomposed in the following way.

/ 1bt           Displays 1 byte in memory, in which case you need to display a value of 4 bytes you can define / 4bt; if you want to show a value of 10 bytes then it will be set / 10bt

The eXemine command has several parameters and is pretty flexible when presenting values ​​and memory locations.

(gdb) bt

Backtrace, shows the functions in the stack and its arguments

(gdb) x /4xw $sp

EXamine 4 words (w) in hexadecimal notation (x) of the Stack Pointer ($sp).

(gdb) info registers

As it should be noted, it shows the information of some important records; If you provide a specific usage record (rdi, rsi, rdx) then it will return the value of it. For example:

(gdb) info registers rdi
(gdb) info registers rsi

We better see it in short and simple code in ASM x64.

global _start


section .text
_start:


mov rax, 9099
mov rbx, 555



; sycall_exit()
mov rbx, 0
mov rax, 1
int 0x80

We compile and then in the gdb we see something like this:

")

With the gdb, we break, launch and go running the application with many s until we reach the instruction that interests us themov rax, 9099 and we see the dump of the records that we establish in the assembler code, the first column shows the name of the record rax in the second column the value in memory of the register in hexadecimal and finally the third column shows the value in decimal system of the recordrax with values ​​9099 and 555 for the record rbx

Well, I think the idea is understood when they are variables with integers, but what about the variable strings? let's see another example with character strings in ASM x64:

section .text

global _start


_start:
    

mov rbx, txt



; syscal_exit()
mov rbx, 0
mov rax, 1
int 0x80



section .data
    txt db 'oPen syLar', 0

We compiled and then in the gdb we see something like this:

Therefore, it is noted that the format presented by eXamine is the appropriate to explain several issues that had not been dealt with in more detail.

In the first instance, we see commands b r that were already treated in this same post, then we observed the command x but this one shows binary values ​​that can be decomposed in different ways:

If you do not have enough time, you also like to simplify things, you can take a calculator, convert binary values ​​to decimals and decimals to ASCII values.

Address in memory	Binario	Decimal	ASCII
0x6000c8	01101111	111	o
0x6000c8	01010000	80	P
0x6000c8	01100101	101	e
0x6000c8	01101110	110	n
0x6000c8	00100000	32
0x6000c8	01110011	115	s
0x6000c8	01111001	121	y
0x6000c8	01001100	76	L
0x6000d0	01100001	97	a
0x6000d0	01110010	114	r
0x6000d0	00000000	0	NULL

I do not think it's necessary to explain the table

Bonus track

If you have free time so, you can use the next tactic to convert decimals to binaries and compare values ​​with an ASCII table.

I saw this procedure in a blog, it is very helpful for those who are passionate about doing the most interesting things; This method is just one of many than exists to convert decimal values ​​to binary, it is not the best or the wors.

Well, let's take the y character of the example string oPen syLar

• If to the number we can subtract 128, we do it and write a one, if is not possible so we put a zero

  • According to the ASCII table the decimal value is 121 therefore we can not subtract 128, then we write 0

• We verify if we can subtract 32 since the previous result, if so, we do it and than write an 1, if it is allow it, we put a zero.

  • 57 if will can be subtract 32 therefore we write 1

• We verify if we can subtract 16 since the previous result, if so, we do it and than write an 1, if it is allow it, we put a zero.

  • 25 if will can be subtract 16 therefore we write 1

• We verify if we can subtract 8 since the previous result, if so, we do it and than write an 1, if it is allow it, we put a zero.

  • 9 if will can be subtract 8 therefore we write 1

• We verify if we can subtract 2 since the previous result, if so, we do it and than write an 1, if it is allow it, we put a zero.

  • 1 if will can be subtract 4 therefore we write 0

• We verify if we can subtract 1 since the previous result, if so, we do it and than write an 1, if it is allow it, we put a zero.

  • 1 if will can be subtract 1 therefore we write 1

Result: 01111001

References
Dartmouth
ASM86 Wordpress
Sourceware
SCSS

Si hablas español puedes leerlo acá