> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/rev-eng/debuggers/gdb.md). # gdb ## [Starting GDB](https://sourceware.org/gdb/current/onlinedocs/gdb.html/Starting.html#Starting) Start GDB by specifying what executable to debug: ``` gdb program ``` To start GDB with a program without printing the banner ``` gdb -q program ``` If you don't specify the program as a parameter to GDB, you can specify it from inside GDB with ``` (gdb) file program ``` ### Starting a program inside GDB {% hint style="info" %} HINT\ Commands in GDB can be shortened as long as they are unambiguous. \ Therefore, 'run' can be shortened to 'r'. {% endhint %} To start a program inside GDB: ``` (gdb) run ``` To start a program inside GDB, with certain input parameters: ``` (gdb) run -d 1 ``` To redirect stdin to the program from a file ``` (gdb) run < solution.txt ``` To [redirect stdin to the program](https://klatz.co/ctf-blog/stdin-to-gdb) from a script ``` (gdb) run < <(python -c "print '\x41'*36") ``` Or using command substitution. Note that this handles nulls weirdly on stdin within GDB. ``` (gdb) run <<< $(python -c "print '\x41'*36") ``` ### Start the program and break at the start To start the program and break immediately at the starting point can be done with both `start` and `starti` #### start The `start` command does the equivalent of setting a temporary breakpoint at the beginning of the **main procedure** and then invoking the ‘run’ command. #### starti The `starti` command does the equivalent of setting a temporary breakpoint at the first instruction of a program’s execution and then invoking the ‘run’ command. For programs containing an elaboration phase, the `starti` command will stop execution at the start of the elaboration phase, i.e. **before** the main procedure. ## Exiting GDB To exit GDB and return to the shell prompt: ``` (gdb) quit ``` Note that exiting GDB means you lose all of your breakpoints that you set in this GDB session. When you re-run GDB, you need to re-specify any breakpoints that you want to re-use. ## [Disassembling code](https://sourceware.org/gdb/current/onlinedocs/gdb.html/Machine-Code.html#Machine-Code) Before disassembling we should set the syntax to Intel. Default is AT\&T-syntax. ``` (gdb) set disassembly-flavor intel ``` You can use 'disassemble' (can be shortened to `disas`) to disassemble a function or a specified address range. To disassemble function some\_func: ``` (gdb) disas some_func ``` To disassemble the address range from 0x4005dc to 0x4005eb: ``` (gdb) disas 0x4005dc 0x4005eb ``` ## [Breakpoints](https://sourceware.org/gdb/current/onlinedocs/gdb.html/Breakpoints.html#Breakpoints) ### Set a breakpoint To set a breakpoint at function main, without or with offset from the beginning ``` (gdb) break main (gdb) break *main (gdb) break *main+19 ``` Note that: * `break main` will break **after** the function prologue in the function * `break *main` will break on the **very first instruction** of the function To set a breakpoint at virtual address 0x11223344 ``` (gdb) break *0x11223344 ``` ### List breakpoints To list your breakpoints ``` (gdb) info break ``` ### Delete a breakpoint To delete/clear a breakpoint ``` (gdb) delete (gdb) clear *0x11223344 ``` ### Disable breakpoints To temporarily disable a breakpoint ``` (gdb) disable ``` ### Enable breakpoints To enable the breakpoint again ``` (gdb) enable ``` ### [Breakpoint Command Lists](https://sourceware.org/gdb/current/onlinedocs/gdb#Break-Commands) You can give any breakpoint (or watchpoint or catchpoint) a series of commands to execute when your program stops due to that breakpoint. #### Example #1 Use breakpoint commands to print the value of `x` at entry to `foo` whenever `x` is positive. ``` break foo if x>0 commands silent printf "x is %d\n",x cont end ``` #### Example #2 Use breakpoint commands to print the value a vaule on the stack ``` break *main+709 commands silent set $currentValue = *(unsigned long long*)($rbp-0x18) printf "Current value: %llx\n", $currentValue continue end ``` ## [Continuing and Stepping](https://sourceware.org/gdb/current/onlinedocs/gdb#Continuing-and-Stepping) To continue execution ``` (gdb) c (gdb) continue ``` There are a number of stepping commands in GDB:
CommandDescription
fin
finish		Continue running until just after function in the selected stack frame returns. Print the returned value (if any). This command can be abbreviated as fin.
ni
nexti		Execute one machine instruction, but if it is a function call, proceed until the function returns.
n
next		Continue to the next source line in the current (innermost) stack frame. This is similar to step, but function calls that appear within the line of code are executed without stopping.
si
stepi		Execute one machine instruction, then stop and return to the debugger.
si <n>
stepi <n>		An argument is a repeat count, step <n> times
s
step		Continue running your program until control reaches a different source line, then stop it and return control to GDB. step steps inside any functions called within the line.
s <n>
step <n>		An argument is a repeat count, step <n> times
To summaries: * `step`/`stepi` steps **into** functions. `next`/`nexti` steps **over** functions. * `step`/`next` stops at next **source line**. `stepi`/`nexti` stops at next **assembly instruction**. ## [Catchpoints](https://sourceware.org/gdb/current/onlinedocs/gdb#Set-Catchpoints) You can use *catchpoints* to cause the debugger to stop for certain kinds of program events, such as C++ exceptions or the loading of a shared library. Use the `catch` command to set a catchpoint. ### Example #1 - Read syscalls To set a catchpoint that triggers every time a read syscall is made and automatically run commands that modifies a memory position ``` catch syscall read commands silent set *(unsigned long long*)($rbp-0x10) = *(unsigned long long*)($rbp-0x18) continue end ``` ## Get information info functions ### [Viewing registers](https://sourceware.org/gdb/current/onlinedocs/gdb#Registers) To print the values of all registers ``` (gdb) info registers (gdb) info r ``` To only view specific registers with `info` ``` (gdb) info reg rax rbx rsp ``` You can also use `p` or `print` ``` (gdb) p $r12 $1 = 2879248066738619861 (gdb) p/x $r12 $2 = 0x27f524dc9e2f85d5 ``` ## [Examining Memory](https://sourceware.org/gdb/current/onlinedocs/gdb.html/Memory.html#Memory) Use the `x` command to view/examine memory. The x command uses the general form of `x/nfu` where * **n** is the repeat count * **f** is the display format * **u** is the unit size Valid formats are d (decimal), x (hexadecimal), s (string) and i (instruction). Valid unit sizes are b (1 byte), h (2 bytes), w (4 bytes), and g (8 bytes). ### Examining memory examples * `x/8i $rip` will print the next 8 instructions from the current instruction pointer * `x/16i main` will print the first 16 instructions of main * `x/16gx $rsp` will print the first 16 values on the stack ## Resources gdb - Linux manual page: GDB (The GNU Project Debugger) - Documentation: GDB (The GNU Project Debugger) - Homepage: