1. By Hugues Leger / legerhs@mail.uc.edu
Intro to GDB debugger By
Hugues Leger /
11/16/2019

2. Intro to GDB debugger Agenda Start the debugger
Set the Intel disassembly format
List debugged source code
Dump disassembly code
Set a break point
Run program (Step by Step)
Read registers info / statuses (EIP/EBP/ESP …)
Examine memory addresses
11/16/2019

3. Intro to GDB debugger Compile the program
$ gcc –g simpleprog.c (-g flag is used to include extra debugging information, which gives GDB access to the source code.
Start the debugger (in quiet mode)
gdb –q ./a.out
(gdb)
Set disassembly syntax to intel
(gdb) set dis intel
Note: Configure this setting to run every time GDB starts up, put the command in the file .gdbinit in your home directory
$ echo “set dis intel” > ~/.gdbinit
List the source code
(gdb) list
11/16/2019

4. Intro to GDB debugger Dump the disassembly of the main() function
(gdb) disassemble main
Set break point at the start of the main() function
(gdb) break main
Run the program
(gdb) run (Program hits break point and pauses before executing any instructions.
Display all the registers and their statuses
(gdb) info registers
Display / check the value of the EIP (Instruction Pointer)
(gdb) info register eip (the memory address eip points to)
NOTE: eip skips the function prolog
11/16/2019

5. Intro to GDB debugger
Memory can be examined using the command x, which is short for examine.
Expects 2 arguments: The memory location to examine and how to display that memory
The display format uses a single letter (x) optionally preceded by a count of items to examine.
Some common format letters are as follows:
o Display in octal
x Display in hexadecimal
u Display in unsigned, standard base-10 decimal
t Display in binary
11/16/2019

6. Intro to GDB debugger
Memory can be examined using the command x, which is short for examine.
Examine the content of eip (the value eip contains at that moment)
(gdb) x/x $eip
Display the assembly instruction pointed by eip
(gdb) x/i $eip
- What address does the ebp register currently content?
(gdb) i r ebp
(gdp) print $ebp - 4
What is the contain of [ebp – 4] before the instruction is executed?
(gdb) x/4xb $ebp Contains random garbage
11/16/2019

7. Intro to GDB debugger - What assembly instruction is that?
- What is the contain of [ebp – 4] before the instruction is executed?
(gdb) x/4xb $1
- Execute current instruction using the command nexti
(gdb) netxi
- Now examine the content of ebp - 4
(gdb) x/4xb $ebp - 4
- What does eip point to now?
(gdb) i r eip
- What assembly instruction is that?
(gdb) x/i $eip
11/16/2019

8. Intro to GDB debugger - Display the 10 next instructions
(gdb) x/10i $eip
- Run current instruction
(gdb) nexti
- Check content of eip
(gdb) i r eip
- Display the assembly instruction
(gdp) x/i $eip
Display next 2 instructions
(gdb) x/2i $eip
mov DWORD PTR [esp], 0x
call 0x80482a0
11/16/2019

9. Intro to GDB debugger
mov DWORD PTR [esp], 0x (write address 0x into memory address pointed by esp.
What does esp currently point to?
(gdb) i r esp
(gdb) x/1xw $esp
- After the instruction esp will point to 0x
(gdb) nexti
What is so especial about memory address 0x ?
(gdb) x/6xb 0x (Hello, <space>)
(gdb) x/s 0x
11/16/2019