[关闭]
@oro-oro 2015-08-18T11:17:20.000000Z 字数 5399 阅读 2170

五、GDB 基础

AndroidARM


  1. $ adb shell
  2. # cd /data/local/tmp
  3. # ./hello
  4. ./hello
  5. Hello ARM World!

下面开始调试 hello,尝试反汇编、断点、查看寄存器等操作。

  1. # ./gdb -q hello
  2. ./gdb -q hello
  3. Reading symbols from /data/local/tmp/hello...(no debugging symbols found)...done.

gdb disassemble/disas [function-name]

反汇编一下main函数的内容。

  1. (gdb) disas main
  2. disas main
  3. Dump of assembler code for function main:
  4. 0x00008258 <+0>: push {r11, lr}
  5. 0x0000825c <+4>: add r11, sp, #4
  6. 0x00008260 <+8>: sub sp, sp, #32
  7. 0x00008264 <+12>: str r0, [r11, #-32]
  8. 0x00008268 <+16>: str r1, [r11, #-36] ; 0x24
  9. 0x0000826c <+20>: ldr r3, [pc, #52] ; 0x82a8 <main+80>
  10. 0x00008270 <+24>: add r3, pc, r3
  11. 0x00008274 <+28>: sub r12, r11, #24
  12. 0x00008278 <+32>: mov lr, r3
  13. 0x0000827c <+36>: ldm lr!, {r0, r1, r2, r3}
  14. 0x00008280 <+40>: stmia r12!, {r0, r1, r2, r3}
  15. 0x00008284 <+44>: ldr r3, [lr]
  16. 0x00008288 <+48>: strb r3, [r12]
  17. 0x0000828c <+52>: sub r3, r11, #24
  18. 0x00008290 <+56>: mov r0, r3
  19. 0x00008294 <+60>: bl 0x8234
  20. 0x00008298 <+64>: mov r3, #0
  21. 0x0000829c <+68>: mov r0, r3
  22. 0x000082a0 <+72>: sub sp, r11, #4
  23. 0x000082a4 <+76>: pop {r11, pc}
  24. 0x000082a8 <+80>: andeq r0, r0, r4, ror #1
  25. End of assembler dump.

第9行就是main函数的入口,适合第一个断点。
第19行就是函数调用,这里下断点,查看寄存器的值,应该会看到要打印的字符串的。

break/b address/line_number

下断点

  1. (gdb) b *0x0000826c
  2. b *0x0000826c
  3. Breakpoint 1 at 0x826c
  4. (gdb) b *0x00008290 @这里下到18
  5. b *0x00008290
  6. Breakpoint 2 at 0x8290

info/i

查看信息,可以查看断点信息、寄存器信息等。

i b查看断点

  1. (gdb) i b
  2. i b
  3. Num Type Disp Enb Address What
  4. 1 breakpoint keep y 0x0000826c <main+20>
  5. 2 breakpoint keep y 0x00008290 <main+56>

delete/d num

删除断点

  1. (gdb) b *0x000082a8
  2. b *0x000082a8
  3. Breakpoint 3 at 0x82a8
  4. (gdb) i b
  5. i b
  6. Num Type Disp Enb Address What
  7. 1 breakpoint keep y 0x0000826c <main+20>
  8. 2 breakpoint keep y 0x00008290 <main+56>
  9. 3 breakpoint keep y 0x000082a8 <main+80>
  10. (gdb) d 3
  11. d 3
  12. (gdb) i b
  13. i b
  14. Num Type Disp Enb Address What
  15. 1 breakpoint keep y 0x0000826c <main+20>
  16. 2 breakpoint keep y 0x00008290 <main+56>

run/r

让程序跑起来

  1. (gdb) r
  2. r
  3. Starting program: /data/local/tmp/hello
  4. BFD: /system/bin/linker: warning: sh_link not set for section `.ARM.exidx'
  5. BFD: /system/bin/linker: warning: sh_link not set for section `.ARM.exidx'
  6. warning: Unable to find dynamic linker breakpoint function.
  7. GDB will be unable to debug shared library initializers
  8. and track explicitly loaded dynamic code.
  9. Breakpoint 1, 0x0000826c in main ()
  10. (gdb) n
  11. n
  12. Single stepping until exit from function main,
  13. which has no line number information.
  14. Breakpoint 2, 0x00008290 in main ()
  1. (gdb) i r
  2. i r
  3. r0 0x6c6c6548 1819043144
  4. r1 0x5241206f 1379999855
  5. r2 0x6f57204d 1867980877
  6. r3 0xbeed3c4c -1091748788 @ r3 的值会赋给r0,此时还没有赋值
  7. r4 0x8258 33368
  8. r5 0x1 1
  9. r6 0xafd41504 -1345055484
  10. r7 0xbeed3cac -1091748692
  11. r8 0x0 0
  12. r9 0x0 0
  13. r10 0x0 0
  14. r11 0xbeed3c64 -1091748764
  15. r12 0xbeed3c5c -1091748772
  16. sp 0xbeed3c40 0xbeed3c40
  17. lr 0x836c 33644
  18. pc 0x8290 0x8290 <main+56>
  19. cpsr 0x10 16
  20. (gdb) x 0xbeed3c4c
  21. x 0xbeed3c4c
  22. 0xbeed3c4c: "Hello ARM World!"

继续给19行下断点,再查看r0的值。

  1. (gdb) disas main
  2. disas main
  3. Dump of assembler code for function main:
  4. 0x00008258 <+0>: push {r11, lr}
  5. 0x0000825c <+4>: add r11, sp, #4
  6. 0x00008260 <+8>: sub sp, sp, #32
  7. 0x00008264 <+12>: str r0, [r11, #-32]
  8. 0x00008268 <+16>: str r1, [r11, #-36] ; 0x24
  9. 0x0000826c <+20>: ldr r3, [pc, #52] ; 0x82a8 <main+80>
  10. 0x00008270 <+24>: add r3, pc, r3
  11. 0x00008274 <+28>: sub r12, r11, #24
  12. 0x00008278 <+32>: mov lr, r3
  13. 0x0000827c <+36>: ldm lr!, {r0, r1, r2, r3}
  14. 0x00008280 <+40>: stmia r12!, {r0, r1, r2, r3}
  15. 0x00008284 <+44>: ldr r3, [lr]
  16. 0x00008288 <+48>: strb r3, [r12]
  17. 0x0000828c <+52>: sub r3, r11, #24
  18. => 0x00008290 <+56>: mov r0, r3
  19. 0x00008294 <+60>: bl 0x8234
  20. 0x00008298 <+64>: mov r3, #0
  21. 0x0000829c <+68>: mov r0, r3
  22. 0x000082a0 <+72>: sub sp, r11, #4
  23. 0x000082a4 <+76>: pop {r11, pc}
  24. 0x000082a8 <+80>: andeq r0, r0, r4, ror #1
  25. End of assembler dump.
  26. (gdb) b *0x00008294
  27. b *0x00008294
  28. Breakpoint 4 at 0x8294
  29. (gdb) n
  30. n
  31. Single stepping until exit from function main,
  32. which has no line number information.
  33. Breakpoint 4, 0x00008294 in main ()
  34. (gdb) i r
  35. i r
  36. r0 0xbeed3c4c -1091748788 @ r0 就是 puts 函数的参数
  37. r1 0x5241206f 1379999855
  38. r2 0x6f57204d 1867980877
  39. r3 0xbeed3c4c -1091748788
  40. r4 0x8258 33368
  41. r5 0x1 1
  42. r6 0xafd41504 -1345055484
  43. r7 0xbeed3cac -1091748692
  44. r8 0x0 0
  45. r9 0x0 0
  46. r10 0x0 0
  47. r11 0xbeed3c64 -1091748764
  48. r12 0xbeed3c5c -1091748772
  49. sp 0xbeed3c40 0xbeed3c40
  50. lr 0x836c 33644
  51. pc 0x8294 0x8294 <main+60>
  52. cpsr 0x10 16
  53. (gdb) x 0xbeed3c4c
  54. x 0xbeed3c4c
  55. 0xbeed3c4c: "Hello ARM World!"

where/whe

查看当然程序运行所在的位置

  1. (gdb) whe
  2. whe
  3. #0 0x00008294 in main ()
  4. (gdb)

commands

调试的时候,自动执行某些命令。
譬如,让断点2触发时,自动显示寄存器信息。(第6-16行)

  1. (gdb) i b
  2. i b
  3. Num Type Disp Enb Address What
  4. 1 breakpoint keep y 0x0000826c <main+20>
  5. breakpoint already hit 1 time
  6. 2 breakpoint keep y 0x00008290 <main+56>
  7. breakpoint already hit 1 time
  8. 4 breakpoint keep y 0x00008294 <main+60>
  9. (gdb) commands 2 // -------------------------- 开始 -------------------------
  10. commands 2
  11. Type commands for breakpoint(s) 2, one per line.
  12. End with a line saying just "end".
  13. >i r
  14. i r
  15. >end // -------------------------- 结束 --------------------------
  16. end
  17. (gdb) n
  18. n
  19. Single stepping until exit from function main,
  20. which has no line number information.
  21. Breakpoint 4, 0x00008294 in main ()
  22. (gdb) n
  23. n
  24. Single stepping until exit from function main,
  25. which has no line number information.
  26. Hello ARM World!
  27. 0xafd14dba in __libc_init () from /system/lib/libc.so
  28. (gdb) r
  29. r
  30. The program being debugged has been started already.
  31. Start it from the beginning? (y or n) y
  32. y
  33. Starting program: /data/local/tmp/hello
  34. BFD: /system/bin/linker: warning: sh_link not set for section `.ARM.exidx'
  35. BFD: /system/bin/linker: warning: sh_link not set for section `.ARM.exidx'
  36. warning: Unable to find dynamic linker breakpoint function.
  37. GDB will be unable to debug shared library initializers
  38. and track explicitly loaded dynamic code.
  39. Breakpoint 1, 0x0000826c in main ()
  40. (gdb) n
  41. n
  42. Single stepping until exit from function main,
  43. which has no line number information.
  44. Breakpoint 2, 0x00008290 in main ()
  45. r0 0x6c6c6548 1819043144
  46. r1 0x5241206f 1379999855
  47. r2 0x6f57204d 1867980877
  48. r3 0xbefbcc4c -1090794420
  49. r4 0x8258 33368
  50. r5 0x1 1
  51. r6 0xafd41504 -1345055484
  52. r7 0xbefbccac -1090794324
  53. r8 0x0 0
  54. r9 0x0 0
  55. r10 0x0 0
  56. r11 0xbefbcc64 -1090794396
  57. r12 0xbefbcc5c -1090794404
  58. sp 0xbefbcc40 0xbefbcc40
  59. lr 0x836c 33644
  60. pc 0x8290 0x8290 <main+56>
  61. cpsr 0x10 16
  62. (gdb)

continue/c

继续运行,跟next/n 效果差不多。

  1. (gdb) c
  2. c
  3. Continuing.
  4. Breakpoint 4, 0x00008294 in main ()
  5. (gdb) c
  6. c
  7. Continuing.
  8. Hello ARM World!
  9. Program exited normally.
  10. (gdb)
添加新批注
在作者公开此批注前,只有你和作者可见。
回复批注