Thursday, August 7, 2008

"RE" On Linux :: Debugging stripped binaries with GDB

gdb$ info file
This will print the entry point of the file.

Symbols from "/home/babil/Desktop/Keygenme_v3/Keygenme_v3.p2".
Local exec file:
`/home/babil/Desktop/Keygenme_v3/Keygenme_v3.p2', file type elf32-i386.
Entry point: 0x8048610 0x08048114 - 0x08048127 is .interp
0x08048128 - 0x08048148 is .note.ABI-tag
0x08048148 - 0x080481dc is .hash
0x080481dc - 0x08048200 is .gnu.hash
0x08048200 - 0x08048320 is .dynsym
0x08048320 - 0x0804840e is .dynstr
0x0804840e - 0x08048432 is .gnu.version
0x08048434 - 0x08048464 is .gnu.version_r
0x08048464 - 0x08048474 is .rel.dyn
0x08048474 - 0x080484e4 is .rel.plt
0x080484e4 - 0x08048514 is .init
0x08048514 - 0x08048604 is .plt
0x08048610 - 0x08048c0c is .text
0x08048c0c - 0x08048c28 is .fini
0x08048c28 - 0x08048d76 is .rodata
0x08048d78 - 0x08048d7c is .eh_frame
0x08049000 - 0x08049008 is .ctors
0x08049008 - 0x08049010 is .dtors
0x08049010 - 0x08049014 is .jcr
0x08049014 - 0x080490fc is .dynamic
0x080490fc - 0x08049100 is .got
0x08049100 - 0x08049144 is .got.plt
0x08049160 - 0x080494e4 is .data
0x080494e4 - 0x080494f0 is .bss

Now set a temporary break on that address. (don't miss the star before 0x8048610)
gdb$ tbreak *0x8048610