SGDE Flashcards
SecurityTube Gnu Debugger Expert
What are Debugger Symbols?
Debugger Symbols are information about variables, functions etc. about the binary that can be read by a debugger. The Debugger Symbols can be a part of the Binary or in a separate file. This makes the binary more understandable and readable from the debugger’s perspective. They can be specified at compile time.
What command can be used to rip symbols off a binary?
objcopy –only-keep-debug [binary_file] [debug_symbols_file]
What command can be used to strip debug symbols off a binary?
strip –strip-debug –strip-unneeded [debug_symbols_file]
What is the importance of stripping debug symbols?
A developer should not deploy/ship a binary with debug symbols, or with anything else added on. Ideally, a stripping tool would be run on the binary before it is shipped. Additionally, this brings down the size of the binary by quite a lot!
How can debug symbols be added to a binary?
Two ways:
- During runtime with gdb ‘symbol-file [debug_file]’
- objcopy –add-gnu-debuglink=DEBUG_symbols [binary_file]
What do symbol files tell us?
- Info sources - list of files from which the binary was compiled and linked.
- Info variables (not local variables) - all the global and static variables.
- Info scope function_name - all of the local variables.
- Info functions - list of functions in the binary.
- maint print symbols filename_to_store - dump the symbols into a different file.
What does NM do?
The nm command lists symbols from object files. This is split into three columns:
- Virtual Address
- Symbol Type
- Symbol Name
NM gives you a very quick snapshot on the artefacts within an executable, which you might want to analyse.
What Symbol Types are there?
A: Absolute Symbol B: In the Uninitialized Data Section (BSS) D: In the Initialized Data Section N: Debugging Symbol T: In the Text Section U: Symbol Undefined right now
nm is a mix of symbol types. Lower case symbols are local, upper case are external.
NM usage
- NM -A … | grep function_name
- NM -n … (Display in sorted order, sorted by address)
- NM -g (External)
- NM -s (display size)
What is Strace?
A helper tool designed to help understand how your program interacts with the OS. Traces all System Calls made by the program. Also tells us about arguments passed, and has great filtering capabilities. Allows us to perform relative timestamping, monitor specific system calls, running processes, and produce tables to summarise what it has found.
Strace usage
- strace [executable_to_trace] [arguments]
- strace -o [output_file] [executable_to_trace] [arguments]
- strace -t [executable_to_trace] [arguments] (timestamping)
- strace -r [executable_to_trace] arguments
- strace -e [send, recv, open, connect] [executable_to_trace] [arguments]
- strace -p [pid]
- strace -c [executable_to_trace] [arguments] (print statistics on system calls)
How can strace filter based on system calls?
- strace -e [list of system calls] [executable_to_trace] [arguments]
e. g. strace -r -e write ./SGDE-video-4 20 30
What is a Breakpoint?
A Breakpoint is a technique used to pause a program during execution based on certain criteria. The criteria can be e.g. about to execute and instruction (for debugging a particular instruction). The debugger then allows you to inspect / modify the CPU Registers, Memory, Data etc.
How to run a program with args in gdb?
in GDB: run [args]
How to add a breakpoint to a specific function?
in GDB: break [function name]
e.g. break main
The breakpoint will be added at the specific memory address of that function. Upon running the program, it will halt at that specific function.
From here, registers may be analysed with ‘info registers’ command.
Can you create additional breakpoints when a program has been halted?
Yes. With the same syntax, ‘break [function name].
breakpoint information can be queried with ‘info breakpoints’, which numerically lists the breakpoints. From here, breakpoints can be enabled, disabled and even deleted:
disable [number]
enable [number]
delete [number]
How can you examine areas of memory (e.g. the stack, binary code)?
Using the ‘x’ command’. To view the value and memory address assigned to certain variables (e.g. a command line argument passed to a programme, such as argv[1]) the ‘print’ command can also be used, to display the memory address.
e.g. to view the memory in a string format at argv[1]:
in gdb: x/s argv[1]
How can you disassemble a function?
Using the disassemble command and specifying a function e.g.
in gdb: disassemble main
to examine a particular instruction, the examine command ‘x’ can also be used.
in gdb: x/i [instruction address]
How can you set a breakpoint by address?
a breakpoint can be set for an address using the following syntax:
break *[address]
How can you step through a program line by line and instruction by instruction?
line by line - in gdb: step
instruction by instruction - in gdb: stepi
How can you modify CPU registers in memory?
Using the set command, specifying the data type, and the memory address, as well as the new value to set it to.
e.g. in gdb: set {char} 0xbffff874 = 65
to set a char at memory address 0xbffff874 to ascii value 65, which is a capital letter A.
Alternate data types, such as {int} can also be used.
To modify particular areas consecutively, arithmetic can be used on the memory addresses.
e.g. in gdb:
(gdb) set {char} 0xbffff874 = ‘B’
(gdb) set {char} (0xbffff874 + 1) = ‘B’
(gdb) set {char} (0xbffff874 + 2) = ‘B’
(gdb) set {char} (0xbffff874 + 3) = ‘B’
(gdb) x/5c argv[1]
0xbffff874: 66 ‘B’ 66 ‘B’ 66 ‘B’ 66 ‘B’ 0 ‘\000’
How can you modify the value of a variable?
Using the set command as follows:
set [var_name] = [value]
e.g. in gdb: set sum = 2000
Assuming that a breakpoint has been set when the modified variable is loaded in memory.
How can you modify registers to change the execution flow of a program?
The most important register for this is the eip (Instruction Pointer). This fetches the next instruction in memory to be executed from a given memory address. Therefore, the eip value can be modified to point to an alternate address to execute that function with the following command:
set $eip = [function address]
function addresses can be determined using the print command:
print [function_name]
All registers must be referenced by prepending the ‘$’ character.
What are Convenience Variables?
Variables which can be created in GDB to hold data. They can be easily created using the set command, and then assigned to different variables in the program.
e.g. in gdb: set $demo = “BBBB”
set argv[1] = $demo
print argv[1]
$4 = 0x804b008 “BBBB”
