Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>Ok, here a big edition of my previous answer. I think I found a way now.</p> <p>You (still :) have this specific problem:</p> <pre><code>(gdb) disas main No symbol table is loaded. Use the "file" command. </code></pre> <p>Now, if you compile the code (I added a <code>return 0</code> at the end), you will get with <code>gcc -S</code>:</p> <pre><code> pushq %rbp movq %rsp, %rbp movl $.LC0, %edi call puts movl $0, %eax leave ret </code></pre> <p>Now, you can see that your binary gives you some info:</p> <p>Striped:</p> <pre><code>(gdb) info files Symbols from "/home/beco/Documents/fontes/cpp/teste/stackoverflow/distrip". Local exec file: `/home/beco/Documents/fontes/cpp/teste/stackoverflow/distrip', file type elf64-x86-64. Entry point: 0x400440 0x0000000000400238 - 0x0000000000400254 is .interp ... 0x00000000004003a8 - 0x00000000004003c0 is .rela.dyn 0x00000000004003c0 - 0x00000000004003f0 is .rela.plt 0x00000000004003f0 - 0x0000000000400408 is .init 0x0000000000400408 - 0x0000000000400438 is .plt 0x0000000000400440 - 0x0000000000400618 is .text ... 0x0000000000601010 - 0x0000000000601020 is .data 0x0000000000601020 - 0x0000000000601030 is .bss </code></pre> <p>The most important entry here is <code>.text</code>. It is a common name for a assembly start of code, and from our explanation of main bellow, from its size, you can see that it includes main. If you disassembly it, you will see a call to __libc_start_main. Most important, you are disassembling a good entry point that is real code (you are not misleading to change DATA to CODE).</p> <pre><code>disas 0x0000000000400440,0x0000000000400618 Dump of assembler code from 0x400440 to 0x400618: 0x0000000000400440: xor %ebp,%ebp 0x0000000000400442: mov %rdx,%r9 0x0000000000400445: pop %rsi 0x0000000000400446: mov %rsp,%rdx 0x0000000000400449: and $0xfffffffffffffff0,%rsp 0x000000000040044d: push %rax 0x000000000040044e: push %rsp 0x000000000040044f: mov $0x400540,%r8 0x0000000000400456: mov $0x400550,%rcx 0x000000000040045d: mov $0x400524,%rdi 0x0000000000400464: callq 0x400428 &lt;__libc_start_main@plt&gt; 0x0000000000400469: hlt ... 0x000000000040046c: sub $0x8,%rsp ... 0x0000000000400482: retq 0x0000000000400483: nop ... 0x0000000000400490: push %rbp .. 0x00000000004004f2: leaveq 0x00000000004004f3: retq 0x00000000004004f4: data32 data32 nopw %cs:0x0(%rax,%rax,1) ... 0x000000000040051d: leaveq 0x000000000040051e: jmpq *%rax ... 0x0000000000400520: leaveq 0x0000000000400521: retq 0x0000000000400522: nop 0x0000000000400523: nop 0x0000000000400524: push %rbp 0x0000000000400525: mov %rsp,%rbp 0x0000000000400528: mov $0x40062c,%edi 0x000000000040052d: callq 0x400418 &lt;puts@plt&gt; 0x0000000000400532: mov $0x0,%eax 0x0000000000400537: leaveq 0x0000000000400538: retq </code></pre> <p>The call to <a href="http://refspecs.freestandards.org/LSB_3.1.1/LSB-Core-generic/LSB-Core-generic/baselib---libc-start-main-.html">__libc_start_main</a> gets as its first argument a pointer to main(). So, the last argument in the stack just immediately before the call is your main() address.</p> <pre><code> 0x000000000040045d: mov $0x400524,%rdi 0x0000000000400464: callq 0x400428 &lt;__libc_start_main@plt&gt; </code></pre> <p>Here it is 0x400524 (as we already know). Now you set a breakpoint an try this:</p> <pre><code>(gdb) break *0x400524 Breakpoint 1 at 0x400524 (gdb) run Starting program: /home/beco/Documents/fontes/cpp/teste/stackoverflow/disassembly/d2 Breakpoint 1, 0x0000000000400524 in main () (gdb) n Single stepping until exit from function main, which has no line number information. hello 1 __libc_start_main (main=&lt;value optimized out&gt;, argc=&lt;value optimized out&gt;, ubp_av=&lt;value optimized out&gt;, init=&lt;value optimized out&gt;, fini=&lt;value optimized out&gt;, rtld_fini=&lt;value optimized out&gt;, stack_end=0x7fffffffdc38) at libc-start.c:258 258 libc-start.c: No such file or directory. in libc-start.c (gdb) n Program exited normally. (gdb) </code></pre> <p>Now you can disassembly it using:</p> <pre><code>(gdb) disas 0x0000000000400524,0x0000000000400600 Dump of assembler code from 0x400524 to 0x400600: 0x0000000000400524: push %rbp 0x0000000000400525: mov %rsp,%rbp 0x0000000000400528: sub $0x10,%rsp 0x000000000040052c: movl $0x1,-0x4(%rbp) 0x0000000000400533: mov $0x40064c,%eax 0x0000000000400538: mov -0x4(%rbp),%edx 0x000000000040053b: mov %edx,%esi 0x000000000040053d: mov %rax,%rdi 0x0000000000400540: mov $0x0,%eax 0x0000000000400545: callq 0x400418 &lt;printf@plt&gt; 0x000000000040054a: mov $0x0,%eax 0x000000000040054f: leaveq 0x0000000000400550: retq 0x0000000000400551: nop 0x0000000000400552: nop 0x0000000000400553: nop 0x0000000000400554: nop 0x0000000000400555: nop ... </code></pre> <p>This is primarily the solution. </p> <p>BTW, this is a different code, to see if it works. That is why the assembly above is a bit different. The code above is from this c file:</p> <pre><code>#include &lt;stdio.h&gt; int main(void) { int i=1; printf("hello %d\n", i); return 0; } </code></pre> <p>But!</p> <hr> <p>if this does not work, then you still have some hints:</p> <p>You should be looking to set breakpoints in the beginning of all functions from now on. They are just before a <code>ret</code> or <code>leave</code>. The first entry point is <code>.text</code> itself. This is the assembly start, but not the main. </p> <p>The problem is that not always a breakpoint will let your program run. Like this one in the very <code>.text</code>:</p> <pre><code>(gdb) break *0x0000000000400440 Breakpoint 2 at 0x400440 (gdb) run Starting program: /home/beco/Documents/fontes/cpp/teste/stackoverflow/disassembly/d2 Breakpoint 2, 0x0000000000400440 in _start () (gdb) n Single stepping until exit from function _start, which has no line number information. 0x0000000000400428 in __libc_start_main@plt () (gdb) n Single stepping until exit from function __libc_start_main@plt, which has no line number information. 0x0000000000400408 in ?? () (gdb) n Cannot find bounds of current function </code></pre> <p>So you need to keep trying until you find your way, setting breakpoints at:</p> <pre><code>0x400440 0x40046c 0x400490 0x4004f4 0x40051e 0x400524 </code></pre> <hr> <p>From the other answer, we should keep this info:</p> <p>In the non-striped version of the file, we see:</p> <pre><code>(gdb) disas main Dump of assembler code for function main: 0x0000000000400524 &lt;+0&gt;: push %rbp 0x0000000000400525 &lt;+1&gt;: mov %rsp,%rbp 0x0000000000400528 &lt;+4&gt;: mov $0x40062c,%edi 0x000000000040052d &lt;+9&gt;: callq 0x400418 &lt;puts@plt&gt; 0x0000000000400532 &lt;+14&gt;: mov $0x0,%eax 0x0000000000400537 &lt;+19&gt;: leaveq 0x0000000000400538 &lt;+20&gt;: retq End of assembler dump. </code></pre> <p>Now we know that main is at <code>0x0000000000400524,0x0000000000400539</code>. If we use the same offset to look at the striped binary we get the same results:</p> <pre><code>(gdb) disas 0x0000000000400524,0x0000000000400539 Dump of assembler code from 0x400524 to 0x400539: 0x0000000000400524: push %rbp 0x0000000000400525: mov %rsp,%rbp 0x0000000000400528: mov $0x40062c,%edi 0x000000000040052d: callq 0x400418 &lt;puts@plt&gt; 0x0000000000400532: mov $0x0,%eax 0x0000000000400537: leaveq 0x0000000000400538: retq End of assembler dump. </code></pre> <p>So, unless you can get some tip where the main starts (like using another code with symbols), another way is if you can have some info about the firsts assembly instructions, so you can disassembly at specifics places and look if it matches. If you have no access at all to the code, you still can read the <a href="http://www.x86-64.org/documentation/abi.pdf">ELF definition</a> to understand how many sections should appear in the code and try a calculated address. Still, you need info about sections in the code!</p> <p>That is hard work, my friend! Good luck!</p> <p>Beco</p>
    singulars
    1. This table or related slice is empty.
    1. POHow to disassemble the main function of a stripped application?
      singulars
      1. PTQuestion
    1. PTAnswer
    1. USDr Beco
    1. USDr Beco
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. POHow to disassemble the main function of a stripped application?
      singulars
      1. PTQuestion
    1. This table or related slice is empty.
    1. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    1. COIndeed, if I had access to the code it would be fairly easy. All I would have to do is compile a version with symbols and either load that binary, or tell gdb where to load symbols from if I really had to debug the stripped version. The problem is that I really don't have the sources nor a non-stripped version of the application I'm interested in debugging. Thanks for your efforts. +1
      singulars
      1. PO
      1. USkarlphillip
    2. COWhat you are looking for is a way to calculate the starting point, given an ELF. You need to take a deep look into ELF definition, and understand how much each section can move main down in the offset. But still you need to know the number and size of sections. That `info files` can help you a bit. If I find some update in the next days I comment here. Good luck.
      singulars
      1. PO
      1. USDr Beco
    3. COThank you, Sensei.
      singulars
      1. PO
      1. USkarlphillip
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload