{"id":395866,"date":"2024-06-29T12:29:05","date_gmt":"2024-06-29T12:29:05","guid":{"rendered":"http:\/\/savepearlharbor.com\/?p=395866"},"modified":"-0001-11-30T00:00:00","modified_gmt":"2024-06-29T12:29:05","slug":"","status":"publish","type":"post","link":"https:\/\/savepearlharbor.com\/?p=395866","title":{"rendered":"GDB Tutorial for Reverse Engineers: Breakpoints, Modifying Memory and Printing its Contents<\/span>"},"content":{"rendered":"
<\/div>\n
\n
\n
\n
\n
<\/figcaption><\/figure>\n

GDB is THE debugger for Linux programs. It\u2019s super powerful. But its user-friendliness or lack thereof can actually make you throw your PC out of the window. But what\u2019s important to understand about GDB is that GDB is not simply a tool, it\u2019s a debugging framework for you to build upon. In this video, I\u2019m gonna walk you through GDB setup for reverse engineering and show you all of the necessary commands and shortcuts for your debugging workflow.<\/p>\n

GDB Setup With Plugins<\/h2>\n

The\u00a0most common mistake I see is that people perceive GDB as a standalone debugger tool. I suggest you think of GDB as a debugger framework that allows you to build your own tools. Or you can use premade tools. My GDB-based tool of choice is Peda. It\u2019s pretty easy to install, just follow installation instructions from Peda repository:\u00a0https:\/\/github.com\/longld\/peda<\/u><\/a><\/p>\n

git clone https:\/\/github.com\/longld\/peda.git ~\/peda echo \"source ~\/peda\/peda.py\" >> ~\/.gdbinit<\/code><\/pre>\n
Program example<\/h2>\n
I\u2019ll be using this simple program as our debugging target:<\/p>\n
#include <stdio.h>int main() {int x = 5;printf(\"x = %d\\n\", x);x = x + 5;printf(\"x = %d\", x);return 0;}<\/code><\/pre>\n
This code creates local variable X on the stack, prints its value to the console, then adds 5 to X, and prints its value again. Pretty simple, just what we need for our learning example.<\/p>\n
First Steps with Debugging a Program<\/h2>\n
To open a file in GDB, type\u00a0gdb [filename]<\/code>\u00a0in the console. GDB will open and load your file. Notice, that code execution hasn\u2019t started. That\u2019s because there\u2019s a separate command to start the execution, it\u2019s called\u00a0run<\/code>, or\u00a0r\u00a0<\/code>for short.<\/p>\n
<\/figcaption><\/figure>\n
And if we start it, our program successfully completes execution. That\u2019s because we haven\u2019t set any breakpoints yet. We can set a breakpoint using symbol name, for example,\u00a0break main<\/code>, or using address: `break *0x555555555149`. You can print a list of all your breakpoints with \u2018info breakpoints\u2019 and delete them with\u00a0delete <breakpoint number><\/code>.<\/p>\n
<\/figcaption><\/figure>\n
Now if I issue\u00a0run\u00a0<\/code>command, the execution conveniently stops at the beginning of the \u201cmain\u201d function. And just to save us some time we can use command\u00a0start\u00a0<\/code>which comes from Peda instead of doing all of this. This command will do all this work for us.<\/p>\n
Of course, as with any other debugger, we can use single-stepping with command\u00a0step\u00a0<\/code>or\u00a0stepi<\/code>.<\/p>\n
And if you like to do single-stepping a lot, note, that pressing \u2018Return\u2019 on an empty line will make GDB execute the previous command you entered once more. Also, you can use command\u00a0next\u00a0<\/code>to single step without entering function calls.<\/p>\n
To step through several instructions at once you can use command\u00a0next <number of instructions><\/code>.<\/p>\n
If you want to continue execution to a certain point in a program (for example to exit a loop), you can use command\u00a0xuntil <address or function><\/code>.<\/p>\n
Modifying Registers<\/h2>\n
To modify registers, use following construction\u00a0set$<register name> = 1234<\/code>. For example, if I want to skip incrementing X, I can change the value of RIP register to 0x555555555176 with command\u00a0set $RIP = 0x555555555176<\/code>.<\/p>\n
<\/figcaption><\/figure>\n
As you might have noticed, you can treat registers like variables in GDB. So I can assign RIP value of EAX with\u00a0set $rip = $eax<\/code>\u00a0command. Now I can issue\u00a0context<\/code>\u00a0command to make Peda reprint its beautiful context \u201cwindow\u201d to make sure that RIP points to some nonsense.<\/p>\n
<\/figcaption><\/figure>\n
And I want to start execution from the start of \u2018main\u2019 function I can just write\u00a0set $rip = main<\/code>.<\/p>\n
By the way, with Peda you have a faster way to skip instructions without executing them with\u00a0skipi<\/code>\u00a0command.<\/p>\n
Modifying Memory<\/h2>\n
Modifying memory is similar to modifying registers in the sense that any memory location can be a variable in GDB. So in my example, I want to change the contents of the format string \u201cx = %d\u201d. This string is located at 0x555555556004 in my binary. I can use this address as a variable and type in the same command as with registers:\u00a0set 0x555555556004 = \u201cAAAA%d\u201d<\/code>. But in this case, we\u2019ll see an error message. That\u2019s because you should always provide a variable type when modifying memory in GDB. So let me correct my command to\u00a0set {char[7]}0x555555556004 = \u201cAAAA%d\u201d<\/code>.<\/p>\n
<\/figcaption><\/figure>\n
Print xprint hexdump hexprint<\/h2>\n
You can use the command\u00a0x<\/code>\u00a0to examine memory. For example, if I want to print 20 8-byte words from the stack pointer, I\u2019ll use command\u00a0x\/20xg $rsp<\/code>: 20 \u2014 the number of words, x \u2014 hexadecimal format, g \u2014 giant (8-byte words).<\/p>\n
<\/figcaption><\/figure>\n
By changing the second\u00a0x<\/code>\u00a0to\u00a0i<\/code>\u00a0you can print memory as instructions.<\/p>\n
<\/figcaption><\/figure>\n
The full list of supported modifiers you can find in the documentation:<\/p>\n
\n
From\u00a0<\/em>https:\/\/sourceware.org\/gdb\/current\/onlinedocs\/gdb\/Memory.html<\/u><\/em><\/a><\/p>\n
You can use the command\u00a0<\/em>x<\/code>\u00a0(for \u201cexamine\u201d) to examine memory in any of several formats, independently of your program\u2019s data types.<\/em><\/p>\n
x\/nfu addrx addrx<\/code>\u00a0Use the\u00a0<\/em>x<\/code>\u00a0command to examine memory.<\/em><\/p>\n
n, f, and u are all optional parameters that specify how much memory to display and how to format it; addr is an expression giving the address where you want to start displaying memory. If you use defaults for nfu, you need not type the slash \u2018\/\u2019. Several commands set convenient defaults for addr.<\/em><\/p>\n
n, the repeat countThe repeat count is a decimal integer; the default is 1. It specifies how much memory (counting by units u) to display. If a negative number is specified, memory is examined backward from addr.f, the display formatThe display format is one of the formats used by\u00a0<\/em>print<\/code>\u00a0(\u2018x\u2019, \u2018d\u2019, \u2018u\u2019, \u2018o\u2019, \u2018t\u2019, \u2018a\u2019, \u2018c\u2019, \u2018f\u2019, \u2018s\u2019), and in addition \u2018i\u2019 (for machine instructions). The default is \u2018x\u2019 (hexadecimal) initially. The default changes each time you use either\u00a0<\/em>x<\/code>\u00a0or\u00a0<\/em>print<\/code>.u, the unit sizeThe unit size is any of<\/em>b<\/code>Bytes.<\/em>h<\/code>Halfwords (two bytes).<\/em>w<\/code>Words (four bytes). This is the initial default.<\/em>g<\/code>Giant words (eight bytes).<\/em><\/p>\n<\/blockquote>\n
Also, Peda provides you with a convenient\u00a0hexdump address \/count<\/code>\u00a0(dump \u201ccount\u201d lines, 16-bytes each) command which you can use\u2026 well, to display hex dump.<\/p>\n
<\/figcaption><\/figure>\n
And if you want to print again all the stuff Peda shows to you (instructions, registers, stack, etc.), you command\u00a0context<\/code>.<\/p>\n
Final Thoughts<\/h2>\n
So today we\u2019ve seen a glimpse of GDB functionality. To sum up, I want you to take home 3 things:<\/p>\n