gdb: breakpoint when register will have value 0xff

问题:

Can I set the breakpoint/watchpoint/smth else in gdb for register value?

I want to break when $eax will have value 0x0000ffaa.

Is it possible with gdb or dbx or any other unix debugger?

回答1:

Yes in gdb you would set a watchpoint like so:

watch $eax == 0x0000ffaa

But it is dependent on watchpoint support being available for the target. You should note that this may slow down execution significantly.

If you would like to break in a certain location you can do so, by setting a conditional breakpoint:

break test.c:120 if $eax == 0x0000ffaa

回答2:

To whit:

If you use $eax the condition is ignored and it becomes an unconditional watch/breakpoint.

(gdb) disass print_hello
Dump of assembler code for function print_hello:
0x000000000040058c :     push   %rbp
0x000000000040058d :     mov    %rsp,%rbp
0x0000000000400590 :     sub    $0x20,%rsp
0x0000000000400594 :     movl   $0x1,-0x4(%rbp)
0x000000000040059b :    movl   $0x5,-0x4(%rbp)
0x00000000004005a2 :    mov    -0x4(%rbp),%esi
0x00000000004005a5 :    mov    $0x4006dc,%edi
0x00000000004005aa :    mov    $0x0,%eax
0x00000000004005af :    callq  0x400468 
0x00000000004005b4 :    leaveq 
0x00000000004005b5 :    retq

End of assembler dump.


(gdb) break *0x00000000004005af if $eax==0
Breakpoint 1 at 0x4005af: file hello.c, line 7.
(gdb) info break
Num     Type           Disp Enb Address            What
1       breakpoint     keep y   0x00000000004005af in print_hello at hello.c:7
        stop only if $eax==0
(gdb) run
Starting program: /home/dg/hello/hello 
hello world 2
Error in testing breakpoint condition:
Invalid type combination in equality test.

Breakpoint 1, 0x00000000004005af in print_hello () at hello.c:7
7               printf("hello %d\n", value);

(gdb) condition 1 $eax != 0
(gdb) run
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/dg/hello/hello 
hello world 2
Error in testing breakpoint condition:
Invalid type combination in equality test.

Breakpoint 1, 0x00000000004005af in print_hello () at hello.c:7
7               printf("hello %d\n", value);
(gdb) 

But $rax works as it should:

(gdb) condition 1 $rax != 0
(gdb) info break
Num     Type           Disp Enb Address            What
1       breakpoint     keep y   0x00000000004005af in print_hello at hello.c:7
        stop only if $rax != 0
        breakpoint already hit 1 time
(gdb) run
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/dg/hello/hello 
hello world 2
hello 5


Program exited normally.
(gdb) condition 1 $rax == 0
(gdb) run
Starting program: /home/dg/hello/hello 
hello world 2

Breakpoint 1, 0x00000000004005af in print_hello () at hello.c:7
7               printf("hello %d\n", value);
(gdb) 

This was all tested on gdb 6.8.50: GNU gdb (GDB; SUSE Linux Enterprise 11) 6.8.50.20081120-cvs

回答3:

If you are on a 64 bit machine you have to watch $rax, not $eax.

回答4:

I was unable to get it to watch eax directly, so I inserted a few asm instructions to store the required value to a junk variable and watch that. I was unable to convince gcc to use eax, so this code "watches" ebx instead.

#include <stdio.h>
int tmp;
int main(void)
{
  int i;
  printf("tmp is originally %d\n",tmp);
  for(i=0;i<20;i++)
  {
    asm (
    "cmpl $10,%ebx\n"
    "jne dont\n"
    "movl %ebx,tmp\n"
    "dont:\n"
        );
    printf("%d\n",i);
  printf("\nnow tmp is %d\n",tmp);
  return 0;
}

Now you can "watch tmp"