Utilizing the GDB debugger to analyze programs Background and application

Topics to be discussed:  Background Information  The shell  Basic commands  Useful practices  The stack  GDB debugger  Accessing the shell  Basic commands  Homework 2

The Shell  Bourne Again Shell (BASH) Bourne Again Shell (BASH)  Visual Text Editor (vi) Visual Text Editor (vi)  Command mode (:)  ! (bang) – run shell command  w – save  With an argument acts like save as  q - quit  Insert mode(i-insert,a-append,o–insert above)  x – delete character  dd – delete line  #, Shift+g – jump to line

The Shell continued  Pipe (|) use output from one command as input for another – command | command  script – used to write all command line activity to a file  To read (cat scriptname | more)  chmod – change file permissions  chmod [a,g,u,o] [+,-] [r/w/x] filename  Octal numbers can be used instead, one each for user, group, others, and all where the binary representation shows permissions (r,w,x)  ls – list files-a show hidden files –l list attributes  cp – copy file(source destination)  mv – move file (source destination)  rm – remove file –f (force, don’t show warnings)  rmdir – remove directory  man – manual pages for command if installed

Useful Practices  (RCS) Revision Control Systems (RCS) Revision Control Systems  Tracks changes in source files  Allows for multiple versions of the same file  When files are checked out, no other user can edit those files (prevents over writing of files when multiple people are working on the same project)

Useful Practices  Make files Make files  Defines compilation (useful when using multiple files) – limits human error  Uses dependency rules and logic to compile necessary files  Only compiles files that have been recently modified (saves compile time)  Sample Make File Sample Make File

Useful Practices  Extend your path  Located in.bash_profile (shell specific)  Append a colon and the path you wish to add  When a command is issued in the shell, the shell will check your default path, then the appended path – run programs that exist in the path from anywhere in the system

The Stack The stack is used to preserve data, hold local variables, store return addresses when subroutines are called, and to pass and return information between functions.  When information is saved on the stack, it is referred to as a push.  When information is read from the stack, it is referred to as a pull or pop.  The stack pointer is automatically manipulated as data is moved to/from the stack.

The Stack  A pointer must be initialized and set to the bottom of the stack (highest location in stack). When information is pushed to the stack, the stack pointer is first adjusted, then the information is stored, when information is pulled, it is first pulled, and then the stack pointer is adjusted.

The Stack Frame  Every time a function is called, a stack frame is created.  In addition to local variables, the frame contains:  passed parameters from the calling code,  space for results returned from subroutine,  the return address of the subroutine, and  saved register contents.  **Within the subroutine, addressing is done relative to the frame pointer, which points to the return address. (stack pointer value at time of function call)

The Stack Frame  The stack frame should be allocated immediately upon entering a function and deallocated prior to exiting.  The stack pointer is transferred to another register which is referred to as the frame pointer.  The stack pointer is adjusted to reserve space for local variables.  This is done to support reentrancy – further functions can be called, and interrupts can occur without affecting information in the stack frame.

Illustration of Stack Frame Enter Function Transfer Stack Pointer Allocate Stack Frame Call external Function Return Address Since all local variables, and the return address are stored on the stack, no information will be lost when additional functions are called. Registers may also be pushed before calling a new function, and pulled upon returning. *Values can be passed/returned by loading them into registers, or pushing them onto the stack prior to calling/returning from another function.

GDB Debugger  The GDB debugger can be used to debug a number of different programming languages and/or their associated binary output.  Starting the debugger:  Type gdb from the command line, or gdb filename to start the debugger and load a file to run.  The shell can be accessed by typing shell command  ex. shell ls  history will display the history of the gdb session  Cheat Sheet Cheat Sheet  Extended Info Extended Info  Overview - from Stanford Overview - from Stanford  DDD – GUI based debugger which uses GDB

Commands  file – file filename will load the symbols from the target file, and prepare the file for debugging.  run – will begin execution of the target file  display – used to display information when a breakpoint is reached. display/i $pc will show the next instruction.  set logging on - starts a log file of all commands and output during the gdb session.  break  break function name/ line number will set a breakpoint at the specified function or line number.

Breakpoints  commands breaknum  Specify commands to be executed when breaknum is reached. The commands can be any list of C statements or gdb commands. This can be useful to fix code on-the-fly in the debugger without recompiling  info – can be used to obtain information about most program and gdb attributes  registers – show register contents  locals- show local variables/values

Breakpoints  next – step program until a new source line is reached  nexti – step one instruction  Next instructions treat subroutine calls as an instruction, (subroutine executed, but not stepped into)  step – step program until a new source line is reached  stepi – step one instruction  Step instructions will treat subroutines as a part of the source. Subroutine will be entered and debugged.

Further Examination  disassemble – shows the assembly for a program from a given memory location  /r option shows machine code  x (examine) allows you to examine memory locations with a given format  /s –string  /#c – character  /#x – byte  /#t – word

Using the source  set list # - sets the number of lines of source to show when list is called  list – lists the source from the start of the program or a specified line number  edit – starts an edit session of the source file(read only) in the default text editor using MIME types.

Homework 2  Dell PowerEdge R510 Server- Intel Xeon X5560 processor Dell PowerEdge R510 Server- Intel Xeon X5560 processor  Intel® 64 and IA-32 Architectures Software Developer's Manual Volume 1: Basic Architecture [pdf] Intel® 64 and IA-32 Architectures Software Developer's Manual Volume 1: Basic Architecture [pdf]  Register Table Register Table  List of Registers List of Registers  Specific Register Duties Specific Register Duties  Registers Outlined Registers Outlined  Register Overlay Register Overlay  Intel® 64 and IA-32 Architectures Software Developer's Manual Volume 2A: Instruction Set Reference, A-M [pdf] Intel® 64 and IA-32 Architectures Software Developer's Manual Volume 2A: Instruction Set Reference, A-M [pdf]  Intel® 64 and IA-32 Architectures Software Developer's Manual Volume 2B: Instruction Set Reference, N-Z [pdf] Intel® 64 and IA-32 Architectures Software Developer's Manual Volume 2B: Instruction Set Reference, N-Z [pdf]  ASCII table ASCII table