[关闭]
@oro-oro 2015-08-18T11:17:20.000000Z 字数 5399 阅读 2187

五、GDB 基础

AndroidARM

  1. $ adb shell
  2. # cd /data/local/tmp
  3. # ./hello
  4. ./hello
  5. Hello ARM World!

下面开始调试 hello，尝试反汇编、断点、查看寄存器等操作。

  1. # ./gdb -q hello
  2. ./gdb -q hello
  3. Reading symbols from /data/local/tmp/hello...(no debugging symbols found)...done.

gdb disassemble/disas [function-name]

反汇编一下main函数的内容。

  1. (gdb) disas main
  2. disas main
  3. Dump of assembler code for function main:
  4.    0x00008258 <+0>:     push    {r11, lr}
  5.    0x0000825c <+4>:     add     r11, sp, #4
  6.    0x00008260 <+8>:     sub     sp, sp, #32
  7.    0x00008264 <+12>:    str     r0, [r11, #-32]
  8.    0x00008268 <+16>:    str     r1, [r11, #-36] ; 0x24
  9.    0x0000826c <+20>:    ldr     r3, [pc, #52]   ; 0x82a8 <main+80>
  10.    0x00008270 <+24>:    add     r3, pc, r3
  11.    0x00008274 <+28>:    sub     r12, r11, #24
  12.    0x00008278 <+32>:    mov     lr, r3
  13.    0x0000827c <+36>:    ldm     lr!, {r0, r1, r2, r3}
  14.    0x00008280 <+40>:    stmia   r12!, {r0, r1, r2, r3}
  15.    0x00008284 <+44>:    ldr     r3, [lr]
  16.    0x00008288 <+48>:    strb    r3, [r12]
  17.    0x0000828c <+52>:    sub     r3, r11, #24
  18.    0x00008290 <+56>:    mov     r0, r3
  19.    0x00008294 <+60>:    bl      0x8234
  20.    0x00008298 <+64>:    mov     r3, #0
  21.    0x0000829c <+68>:    mov     r0, r3
  22.    0x000082a0 <+72>:    sub     sp, r11, #4
  23.    0x000082a4 <+76>:    pop     {r11, pc}
  24.    0x000082a8 <+80>:    andeq   r0, r0, r4, ror #1
  25. End of assembler dump.

第9行就是main函数的入口，适合第一个断点。
第19行就是函数调用，这里下断点，查看寄存器的值，应该会看到要打印的字符串的。

break/b address/line_number

下断点

  1. (gdb) b *0x0000826c
  2. b *0x0000826c
  3. Breakpoint 1 at 0x826c
  4. (gdb) b *0x00008290 @这里下到18行
  5. b *0x00008290
  6. Breakpoint 2 at 0x8290

info/i

查看信息，可以查看断点信息、寄存器信息等。

i b查看断点

  1. (gdb) i b
  2. i b
  3. Num     Type           Disp Enb Address    What
  4. 1       breakpoint     keep y   0x0000826c <main+20>
  5. 2       breakpoint     keep y   0x00008290 <main+56>

delete/d num

删除断点

  1. (gdb) b *0x000082a8
  2. b *0x000082a8
  3. Breakpoint 3 at 0x82a8
  4. (gdb) i b
  5. i b
  6. Num     Type           Disp Enb Address    What
  7. 1       breakpoint     keep y   0x0000826c <main+20>
  8. 2       breakpoint     keep y   0x00008290 <main+56>
  9. 3       breakpoint     keep y   0x000082a8 <main+80>
  10. (gdb) d 3
  11. d 3
  12. (gdb) i b
  13. i b
  14. Num     Type           Disp Enb Address    What
  15. 1       breakpoint     keep y   0x0000826c <main+20>
  16. 2       breakpoint     keep y   0x00008290 <main+56>

run/r

让程序跑起来

  1. (gdb) r
  2. r
  3. Starting program: /data/local/tmp/hello
  4. BFD: /system/bin/linker: warning: sh_link not set for section `.ARM.exidx'
  5. BFD: /system/bin/linker: warning: sh_link not set for section `.ARM.exidx'
  6. warning: Unable to find dynamic linker breakpoint function.
  7. GDB will be unable to debug shared library initializers
  8. and track explicitly loaded dynamic code.
  10. Breakpoint 1, 0x0000826c in main ()
  11. (gdb) n
  12. n
  13. Single stepping until exit from function main,
  14. which has no line number information.
  16. Breakpoint 2, 0x00008290 in main ()
  1. (gdb) i r
  2. i r
  3. r0             0x6c6c6548       1819043144
  4. r1             0x5241206f       1379999855
  5. r2             0x6f57204d       1867980877
  6. r3             0xbeed3c4c       -1091748788 @ r3 的值会赋给r0，此时还没有赋值
  7. r4             0x8258   33368
  8. r5             0x1      1
  9. r6             0xafd41504       -1345055484
  10. r7             0xbeed3cac       -1091748692
  11. r8             0x0      0
  12. r9             0x0      0
  13. r10            0x0      0
  14. r11            0xbeed3c64       -1091748764
  15. r12            0xbeed3c5c       -1091748772
  16. sp             0xbeed3c40       0xbeed3c40
  17. lr             0x836c   33644
  18. pc             0x8290   0x8290 <main+56>
  19. cpsr           0x10     16
  20. (gdb) x 0xbeed3c4c
  21. x 0xbeed3c4c
  22. 0xbeed3c4c:      "Hello ARM World!"

继续给19行下断点，再查看r0的值。

  1. (gdb) disas main
  2. disas main
  3. Dump of assembler code for function main:
  4.    0x00008258 <+0>:     push    {r11, lr}
  5.    0x0000825c <+4>:     add     r11, sp, #4
  6.    0x00008260 <+8>:     sub     sp, sp, #32
  7.    0x00008264 <+12>:    str     r0, [r11, #-32]
  8.    0x00008268 <+16>:    str     r1, [r11, #-36] ; 0x24
  9.    0x0000826c <+20>:    ldr     r3, [pc, #52]   ; 0x82a8 <main+80>
  10.    0x00008270 <+24>:    add     r3, pc, r3
  11.    0x00008274 <+28>:    sub     r12, r11, #24
  12.    0x00008278 <+32>:    mov     lr, r3
  13.    0x0000827c <+36>:    ldm     lr!, {r0, r1, r2, r3}
  14.    0x00008280 <+40>:    stmia   r12!, {r0, r1, r2, r3}
  15.    0x00008284 <+44>:    ldr     r3, [lr]
  16.    0x00008288 <+48>:    strb    r3, [r12]
  17.    0x0000828c <+52>:    sub     r3, r11, #24
  18. => 0x00008290 <+56>:    mov     r0, r3
  19.    0x00008294 <+60>:    bl      0x8234
  20.    0x00008298 <+64>:    mov     r3, #0
  21.    0x0000829c <+68>:    mov     r0, r3
  22.    0x000082a0 <+72>:    sub     sp, r11, #4
  23.    0x000082a4 <+76>:    pop     {r11, pc}
  24.    0x000082a8 <+80>:    andeq   r0, r0, r4, ror #1
  25. End of assembler dump.
  26. (gdb) b *0x00008294
  27. b *0x00008294
  28. Breakpoint 4 at 0x8294
  29. (gdb) n
  30. n
  31. Single stepping until exit from function main,
  32. which has no line number information.
  34. Breakpoint 4, 0x00008294 in main ()
  35. (gdb) i r
  36. i r
  37. r0             0xbeed3c4c       -1091748788 @ r0 就是 puts 函数的参数
  38. r1             0x5241206f       1379999855
  39. r2             0x6f57204d       1867980877
  40. r3             0xbeed3c4c       -1091748788
  41. r4             0x8258   33368
  42. r5             0x1      1
  43. r6             0xafd41504       -1345055484
  44. r7             0xbeed3cac       -1091748692
  45. r8             0x0      0
  46. r9             0x0      0
  47. r10            0x0      0
  48. r11            0xbeed3c64       -1091748764
  49. r12            0xbeed3c5c       -1091748772
  50. sp             0xbeed3c40       0xbeed3c40
  51. lr             0x836c   33644
  52. pc             0x8294   0x8294 <main+60>
  53. cpsr           0x10     16
  54. (gdb) x 0xbeed3c4c
  55. x 0xbeed3c4c
  56. 0xbeed3c4c:      "Hello ARM World!"

where/whe

查看当然程序运行所在的位置

  1. (gdb) whe
  2. whe
  3. #0  0x00008294 in main ()
  4. (gdb)

commands

调试的时候，自动执行某些命令。
譬如，让断点2触发时，自动显示寄存器信息。（第6-16行）

  1. (gdb)  i b
  2.  i b
  3. Num     Type           Disp Enb Address    What
  4. 1       breakpoint     keep y   0x0000826c <main+20>
  5.         breakpoint already hit 1 time
  6. 2       breakpoint     keep y   0x00008290 <main+56>
  7.         breakpoint already hit 1 time
  8. 4       breakpoint     keep y   0x00008294 <main+60>
  9. (gdb) commands 2            // -------------------------- 开始 -------------------------
  10. commands 2
  11. Type commands for breakpoint(s) 2, one per line.
  12. End with a line saying just "end".
  13. >i r
  14. i r
  15. >end                        // -------------------------- 结束 --------------------------
  16. end
  17. (gdb) n
  18. n
  19. Single stepping until exit from function main,
  20. which has no line number information.
  22. Breakpoint 4, 0x00008294 in main ()
  23. (gdb) n
  24. n
  25. Single stepping until exit from function main,
  26. which has no line number information.
  27. Hello ARM World!
  28. 0xafd14dba in __libc_init () from /system/lib/libc.so
  29. (gdb) r
  30. r
  31. The program being debugged has been started already.
  32. Start it from the beginning? (y or n) y
  33. y
  34. Starting program: /data/local/tmp/hello
  35. BFD: /system/bin/linker: warning: sh_link not set for section `.ARM.exidx'
  36. BFD: /system/bin/linker: warning: sh_link not set for section `.ARM.exidx'
  37. warning: Unable to find dynamic linker breakpoint function.
  38. GDB will be unable to debug shared library initializers
  39. and track explicitly loaded dynamic code.
  41. Breakpoint 1, 0x0000826c in main ()
  42. (gdb) n
  43. n
  44. Single stepping until exit from function main,
  45. which has no line number information.
  47. Breakpoint 2, 0x00008290 in main ()
  48. r0             0x6c6c6548       1819043144
  49. r1             0x5241206f       1379999855
  50. r2             0x6f57204d       1867980877
  51. r3             0xbefbcc4c       -1090794420
  52. r4             0x8258   33368
  53. r5             0x1      1
  54. r6             0xafd41504       -1345055484
  55. r7             0xbefbccac       -1090794324
  56. r8             0x0      0
  57. r9             0x0      0
  58. r10            0x0      0
  59. r11            0xbefbcc64       -1090794396
  60. r12            0xbefbcc5c       -1090794404
  61. sp             0xbefbcc40       0xbefbcc40
  62. lr             0x836c   33644
  63. pc             0x8290   0x8290 <main+56>
  64. cpsr           0x10     16
  65. (gdb)

continue/c

继续运行，跟next/n 效果差不多。

  1. (gdb) c
  2. c
  3. Continuing.
  5. Breakpoint 4, 0x00008294 in main ()
  6. (gdb) c
  7. c
  8. Continuing.
  9. Hello ARM World!
  11. Program exited normally.
  12. (gdb)
添加新批注
在作者公开此批注前，只有你和作者可见。
回复批注