2013-04-12 20 views
2

考虑以下NASM代码:如何步调试没有符号或部分的组合二进制文件?

BITS 32 

       org  0x08048000 

    ehdr:             ; Elf32_Ehdr 
       db  0x7F, "ELF", 1, 1, 1, 0   ; e_ident 
     times 8 db  0 
       dw  2        ; e_type 
       dw  3        ; e_machine 
       dd  1        ; e_version 
       dd  _start       ; e_entry 
       dd  phdr - $$      ; e_phoff 
       dd  0        ; e_shoff 
       dd  0        ; e_flags 
       dw  ehdrsize      ; e_ehsize 
       dw  phdrsize      ; e_phentsize 
       dw  1        ; e_phnum 
       dw  0        ; e_shentsize 
       dw  0        ; e_shnum 
       dw  0        ; e_shstrndx 

    ehdrsize  equ  $ - ehdr 

    phdr:             ; Elf32_Phdr 
       dd  1        ; p_type 
       dd  0        ; p_offset 
       dd  $$        ; p_vaddr 
       dd  $$        ; p_paddr 
       dd  filesize      ; p_filesz 
       dd  filesize      ; p_memsz 
       dd  5        ; p_flags 
       dd  0x1000       ; p_align 

    phdrsize  equ  $ - phdr 

    _start: 

       xor  eax, eax ;now just return to system with ebx 
       inc  eax 
       int  0x80 


    ; your program here 

    filesize  equ  $ - $$ 

如何调试的结构是这样的程序?最优选的是,我正在寻找一种GDB解决方案,它可以让我逐步运行汇编指令,允许每一步预览寄存器。这时候,我想设置一个基于内存的断点有发生的情况:

[localhost.localdomain][/tmp] $ gdb ./a.out 
GNU gdb (GDB) Fedora (7.5.1-37.fc18) 
Copyright (C) 2012 Free Software Foundation, Inc. 
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> 
This is free software: you are free to change and redistribute it. 
There is NO WARRANTY, to the extent permitted by law. Type "show copying" 
and "show warranty" for details. 
This GDB was configured as "x86_64-redhat-linux-gnu". 
For bug reporting instructions, please see: 
<http://www.gnu.org/software/gdb/bugs/>... 
Reading symbols from /tmp/a.out...(no debugging symbols found)...done. 
(gdb) break 0x08048054 
No symbol table is loaded. Use the "file" command. 
Make breakpoint pending on future shared library load? (y or [n]) n 
(gdb) list breakpoints 
No symbol table is loaded. Use the "file" command. 

回答

3

的命令在特定地址设置断点应该是你的榜样break *0x08048054。对于通过二进制单步执行,您可以使用stepi(步指令)命令。

+1

而你得到一个寄存器转储'info registers'。 – zwol

相关问题