GDB 速查表及原理简介

gdb
gdb <file>

quit 					Exit gdb
run 					Run program
run 1 2 3 				Run program with command-line arguments 1 2 3
kill 					Stop the program
quit 					Exit gdb
Ctrl-d 					Exit gdb

break sum 				Set breakpoint at the entry to function sum
break *0x80483c3 		Set breakpoint at address 0x80483c3
delete 1 				Delete breakpoint 1
disable 1 				Disable the breakpoint 1
							(gdb numbers each breakpoint you create)
enable 1 				Enable breakpoint 1
delete 					Delete all breakpoints
clear sum 				Clear any breakpoints at the entry to function sum

stepi 					Execute one instruction
stepi 4 				Execute four instructions
nexti 					Like stepi, but proceed through function calls without stopping
step 					Execute one C statement
continue 				Resume execution until the next breakpoint
until 3 				Continue executing until program hits breakpoint 3
finish 					Resume execution until current function returns
call sum(1, 2) 			Call sum(1,2) and print return value

disas 					Disassemble current function
disas sum 				Disassemble function sum
disas 0x80483b7 		Disassemble function around 0x80483b7
disas 0x80483b7 0x80483c7 	Disassemble code within specified address range
print /x $rip 			Print program counter in hex
print /d $rip 			Print program counter in decimal
print /t $rip 			Print program counter in binary

print /d $rax 				Print contents of %rax in decimal
print /x $rax 				Print contents of %rax in hex
print /t $rax 				Print contents of %rax in binary
print /d (int)$rax 			Print contents of %rax in decimal after sign-extending lower 32-bits. You need this to print 32-bit, negative numbers stored in the lower 32 bits of %rax. For example, if the lower 32-bits of %rax store 0xffffffff, you will see 
						 (gdb) print $rax
						 $1 = 4294967295
						 (gdb) print (int)$rax
						 $2 = -1

print /d 0x100 				Print decimal representation of 0x100
print /x 555 				Print hex representation of 555
print /x ($rsp+8) 			Print (contents of %rsp) + 8 in hex
print *(int *) 0xbffff890 	Print integer at address 0xbffff890
print *(int *) ($rsp+8) 	Print integer at address %rsp + 8
print (char *) 0xbfff890 	Examine a string stored at 0xbffff890

x/w 0xbffff890 				Examine (4-byte) word starting at address 0xbffff890
x/w $rsp 					Examine (4-byte) word starting at address in $rsp
x/wd $rsp 					Examine (4-byte) word starting at address in $rsp. Print in decimal
x/2w $rsp 					Examine two (4-byte) words starting at address in $rsp
x/2wd $rsp 					Examine two (4-byte) words starting at address in $rsp. Print in decimal
x/g $rsp 					Examine (8-byte) word starting at address in $rsp.
x/gd $rsp 					Examine (8-byte) word starting at address in $rsp. Print in decimal
    						gef➤  x/g 0x6032d0
    						0x6032d0 <node1>:       4294967628
    						gef➤  x/2w 0x6032d0
							0x6032d0 <node1>:       332     1

x/a $rsp 					Examine address in $rsp. Print as offset from previous global symbol.
x/s 0xbffff890 				Examine a string stored at 0xbffff890
x/20b sum 					Examine first 20 opcode bytes of function sum
x/10i sum 					Examine first 10 instructions of function sum
 
Note: the format string for the ‘x’ command has the general form: 
x/[NUM][SIZE][FORMAT] where
 - NUM = number of objects to display
 - SIZE = size of each object (b=byte, h=half-word, w=word, g=giant (quad-word))
 - FORMAT = how to display each object (d=decimal, x=hex, o=octal, etc.)
If you don’t specify SIZE or FORMAT, either a default value, or the last value you specified in a previous ‘print’ or ‘x’ command is used. 

backtrace 					Print the current address and stack backtrace
where 						Print the current address and stack backtrace
info program 				Print current status of the program)
info functions 				Print functions in program
info stack 					Print backtrace of the stack)
info frame 					Print information about the current stack frame
info registers 				Print registers and their contents
info breakpoints 			Print status of user-settable breakpoints
display /FMT EXPR 			Print expression EXPR using format FMT every time GDB stops
undisplay 					Turn off display mode
help 						Get information about gdb

#include <sys/ptrace.h>
long ptrace(enum __ptrace_request request, pid_t pid, void *addr, void *data);

#include <sys/ptrace.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>

#define SHOW(call) ({ int _ret = (int)(call); printf("%s -> %d\n", #call, _ret); if (_ret < 0) { perror(NULL); }}) 
// 定义一个宏来显示系统调用的结果，并在调用失败时打印错误信息

char changeme[] = "This is  a test"; // 定义一个全局变量

int main (void) {
    pid_t pid = fork(); // 创建子进程
    int ret;
    int i;
    union {
        char cdata[8];
        int64_t data;
    } u = { "Hijacked" }; // 定义一个联合体，用于存储要写入子进程内存的字符串

    switch (pid) {
        case 0: /* child */
            sleep(2); // 让子进程先睡眠2秒，这样父进程就有时间修改内存
            printf("Children Message: %s\n", changeme); // 子进程打印修改后的消息
            exit(0);

        case -1:
            perror("fork"); // 创建子进程失败时打印错误信息并退出
            exit(1);
            break;

        default: /* parent */
            SHOW(ptrace(PTRACE_ATTACH, pid, 0, 0)); // 父进程通过 ptrace 附加到子进程
            SHOW(ptrace(PTRACE_POKEDATA, pid, changeme, u.data)); // 将新的字符串写入子进程的内存
            SHOW(ptrace(PTRACE_CONT, pid, 0, 0)); // 继续执行子进程
            printf("Parent Message: %s\n", changeme); // 父进程打印未被修改的消息
            wait(NULL); // 等待子进程退出
            break;
    }

    return 0;
}

(base) czy@czy-307-thinkcentre-m720q-n000:CSAPP/bomb $ ./changeme 
ptrace(PTRACE_ATTACH, pid, 0, 0) -> 0
ptrace(PTRACE_POKEDATA, pid, changeme, u.data) -> 0
ptrace(PTRACE_CONT, pid, 0, 0) -> 0
Parent Message: This is  a test
Children Message: Hijacked a test

// example
union {
    char cdata[8];
    int64_t data;
} u;

// 将所有字节先初始化为0
memset(u.cdata, 0, sizeof(u.cdata));

// 再拷贝"Hijack"字符串
strncpy(u.cdata, "Hijack", sizeof("Hijack"));