GDB 사용법 정리 *(현대오토에버 과제)
2020. 7. 26. 18:19ㆍSystem
GDB : GNU에서 나온 디버거 프로그램
OLLYDBG나 IDA같이 프로그램을 디버깅할 수 있는 리눅스에서 쓰는 디버거 프로그램
실행 방법 : gdb "파일명"
tip : gdb 를 실행할때 -q 옵션을 주면 부가적인 메시지가 뜨지 않는다.
이걸 alias로 등록해 놓으면 더 좋겠으니 #echo "alias gdb=\"gdb -q\"" >> ~/.bashrc
위와같이 명령어를 입력해 놓으면 좋을 것 같다.
gdb 도 라우터를 만지는것과 비슷하게 명령어를 다 치지 않아도 어느정도 치면 알아듣는다.
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
|
disassemble $target : target을 디스어셈블한다.
ex) disas main ; 메인함수 디스어셈블
break [함수 or 메모리 주소] : 브레이크포인트 설정
ex1) b *0x00000000004005bd
ex2) b main
delete [num]: 브레이크 포인트 삭제
ex) delete 1 ; 첫번째로 설정한 브레이크 포인트 삭제
run "args" 처음부터 실행 ( args는 인자값 )
ex) r AAA
continue 멈춘부분부터 다음 브레이크포인트 까지
ex) c
ni : 한스텝 실행 후 멈추기
ex) n
info reg 레지스터들 확인
info reg "레지스터" 특정 레지스터 확인
info break 브레이크 포인트 확인
x/t "메모리 주소" 2진수로 확인하기
x/o "메모리 주소" 8진수로 확인하기
x/d "메모리 주소" 10진수로 확인하기
x/u "메모리 주소" 부호없는 10진수로 확인하기
x/x "메모리 주소" 16진수로 확인하기
x/c "메모리 주소" char로 확인하기
x/f "메모리 주소" 부동소수점으로 확인하기
x/s "메모리 주소" 스트링으로 확인하기
x/bx $rsp 1바이트씩 확인하기
x/hx $rsp 2바이트씩 확인하기
x/dx $rsp 4바이트씩 확인하기
x/gx $rsp 8바이트씩 확인하기
-- 실행중인 프로그램 attach하기--
gdb "filename" "pid"
gdb" attach
gdb" detach
|
cs |
문제풀이 license_1
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
|
kali@st37:~/Downloads$ ls
41570.py 41614.rb license_1 struts2-showcase.war
kali@st37:~/Downloads$ gdb -q license_1
Reading symbols from license_1...
(No debugging symbols found in license_1)
(gdb) set disassembly-flavor intel
(gdb) disas main
Dump of assembler code for function main:
0x00000000004005bd <+0>: push rbp
0x00000000004005be <+1>: mov rbp,rsp
0x00000000004005c1 <+4>: sub rsp,0x10
0x00000000004005c5 <+8>: mov DWORD PTR [rbp-0x4],edi
0x00000000004005c8 <+11>: mov QWORD PTR [rbp-0x10],rsi
0x00000000004005cc <+15>: cmp DWORD PTR [rbp-0x4],0x2
0x00000000004005d0 <+19>: jne 0x400623 <main+102>
0x00000000004005d2 <+21>: mov rax,QWORD PTR [rbp-0x10]
0x00000000004005d6 <+25>: add rax,0x8
0x00000000004005da <+29>: mov rax,QWORD PTR [rax]
0x00000000004005dd <+32>: mov rsi,rax
0x00000000004005e0 <+35>: mov edi,0x4006c4
0x00000000004005e5 <+40>: mov eax,0x0
0x00000000004005ea <+45>: call 0x400490 <printf@plt>
0x00000000004005ef <+50>: mov rax,QWORD PTR [rbp-0x10]
0x00000000004005f3 <+54>: add rax,0x8
0x00000000004005f7 <+58>: mov rax,QWORD PTR [rax]
0x00000000004005fa <+61>: mov esi,0x4006da
0x00000000004005ff <+66>: mov rdi,rax
0x0000000000400602 <+69>: call 0x4004b0 <strcmp@plt>
0x0000000000400607 <+74>: test eax,eax
0x0000000000400609 <+76>: jne 0x400617 <main+90>
0x000000000040060b <+78>: mov edi,0x4006ea
0x0000000000400610 <+83>: call 0x400480 <puts@plt>
0x0000000000400615 <+88>: jmp 0x40062d <main+112>
0x0000000000400617 <+90>: mov edi,0x4006fa
0x000000000040061c <+95>: call 0x400480 <puts@plt>
0x0000000000400621 <+100>: jmp 0x40062d <main+112>
0x0000000000400623 <+102>: mov edi,0x400701
0x0000000000400628 <+107>: call 0x400480 <puts@plt>
0x000000000040062d <+112>: mov eax,0x0
0x0000000000400632 <+117>: leave
0x0000000000400633 <+118>: ret
--Type <RET> for more, q to quit, c to continue without paging--
End of assembler dump.
(gdb) b main
Breakpoint 1 at 0x4005c1
(gdb) r bbbb
Starting program: /home/kali/Downloads/license_1 bbbb
Breakpoint 1, 0x00000000004005c1 in main ()
(gdb) ni
0x00000000004005c5 in main ()
(gdb)
0x00000000004005c8 in main ()
(gdb)
0x00000000004005cc in main ()
(gdb)
0x00000000004005d0 in main ()
(gdb)
0x00000000004005d2 in main ()
(gdb)
0x00000000004005d6 in main ()
(gdb)
0x00000000004005da in main ()
(gdb)
0x00000000004005dd in main ()
(gdb)
0x00000000004005e0 in main ()
(gdb)
0x00000000004005e5 in main ()
(gdb)
0x00000000004005ea in main ()
(gdb)
Checking License: bbbb
0x00000000004005ef in main ()
(gdb)
0x00000000004005f3 in main ()
(gdb)
0x00000000004005f7 in main ()
(gdb)
0x00000000004005fa in main ()
(gdb)
0x00000000004005ff in main ()
(gdb)
0x0000000000400602 in main ()
(gdb)
0x0000000000400607 in main ()
(gdb) disas main
Dump of assembler code for function main:
0x00000000004005bd <+0>: push rbp
0x00000000004005be <+1>: mov rbp,rsp
0x00000000004005c1 <+4>: sub rsp,0x10
0x00000000004005c5 <+8>: mov DWORD PTR [rbp-0x4],edi
0x00000000004005c8 <+11>: mov QWORD PTR [rbp-0x10],rsi
0x00000000004005cc <+15>: cmp DWORD PTR [rbp-0x4],0x2
0x00000000004005d0 <+19>: jne 0x400623 <main+102>
0x00000000004005d2 <+21>: mov rax,QWORD PTR [rbp-0x10]
0x00000000004005d6 <+25>: add rax,0x8
0x00000000004005da <+29>: mov rax,QWORD PTR [rax]
0x00000000004005dd <+32>: mov rsi,rax
0x00000000004005e0 <+35>: mov edi,0x4006c4
0x00000000004005e5 <+40>: mov eax,0x0
0x00000000004005ea <+45>: call 0x400490 <printf@plt>
0x00000000004005ef <+50>: mov rax,QWORD PTR [rbp-0x10]
0x00000000004005f3 <+54>: add rax,0x8
0x00000000004005f7 <+58>: mov rax,QWORD PTR [rax]
0x00000000004005fa <+61>: mov esi,0x4006da
0x00000000004005ff <+66>: mov rdi,rax
0x0000000000400602 <+69>: call 0x4004b0 <strcmp@plt>
=> 0x0000000000400607 <+74>: test eax,eax
0x0000000000400609 <+76>: jne 0x400617 <main+90>
0x000000000040060b <+78>: mov edi,0x4006ea
0x0000000000400610 <+83>: call 0x400480 <puts@plt>
0x0000000000400615 <+88>: jmp 0x40062d <main+112>
0x0000000000400617 <+90>: mov edi,0x4006fa
0x000000000040061c <+95>: call 0x400480 <puts@plt>
0x0000000000400621 <+100>: jmp 0x40062d <main+112>
0x0000000000400623 <+102>: mov edi,0x400701
0x0000000000400628 <+107>: call 0x400480 <puts@plt>
0x000000000040062d <+112>: mov eax,0x0
0x0000000000400632 <+117>: leave
0x0000000000400633 <+118>: ret
--Type <RET> for more, q to quit, c to continue without paging--
End of assembler dump.
(gdb) x/4x $rdi
0x7fffffffe553: 0x62626262 0x45485300 0x2f3d4c4c 0x2f6e6962
(gdb) x/s $rdi
0x7fffffffe553: "bbbb"
(gdb) x/4x $esi
0x4006da: 0x41 0x41 0x41 0x41
(gdb) x/s $esi
0x4006da: "AAAA-Z10N-42-OK"
(gdb) q
A debugging session is active.
Inferior 1 [process 55251] will be killed.
Quit anyway? (y or n) y
kali@st37:~/Downloads$ ./license_1 AAAA-Z10N-42-OK
Checking License: AAAA-Z10N-42-OK
Access Granted!
kali@st37:~/Downloads$
|
cs |
위처럼 $esi 에 저장되어있는값을 string으로 뽑아봤더니 하드코딩된 비밀번호가 나오게 되었다.
end
'System' 카테고리의 다른 글
| SuNiNaTaS 16번 (0) | 2020.05.01 |
|---|