Using gdb

This guide will help you start with gdb on a simple executable.

For more comprehensive guide follow this.

Starting a gdb session

Disassemble a function

Disassemble with binary printing

Setting a breakpoint on a specific address

Listing all breakpoints

Deleting a breakpoint

Start running

Continue

Execute (run) one instruction

Values of registers

Examining memory

Useful commands:

(Note: the bold text is the command while the rest is the response)

Starting a gdb session:
- /home/../Desktop$ gdb bla
Running gdb with arguments to the program under debugging
/home/../Desktop$ gdb --args bla -arg1 -arg2
Disassemble a function:
(gdb) disassemble main
Dump of assembler code for function main:
0x08048e24 <+0>: push %ebp
0x08048e25 <+1>: mov %esp,%ebp
0x08048e27 <+3>: and $0xfffffff0,%esp
- ...
Disassemble with binary printing
(gdb) disas /r main
Dump of assembler code for function main:
0x080483ed <+0>: 55 push %ebp
0x080483ee <+1>: 89 e5 mov %esp,%ebp
0x080483f0 <+3>: eb 2a jmp 0x804841c <main+47>
0x080483f2 <+5>: 5e pop %esi
Setting a breakpoint on a specific address:
- (gdb) b *0x08048e24
- Breakpoint 1 at 0x8048e24: file bla.c, line 3.
- (gdb) b func
- Breakpoint 1 at 0x8048453: file bla.c, line 10.
Listing all breakpoints:
(gdb) info breakpoints
Num Type Disp Enb Address What
1 breakpoint keep y 0x08048454 in main at overflow.c:19
breakpoint already hit 1 time
2 breakpoint keep y 0x08048471 in main at overflow.c:22
breakpoint already hit 1 time
Deleting a breakpoint:
(gdb) del 2
Start running
- (gdb) run
- Starting program: /home/../Desktop/bla
- Breakpoint 1, main () at bla.c:3
- 3 void main() {
Run till the next breakpoint (or till the program terminates):
(gdb) continue
Execute (run) one instruction:
(gdb) si
0x08048e25 3 void main() {
Values of registers (see also this):
(gdb) p/x $sp
$1 = 0xffffd53c
(gdb) p/x $pc
$4 = 0x8048e24
(gdb) info registers
eax 0x1 1
ecx 0xf992a0f1 -107831055
edx 0xffffd554 -10924
ebx 0x80481a8 134513064
esp 0xffffd53c 0xffffd53c
ebp 0x80495e0 0x80495e0 <__libc_csu_fini>
esi 0x0 0
edi 0x80e900c 135172108
eip 0x8048e24 0x8048e24 <main>
eflags 0x246 [ PF ZF IF ]
cs 0x23 35
ss 0x2b 43
ds 0x2b 43
es 0x2b 43
fs 0x0 0
gs 0x63 99
Examining memory:
- Format is: x/nfu addr (see this)
- Examples:
  - (gdb) x/ $esp
  - 0xffffd53c: 134516778
  - (gdb) x/x $esp
  - 0xffffd53c: 0x0804902a
  - (gdb) x/24xw $esp
  - 0xffffd524: 0xffffd5c4 0xffffd5cc 0x080481a8 0x080bdee8
  - 0xffffd534: 0x080e900c 0x080495e0 0x0804902a 0x00000001
  - 0xffffd544: 0xffffd5c4 0xffffd5cc 0x00000000 0x00000000
  - 0xffffd554: 0x080481a8 0x00000000 0x080e900c 0x080495e0
  - 0xffffd564: 0x571d6007 0xa1a831e8 0x00000000 0x00000000
  - 0xffffd574: 0x00000000 0x00000000 0x00000000 0x00000000
  - (gdb) x/24xb $ebp
  - 0xffffd538: 0xe0 0x95 0x04 0x08 0x2a 0x90 0x04 0x08
  - 0xffffd540: 0x01 0x00 0x00 0x00 0xc4 0xd5 0xff 0xff
  - 0xffffd548: 0xcc 0xd5 0xff 0xff 0x00 0x00 0x00 0x00
  - (gdb) x/s 0x80bdee8
  - 0x80bdee8: "/bin/sh"
Memory used by our process:
(gdb) info proc mappings
process 17709
Mapped address spaces:
Start Addr End Addr Size Offset objfile
0x8048000 0x80e8000 0xa0000 0x0 /home/bush/Desktop/smash/shellcode
0x80e8000 0x80ea000 0x2000 0x9f000 /home/bush/Desktop/smash/shellcode
0x80ea000 0x810e000 0x24000 0x0 [heap]
0xf7ffb000 0xf7ffc000 0x1000 0x0 [vdso]
0xf7ffc000 0xf7ffe000 0x2000 0x0 [vvar]
0xfffdd000 0xffffe000 0x21000 0x0 [stack]
Get info (addresses) of various sections:
(gdb) maintenance info sections
Exec file:
`bla', file type elf32-i386.
[0] 0x8048154->0x8048167 at 0x00000154: .interp ALLOC LOAD READONLY DATA HAS_CONTENTS
[1] 0x8048168->0x8048188 at 0x00000168: .note.ABI-tag ALLOC LOAD READONLY DATA HAS_CONTENTS
[2] 0x8048188->0x80481ac at 0x00000188: .note.gnu.build-id ALLOC LOAD READONLY DATA HAS_CONTENTS
[3] 0x80481ac->0x80481cc at 0x000001ac: .gnu.hash ALLOC LOAD READONLY DATA HAS_CONTENTS
[4] 0x80481cc->0x804822c at 0x000001cc: .dynsym ALLOC LOAD READONLY DATA HAS_CONTENTS
[5] 0x804822c->0x804827e at 0x0000022c: .dynstr ALLOC LOAD READONLY DATA HAS_CONTENTS
[6] 0x804827e->0x804828a at 0x0000027e: .gnu.version ALLOC LOAD READONLY DATA HAS_CONTENTS
[7] 0x804828c->0x80482ac at 0x0000028c: .gnu.version_r ALLOC LOAD READONLY DATA HAS_CONTENTS
[8] 0x80482ac->0x80482b4 at 0x000002ac: .rel.dyn ALLOC LOAD READONLY DATA HAS_CONTENTS
[9] 0x80482b4->0x80482d4 at 0x000002b4: .rel.plt ALLOC LOAD READONLY DATA HAS_CONTENTS
[10] 0x80482d4->0x80482f7 at 0x000002d4: .init ALLOC LOAD READONLY CODE HAS_CONTENTS
[11] 0x8048300->0x8048350 at 0x00000300: .plt ALLOC LOAD READONLY CODE HAS_CONTENTS
[12] 0x8048350->0x8048592 at 0x00000350: .text ALLOC LOAD READONLY CODE HAS_CONTENTS
[13] 0x8048594->0x80485a8 at 0x00000594: .fini ALLOC LOAD READONLY CODE HAS_CONTENTS
[14] 0x80485a8->0x804860e at 0x000005a8: .rodata ALLOC LOAD READONLY DATA HAS_CONTENTS
[15] 0x8048610->0x8048644 at 0x00000610: .eh_frame_hdr ALLOC LOAD READONLY DATA HAS_CONTENTS
[16] 0x8048644->0x8048714 at 0x00000644: .eh_frame ALLOC LOAD READONLY DATA HAS_CONTENTS
[17] 0x8049f08->0x8049f0c at 0x00000f08: .init_array ALLOC LOAD DATA HAS_CONTENTS
[18] 0x8049f0c->0x8049f10 at 0x00000f0c: .fini_array ALLOC LOAD DATA HAS_CONTENTS
[19] 0x8049f10->0x8049f14 at 0x00000f10: .jcr ALLOC LOAD DATA HAS_CONTENTS
[20] 0x8049f14->0x8049ffc at 0x00000f14: .dynamic ALLOC LOAD DATA HAS_CONTENTS
[21] 0x8049ffc->0x804a000 at 0x00000ffc: .got ALLOC LOAD DATA HAS_CONTENTS
[22] 0x804a000->0x804a01c at 0x00001000: .got.plt ALLOC LOAD DATA HAS_CONTENTS
[23] 0x804a01c->0x804a028 at 0x0000101c: .data ALLOC LOAD DATA HAS_CONTENTS
[24] 0x804a040->0x804fe20 at 0x00001028: .bss ALLOC
[25] 0x0000->0x0024 at 0x00001028: .comment READONLY HAS_CONTENTS
[26] 0x0000->0x0020 at 0x0000104c: .debug_aranges READONLY HAS_CONTENTS
[27] 0x0000->0x0128 at 0x0000106c: .debug_info READONLY HAS_CONTENTS
[28] 0x0000->0x00bf at 0x00001194: .debug_abbrev READONLY HAS_CONTENTS
[29] 0x0000->0x0053 at 0x00001253: .debug_line READONLY HAS_CONTENTS
[30] 0x0000->0x00f1 at 0x000012a6: .debug_str READONLY HAS_CONTENTS

Google Sites

Report abuse