Using GDB without debugging symbols on x86?

问题:

How do I use GDB to debug a program which do not have debugging symbols on a 32-bit x86 processor? Inspecting the function arguments, local variables, resolving pointers would be useful to know how to do. The intention is not really to use this for reverse engineering, as I'm sometimes just too lazy to install the debugging symbols and would be great to know how to get some basic information out of gdb.

回答1:

To start out, you can do;

gdb "whatever"
break __libc_start_main
r

that will setup a breakpoint in libc's crt0 code and allow you to break before main, even if the target binary is totally stripped.

That will get you to a running state at a breakpoint before most user code. You can then single step, dissasemble, dump memory etc... to your heart's content.

This works on all platforms, the fact your asking about IA-32 / x86 does not matter.

回答2:

Without debugging symbols, you can only debug at the ASM level. Ok you get a bit more information, but you're not going to get very far unless you understand a bit of ASM and the code the compiler generates. This will let you do a simple inspection of local variables etc if you know what you're doing.

If you have the source, it's going to be far easier just to recompile it.

回答3:

All you can do is look at registers and the contents of the stack - you'll have to do everything by inferring what things are used for, as Draemon mentions.

回答4:

Well, the absolutely most important thing is that you be able to unwind the stack. There are three ways this can be ensured:

• Build debugging symbols with -g

• On systems that do C++ exception unwinding via tables (probably anything ELF these days?), the -funwind-tables flag will tell it to generate such tables regardless of language, and GDB can use these tables (at least, with x86 linux it can).

• Or, failing those, at least make sure that -fomit-frame-pointer isn't enabled