Tool GDB

Examining Memory (data or in machine instructions)

You can use the command x (for “examine”) to examine memory in any of several formats, independently of your program's data types.

x/nfu addr

x addr

x

n, the repeat count

The repeat count is a decimal integer; the default is 1. It specifies how much memory (counting by units u) to display.

f, the display format

The display format is one of the formats used by print (`x', `d', `u', `o', `t', `a', `c', `f', `s'), and in addition `i' (for machine instructions). The default is `x' (hexadecimal) initially. The default changes each time you use either x or print.

x -- Print as integer in hexadecimal.

d -- Print as integer in signed decimal.

u -- Print as integer in unsigned decimal.

o -- Print as integer in octal.

t -- Print as integer in binary. The letter `t' stands for “two”. 1

a -- Print as an address, both absolute in hexadecimal and as an offset from the nearest preceding symbol. You can use this format used to discover where (in what function) an unknown address is located:

(gdb) p/a 0x54320

$3 = 0x54320 <_initialize_vx+396>

c -- Regard as an integer and print it as a character constant.

f -- Regard as a floating point number and print using typical floating point syntax.

s --Regard as a string

u, the unit size  -- The unit size is any of

b -- Bytes.

h -- Halfwords (two bytes).

w -- Words (four bytes). This is the initial default.

g -- Giant words (eight bytes).

Each time you specify a unit size with x, that size becomes the default unit the next time you use x. For the `i' format, the unit size is ignored and is normally not written. For the `s' format (string), the unit size defaults to `b', unless it is explicitly given. Use x /hs to display 16-bit char strings and x /ws to display 32-bit strings. The next use of x /s will again display 8-bit strings. Note that the results depend on the programming language of the current compilation unit. If the language is C, the `s' modifier will use the UTF-16 encoding while `w' will use UTF-32. The encoding is set by the programming language and cannot be altered.

Example:

x/4xw $sp -- print the four words (`w') of memory above the stack pointer  in hexadecimal (`x').

x/3uh 0x54320 -- display three halfwords (h) of memory, formatted as unsigned decimal integers (`u'), starting at address 0x54320.

x/5i $pc-6 -- examines machine instructions.

Registers

The names of registers are different for each machine; use info registers to see the names 
used on your machine.
info registers– check register names
gdb four “standard” register:
$pc -- the program counter register, $RIP
$sp -- the stack pointer register, $RSP
$fp -- a pointer to the current stack frame, “base pointer” register, $RBP
$ps -- a register that contains the processor status
Example:
p/x $pc
x/i $pc

GDB conversation

If displaying variable, which is a address, gdb will try to display its content(value) together. 
Format:
Address:  content(value) 
Example:
(gdb) x/x $pc  -- $pc is a address
0x40071e <_Z3addii+4>:  0x10ec8348
(gdb) x/i $pc
0x40071e <_Z3addii+4>:  sub    $0x10,%rsp
(gdb) x/xg $pc
0x40071e <_Z3addii+4>:  0x89fc7d8910ec8348
(gdb) p $pc – print value of $pc only
$9 = (void (*)()) 0x40071e <add(int, int)+4>
(gdb) p/x $pc
$10 = 0x40071e 

Advance guide for debugging a program

Introduce

Any program only includes data and machine instructions.
Machine instructions: user code(Text), static lib code and shared lib code. We can 
disassemble program at any program memory.
Data: initialized data, uninitialized data (bss), Heap(malloc arena), stack and registers. 
Commonly, the code(machine instruction) won’t change when running a program. It means 
if we track data, we can know the all program status according to machine instruction.
This means gdb x command can be a general tool for program debug.

Virtual memory

Modern operating systems and architectures provide virtual memory. Through hardware support and additional code in the operating system, virtual memory allows each user process to act as though it is the only thing running on the computer. It gives each process a completely separate address space.

Through pmap, user can check process' memory map, such as:

$ pmap 23814  # If you don't have pmap installed, use 'cat /proc/23814/maps'

Process memory layout

It is for 64-bit systems. On 32-bit systems the shared libraries are usually found at the lowest address, followed by the text segment, then everything else.

The text, or code, segment contains the actual program and any statically linked libraries. On 64-bit systems it generally starts at 0x400000 (32-bit systems like to place it at 0x8047000).

The data and BSS segments come next. The data segment contains all initialized global variables as well as static strings (eg, those used in printf). The BSS, or "block started by segment" region holds all uninitialized global variables (those which by C convention are initialized automatically to 0).

After that comes the heap, where all memory obtained via malloc() is located. The heap grows upwards as more memory is requested.

Then we have any shared libraries such as the loader, libc, malloc, etc.

Finally we have the stack, which it should be noted grows downward as it expands.

Downward-growing stack

Programs use the stack to store temporary, or automatic variables, arguments passed during a function call, and information needed to return to a previous point in the program when a function call is made.

There are also three registers that are important at this point - RBP, RSP, and RIP. RSP is the stack pointer. The stack works just like a LIFO queue with push() and pop() operations. RSP tracks the next available position in this queue.

The stack frame is essentially the region of the stack that is presently active, or that corresponds to the presently executing function. It is pointed to by RBP, the "base pointer," and is used in combination with an offset to reference all local variables. Every time a function is called, RBP is updated to point to its stack frame.  

RIP is the instruction pointer. It holds the address of the instruction that the CPU just loaded and is presently executing.

The diagram above shows a snapshot of the stack for a program that is presently in func1(), which was called from main(). In order for the stack to look this way, some things must have happened when func1() was called. These steps are defined by the C calling convention. [2]

1. The arguments to func1() were pushed onto the stack.
2. func1() was called.
3. RBP was pushed onto the stack.
4. RSP was moved to RBP.
5. Space for the local variables was allocated on the stack.
6. Local variables were set to initial values (if provided).

Steps 3 through 6 are called the function prelude.

图3 带有基指针的栈帧

System calls

The only way to enter supervisor mode is to go through predefined entry points in the kernel. 
One of these points is called a system call.

How system calls work on x86_64 Linux by taking a look at the kernel source, specifically arch/x86_64/kernel/entry.S where we see the following comment...

/*

 * System call entry. Upto 6 arguments in registers are supported.

 *

 * SYSCALL does not save anything on the stack and does not change the

 * stack pointer.

 */

                              

/*

 * Register setup: 

 * rax  system call number

 * rdi  arg0

 * rcx  return address for syscall/sysret, C arg3

 * rsi  arg1

 * rdx  arg2        

 * r10  arg3        (--> moved to rcx for C)

 * r8   arg4

 * r9   arg5

 * r11  eflags for syscall/sysret, temporary for C

 * r12-r15,rbp,rbx saved by C code, not touched.                          

 *

 * Interrupts are off on entry.

 * Only called from user space.

 *

 * XXX   if we had a free scratch register we could save the RSP into the stack frame

 *      and report it properly in ps. Unfortunately we haven't.

 */ 

So to make a system call, you first store the syscall number in RAX, any parameters in RDI, RSI, 
RDX, etc, and then execute the "syscall" instruction.

图4 64位模式下通用寄存器的大小和名称

图5 在传统和兼容模式下的通用寄存器大小和名称

通用寄存器在编程时通常用于不同的用途,说明如表1所示。

表1 通用寄存器的用途

寄存器名

用途

EAX

累加器

EBX

基址寄存器

ECX

计数器

EDX

数据寄存器

ESI

源地址指针寄存器

EDI

目的地址指针寄存器

EBP

基址指针寄存器

ESP

堆栈指针寄存器

 
待续 参考文献:
Buffer Overflows and You (上)
GDB munual
X86-64构架概述
X86-64处理器构架的应用程序二进制接口

作者:zhenjing.chen 
出处:http://www.cnblogs.com/zhenjing/ 
未注明转载的文章,版权归作者所有,欢迎转载,但未经作者同意必须保留此段声明,且在文章页面明显位置给出原文连接,否则保留追究法律责任的权利。

[Advance] How to debug a program (上)的更多相关文章

  1. eclipse debug Liunx服务器上的svn项目

    1.本地项目提交到svn上,以保证本地代码与服务器代码相同 2.开启服务器debug端口 3.使用root账号重新部署服务器项目并监听catalina.out sh /home/p/deploy/gt ...

  2. using gdb to debug c program

    #include <stdio.h> static void display(int i, int *ptr); int main(void) { int x = 5; int *xptr ...

  3. 如何让Jboss的debug在myeclise上运行

    1.在windows下运行jboss的debug.bat 看见监听的端口 2.打开myeclipse 点击选择 ①你要配置的名字(随意) ②myeclipse中选中该项目 ③jboss的启动的ip地址 ...

  4. Eclipse进行Debug时断点上有一个斜杠,并且debug没有停在断点处

    断点上有斜杠,这是由于设置了Skip All Breakpoints的缘故,调试会忽略所有断点,执行完,只需取消Skip All Breakpoints即可,操作:Run-->Skip All ...

  5. Rocket - debug - TLDebugModuleInner - Program Buffer Access

    https://mp.weixin.qq.com/s/EJVqw7JPjjaib68tENl5AQ 简单介绍TLDebugModuleInner中的Program Buffer Access. 1. ...

  6. Rocket - debug - TLDebugModuleInner - Program Buffer

    https://mp.weixin.qq.com/s/kjhJJ3moRQzxHt6pJOXEgg 简单介绍TLDebugModuleInner中Program Buffer寄存器的实现. 1. pr ...

  7. eclipse远程debug服务器上的项目(Tomcat),打开、关闭及常见错误汇总

    我们工作中,有时候测试/生产环境,出现的结果会与我们预计的不一样,只看代码又看不出去问题所在,这个时候就需要远程debug下服务器上的项目. 注意:(1)需要debug的代码,本机代码需与服务器上一致 ...

  8. mac上eclipse用gdb调试(转)

    mac上eclipse用gdb调试 With its new OS release, Apple has discontinued the use of GDB in OS X. Since 2005 ...

  9. 预定义指令之debug

    1)根据你必须知道的.NET一书, #define DEBUG class Program { static void Main(string[] args) { #if DEBUG Console. ...

随机推荐

  1. Go:struct

    一.使用方式 方式3和方式4返回的是:结构体指针,编译器底层对 p.Name 做了转化 *(p).Name,方便程序员使用. type Person struct { Name string Age ...

  2. java使用ant.jar解压缩文件

    ant.jar下载地址http://ant.apache.org/bindownload.cgi 压缩文件代码: import org.apache.tools.ant.Project; import ...

  3. Python 中的变量还能这样理解(白话)

    一.案例分析 1.思考 计算软件测试大佬柠檬小姐姐,每月能存多少钱 # 计算软件测试大佬柠檬小姐姐,每月能存多少钱 # 坐标:深圳 # 2018年1月份 # 房租水电 4000元 # 伙食费 1000 ...

  4. xtu read problem training 4 A - Moving Tables

    Moving Tables Time Limit: 2000ms Memory Limit: 65536KB This problem will be judged on ZJU. Original ...

  5. Leetcode 166.分数到小数

    分数到小数 给定两个整数,分别表示分数的分子 numerator 和分母 denominator,以字符串形式返回小数. 如果小数部分为循环小数,则将循环的部分括在括号内. 示例 1: 输入: num ...

  6. [luoguP1044] 栈(数论?)

    传送门 卡特兰数 代码 #include <cstdio> int n; long long f[20]; int main() { int i; scanf("%d" ...

  7. 整体二分--BZOJ1901: Zju2112 Dynamic Rankings

    n<=10000个数有m<=10000个操作,1.询问一个区间的第k小的数:2.单点修改. 带修主席树. 整体二分. 整体二分的必要条件: #include<string.h> ...

  8. jquery校验框架

    http://www.validform.club/ http://craftpip.github.io/jquery-confirm/

  9. weblogic自带的jdk是在工程的包部署后编译使用

    weblogic自带的jdk是在工程的包部署后编译使用的.当用户把项目打包部署到weblogic上面,运行该项目的java环境jdk就是用的weblogic自带的jdk了,工程中的jdk和编译时的jd ...

  10. mvn打包源码的方法:maven-source-plugin

    maven-javadoc-plugin可以打包 dubbo-demo-provider-2.6.1-javadoc.jar maven-jar-plugin 打包插件 dubbo-demo-prov ...