Reversing a binary utilizing GDB: tutorial for Reverse Engineers

0
107

[ad_1]

This weblog was written by an unbiased visitor blogger.

Reversing binaries is a vital talent if you wish to pursue a profession as exploit developer, reverse engineer or programming. The GNU Mission debugger is a extensively used debugger for debugging C and C++ functions on UNIX methods. A debugger is a developer’s greatest pal to determine software program bugs and points. 

This tutorial intends to be helpful to all builders who need to create dependable and fault-free software program.

A debugger executes a number of applications and permits the programmer to handle them and analyze variables in the event that they trigger points.

GDB allows us to execute this system till it reaches a particular level. It will probably then output the contents of chosen variables at that second, or stroll via this system line by line and print the values of each parameter after each line executes. It has a command-line interface.

Let’s perceive GNU debugger with an instance

To put in the GDB within the Linux system, sort within the command to put in GDB.

The code I’m utilizing for an instance right here is calculating factorial numbers inaccurately. The purpose is to determine why the problem occurred.

#embody

utilizing namespace std;

lengthy factorial(int n);

int predominant()

{
int n(0);

cin>>n;

lengthy val=factorial(n);

cout<
;>

GCC is a Linux compiler that comes pre-installed in Linux. Use the “g++” command to transform the supply code “take a look at.cpp” into an executable “predominant.” Use “-g flag” so you’ll be able to debug the code later as properly.

Begin the GDB with the executable filename within the terminal.

You will probably want the code to cease at one stage so you’ll be able to assess its standing. The breakpoint is the road the place you need the code to halt momentarily. On this situation, I’m setting a breakpoint on line 11 and working this system.

The instructions “subsequent” and “step” in GDB execute the code line by line.

The Step command screens the execution through operate calls.
The Subsequent command retains management solely within the present scope.

Utilizing “watchpoints” is akin to requesting the debugger to provide you a relentless stream of details about any modifications to the variables. The software program stops when an replace occurs and informs you of the specifics of the change.

Right here, we set the watchpoints for the calculation’s end result and the enter worth because it fluctuates. Final, the outcomes of the watchpoints are analyzed to establish any irregular exercise.

Discover the end in “outdated” and “new” values.  To repeatedly discover the shift in values, press the Enter key.

Discover that “n” instantaneously reduces from 3 to 2.

By multiplying the earlier worth of the consequence by the “n” worth, the consequence now equals 2. The primary bug has been noticed!

It ought to assess the end result by multiplying 3 * 2 * 1. Nonetheless, the multiplication right here begins at 2. We’ll have to change the loop a bit to repair that.

The result’s now 0. One other bug!

So, when 0 multiplies with the factorial, how can the output hold the factorial worth? It should be that loop halts earlier than “n” approaches 0.

When “n” values shift to -1, the loop could not execute anymore. Subsequent, name the operate. Discover when a variable is out of scope, watchpoint deletes it.

Analyzing native variables to find out whether or not something uncommon has occurred may show you how to find the problematic part of your code. Since GDB refers to a line earlier than it runs, the “print val” command returns a trash worth.

Final, the error-free code would seem like this.

To completely comprehend what the debugger is doing, study the meeting code and what’s occurring in reminiscence.

Use the “disass” command to output the listing of Meeting directions. GDB’s default disassembly type is AT&T, which could perplex Home windows customers as this type is for Linux. If you happen to don’t desire this, the disassembly type might be re-set as properly.

Execute the “set disassembly-flavor ” command to alter to the Intel disassembly type.

The logic stream is essential to the success of any program. The stream of Meeting code might be easy or sophisticated, primarily based on the compiler and settings used throughout compiling.

The primary three strains are Reminiscence Setup.

 

DWORD PTR -> Transfer the worth at [rdp-0xc] and skim bytes.

 

QWORD PTR -> QWORD operand describes an handle of quod-word measurement in Intel’s x86 household of processors; this implies 8 bytes. And PTR signifies the worth of the operand that must be handled as an handle.

In a nutshell

After ending this tutorial, you must have a strong information of utilizing GNU Debugger to debug a C or C++ applications.

We took an instance of C++ code and tried a number of issues with GDB. However if you wish to discover it additional, use the “assist” possibility within the “(gdb) interface.”

Concerning the Creator: Irfan Shakeel, EH Academy
Irfan Shakeel is the founding father of ehacking.web and creates future cyber safety professionals by providing high quality cyber safety training at EH Academy. You may join with him on Twitter (@irfaanshakeel) and LinkedIn.

Learn extra posts from Irfan Shakeel ›

[ad_2]