===== gdb =====
* spusteni gdb
$gdb -q ./a.out
* nastaveni breakpointu na fci main
(gdb) break main
* spusteni programu :)
(gdb) run
* vypsani info o registrech (kdyz program stoji na breakpoint)
(gdb) info registers
* nastaveni assembleru na intel
(gdb) set dis intel
===== object dump =====
$objdump -D -M intel ./a.out
* parametry
* -D - dissassemble all
* -M - typ asembleru (default AT&T)
* syntax assembleru INTEL
4004e4: 55 push rbp
4004e5: 48 89 e5 mov rbp,rsp
4004e8: 48 83 ec 10 sub rsp,0x10
* syntax assembleru AT&T
4004e4: 55 push %rbp
4004e5: 48 89 e5 mov %rsp,%rbp
4004e8: 48 83 ec 10 sub $0x10,%rsp
===== registry =====
==== x86 ====
* EIP - instruction pointer
* EAX, ECX, EDX, EBX - univerzalni registry - Accumulator, Counter, Data, base
* ESP, EBP, ESI, EDI - dalsi univerzalni registry
* EFLAGS - bitove identifikatory
==== x86_64 ====
* stejne registry jako x86, ale misto prefixu e pouziva prefix r
* navic registry r8-r15
(gdb) info registers
rax 0x7ffff7dd9ee8 140737351884520
rbx 0x0 0
rcx 0x0 0
rdx 0x7fffffffe7a8 140737488349096
rsi 0x7fffffffe798 140737488349080
rdi 0x1 1
rbp 0x7fffffffe6b0 0x7fffffffe6b0
rsp 0x7fffffffe6b0 0x7fffffffe6b0
r8 0x7ffff7dd8320 140737351877408
r9 0x7ffff7deb040 140737351954496
r10 0x0 0
r11 0x7ffff7a78db0 140737348341168
r12 0x400400 4195328
r13 0x7fffffffe790 140737488349072
r14 0x0 0
r15 0x0 0
rip 0x4004e8 0x4004e8
eflags 0x246 [ PF ZF IF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
===== Co rika segfault =====
* tohle jsem nevedel :) je to velice zajimave :)
[1000950.117170] nfprofile[19184]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fffed2781c0 error 4 in nfprofile[400000+25000]
[1000950.120928] nfprofile[19185]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fff2d003080 error 4 in nfprofile[400000+25000]
[1000950.124587] nfprofile[19186]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fffedda2e90 error 4 in nfprofile[400000+25000]
[1005919.114319] nfprofile[32626]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fff8871a070 error 4 in nfprofile[400000+25000]
[1022741.303483] nfprofile[11309]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fff5baf7ec0 error 4 in nfprofile[400000+25000]
[1185433.766166] nfprofile[22225]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fff96a5eae0 error 4 in nfprofile[400000+25000]
[1185433.770096] nfprofile[22226]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fff3c799510 error 4 in nfprofile[400000+25000]
[1185433.773886] nfprofile[22227]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fffb9240610 error 4 in nfprofile[400000+25000]
[1186145.925757] nfprofile[24369]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fff0fa10cf0 error 4 in nfprofile[400000+25000]
[1191930.527903] nfprofile[9294]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fff59045820 error 4 in nfprofile[400000+25000]
objdump -NCl on the nfprofile binary tells me 402c67 in the compiled application is in process_data() at line 130
121: nffile = GetNextFile(NULL, 0, 0);
122: if ( !nffile ) {
123: LogError("GetNextFile() error in %s line %d: %s\n", __FILE__, __LINE__, strerror(errno) );
124: return;
125: }
126:
127: // store infos away for later use
128: // although multiple files may be processed, it is assumed that all
129: // have the same settings
130: is_anonymized = IP_ANONYMIZED(nffile);
131: strncpy(Ident, nffile->file_header->ident, IDENTLEN);
132: Ident[IDENTLEN-1] = '\0';
* a prakticky to bude takove...
nfprofile[3448]: segfault at ffffffffffffffff ip 000000000040272d sp 00007fff025f6830 error 4
nfprofile[3454]: segfault at ffffffffffffffff ip 000000000040272d sp 00007fff4a5dac60 error 4 in nfprofile[400000+22000] in nfprofile[400000+22000]
nfprofile[3446]: segfault at ffffffffffffffff ip 000000000040272d sp 00007fff4b56d150 error 4 in nfprofile[400000+22000]
nfprofile[3458]: segfault at ffffffffffffffff ip 000000000040272d sp 00007fff7a1d4dd0 error 4 in nfprofile[400000+22000]
nfprofile[3456]: segfault at ffffffffffffffff ip 000000000040272d sp 00007fff20e5a570 error 4 in nfprofile[400000+22000]
nfprofile[3450]: segfault at ffffffffffffffff ip 000000000040272d sp 00007fff58e734f0 error 4 in nfprofile[400000+22000]
nfprofile[3452]: segfault at ffffffffffffffff ip 000000000040272d sp 00007fff3c90aa20 error 4 in nfprofile[400000+22000]
$ objdump -DCl /usr/local/bin/nfprofile | less
..
/home/flowmon/nfdump-1.6.6-lic2.0/bin/nfprofile.c:626
402727: 48 89 44 24 68 mov %rax,0x68(%rsp)
process_data():
/home/flowmon/nfdump-1.6.6-lic2.0/bin/nfprofile.c:121
40272c: e8 cf bd 00 00 callq 40e500
/home/flowmon/nfdump-1.6.6-lic2.0/bin/nfprofile.c:122
402731: 48 85 c0 test %rax,%rax
/home/flowmon/nfdump-1.6.6-lic2.0/bin/nfprofile.c:121
402734: 49 89 c7 mov %rax,%r15
/home/flowmon/nfdump-1.6.6-lic2.0/bin/nfprofile.c:122
402737: 0f 84 89 0f 00 00 je 4036c6
..
===== ladeni segmentation fault (segfault) 2 =====
* zdroje: http://mytechrants.wordpress.com/2009/05/22/debugging-a-segmentation-fault-using-gdb/
* priiklad z praxe
* klasicky vystup pri spusteni programu
/home/bari/Plocha/flowmon-vyvoj/nfdump-1.6.9-nbar-lic3.0-geo-http/bin/sfcapd -E -w -p 3030 -l /tmp/
..
Neoprávněný přístup do paměti (SIGSEGV)
* v dmesg se dozvime vice, ale je to k nicemu. Program umrel pri volani funkce knihovny libc. Nevim ale jakeho, chybi mi backtrace.
sfcapd[1407] general protection ip:7f25fab7e119 sp:de0a6b281b401a28 error:0 in libc-2.13.so[7f25faa7d000+18d000]
* zapnuti coredump
ulimit -c unlimited
* vytvoril se mi soubor core
Neoprávněný přístup do paměti (SIGSEGV) (core dumped [obraz paměti uložen])
gdb /home/bari/Plocha/flowmon-vyvoj/nfdump-1.6.9-nbar-lic3.0-geo-http/bin/sfcapd core
* ale moc moudra z toho nevypadlo
[195964.091582] sfcapd[1438] general protection ip:7fbe6b62b119 sp:44ca3412556af324 error:0 in libc-2.13.so[7fbe6b52a000+18d000]
(gdb) bt
#0 ____longjmp_chk () at ../sysdeps/unix/sysv/linux/x86_64/____longjmp_chk.S:112
#1 0x44ca3412556af324 in ?? ()
Cannot access memory at address 0x44ca3412556af324
===== Systemd coredump =====
* systemd se stará i o core dumpy
cat /proc/sys/kernel/core_pattern
|/usr/lib/systemd/systemd-coredump %p %u %g %s %t %e
* podle [[https://www.freedesktop.org/software/systemd/man/systemd-coredump.html|dokumentace]] se coredump vytváří ve složce ''/var/lib/systemd/coredump/*''
* je uložen komprimovaně v xz archívu
* lze taky použít
systemd-coredumpctl list
systemd-coredumpctl dump --output /tmp/aaa
===== Odkazy =====
* [[http://lcamtuf.coredump.cx/signals.txt|Moc pekne exploitace pres signal handler]]