owned this note changed 5 years ago
Published Linked with GitHub

AIdrifter CS 浮生筆錄 :
Debug Hacks
Ch2 : Debug前該知道的事

  • 介紹debuger(GDB), intel 架構, stack, function argument 運作方式。

Process Core Dump

Get Process core dump

  • 啟用linux core dump 機制
# unlimited
ulimit -c unlimited
# bytes size
ulimit -c 1234567
  • 故意寫 coredump file code
#include <stdio.h>
#include <stdlib.h>

int main()
{
    int *a = NULL;
    *a = 0x1;
    return 0;
}
  • 透過core dump file除錯
gcc -g main.c
gdb -c core ./a.out
  • gdb show information
[New LWP 20545]
Core was generated by `./a.out'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000055d3dff72670 in main () at main.c:12
12          *a = 0x1;

產生目錄專用的coredump file

# case 1
cat  /etc/sysctl.conf 
kernel.core_pattern = /tmp/cores/core.%e.%p.%h.%t
kernel.core_user_pid = 0

# case 2 : use pipe to compress core dump file
cat  /proc/sys/kernel/core_pattern
|/usr/share/apport/apport %p %s %c %d %P

## Absolute path 
mkdir /tmp/cores/
echo "/tmp/cores/core.%e.%p.%h.%t" > /proc/sys/kernel/core_pattern

## relative path
echo "core.%e.%p.%t" > /proc/sys/kernel/core_pattern

利用Core Dump Masking 跳過共享記憶體範圍

  • 在多process情境下 core dump檔案要如何進行設定為佳?
root@aidrifter-VM /p/4900# cat coredump_filter 
00000033

利用core dump file debug

gdb a.out
gdb) set solib-absolute-prefix symbols
gdb) core core.xxxxx
gdb) bt

How to use GDB (I)

加入 -g 參數去debug

  • Werror : 把warnning 視為錯誤
  • O2 : optimize
    • inline functino會被自動展開,symbol table不會記載該function
    • local變數被放到register內,gdb無法顯示該local變數的值
    • 作者不建議拿掉-O,因為不好mantain,最少要知道怎樣去最佳化的過程。
# gcc
gcc -Wall -O2 -g *.c

# makefile
CFLAGS =  -Wall -O2 -g 

# confiure 
./configure CFLAGS="-Wall -O2 -g"

b : Break Point

  • b 設定中斷點
# function
b main

# file and line number
b main.c:123

# file and function
b test.c:foo

r : run program

  • r run program

info : show information

# sholl all break points
info break
info b

# delete break point or watch point
delete 3

# show stack frame
info s

# show registers
info reg

bt : back trace

  • bt show backtrace
#  show 3 frame and their local variable 
bt full -3

p : printf

p argv
p *argv
p argv[0]

# hex
p/x local_var

# printf register eax
p $eax

# printf program counter <=> p $eip
p $pc

x : x/NFU ADDR

  • ADDR : address
  • N : 重複次數
  • F : 前面格式字元
# disassemble pc's command
x/i $pc
0x8048ebd <main+173>  cmp $0x6e,%eax

# disassemble pc's list 10 command
x/i $pc
0x8048ebd <main+173>  cmp $0x6e,%eax
0x8048ec0
0x8048ec6
0x8048ecc
0x8048ecf
...

disassem : 反組譯

# dissassemble $pc ~ $pc+50
disassem $pc $pc+50

n : next 逐步執行

c : continue到中斷點 or signal

wathc : watch point

watch
awatch
rwatch

set variable : change bariable

set variable options = 0
print options

產生core file

  • 為正在debug的process產生core file
# generate core dump file
generate-core-file

# Get core file without terminating process status
gcore `pidof emcas`

How to use GDB (II)

gdb attach $pid

sleep 1000

ps -aux | grep sleep

aidrifter@aidrifter-VM$ ps -aux | grep  sleep
aidrift+  30054  0.0  0.0   7580   720 pts/8    S+   09:33   0:00 sleep 1000
aidrift+  30131  0.0  0.0  14528   916 pts/9    S+   09:35   0:00 grep --color sleep

# attach process pid
sudo su

(gdb) attach 30054
Attaching to process 30054
Reading symbols from /bin/sleep...(no debugging symbols found)...done.
Reading symbols from /lib/x86_64-linux-gnu/libc.so.6...Reading symbols from /usr/lib/debug//lib/x86_64-linux-gnu/libc-2.24.so...done.
done.
Reading symbols from /lib64/ld-linux-x86-64.so.2...Reading symbols from /usr/lib/debug//lib/x86_64-linux-gnu/ld-2.24.so...done.
done.
0x00007f00c2a892d0 in __nanosleep_nocancel () at ../sysdeps/unix/syscall-template.S:84
84      ../sysdeps/unix/syscall-template.S: No such file or directory.
(gdb) bt
#0  0x00007f00c2a892d0 in __nanosleep_nocancel () at ../sysdeps/unix/syscall-template.S:84
#1  0x0000555f4a95190f in ?? ()
#2  0x0000555f4a9516f0 in ?? ()
#3  0x0000555f4a94e994 in ?? ()
#4  0x00007f00c29dc3f1 in __libc_start_main (main=0x555f4a94e780, argc=2, argv=0x7ffd175385f8,
    init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffd175385e8)
    at ../csu/libc-start.c:291
#5  0x0000555f4a94ea6a in ?? ()
Select a repo