GDB für das Debugging von Assembly verwenden

Welcome to the world of debugging! When working with low-level languages like assembly, understanding exactly what your program is doing, instruction by instruction, is crucial.

The GNU Debugger (GDB) is an incredibly powerful tool that lets you:

• Pause your program at specific points (breakpoints).
• Step through code line by line.
• Inspect the values in registers and memory.
• Understand program flow and identify issues.

It's an essential skill for any assembly programmer!

Before GDB can help us, we need to compile our assembly code with special 'debug symbols'. These symbols tell GDB about variable names, function labels, and source code lines, making debugging much easier.

For NASM assembly on Linux, you typically use the -g flag during compilation and linking:

• Assemble: nasm -f elf32 -g your_code.asm -o your_code.o
• Link: ld -m elf_i386 -g your_code.o -o your_executable

The -g flag embeds the debugging information directly into the object file and executable.

Let's use a straightforward assembly program as our debugging target. This program prints a message to the console and then performs a simple addition before exiting.

We'll compile this with debug symbols and then dive into GDB.

Once your program is compiled with debug symbols, launching GDB is simple. Open your terminal and type gdb followed by your executable's name.

For our example, if the executable is named debug_executable, you would type:

gdb ./debug_executable

GDB will load your program and present you with its prompt, usually (gdb). Your program isn't running yet; GDB is just ready to receive commands.

A breakpoint is a marker that tells GDB to pause your program's execution when it reaches a specific instruction or memory address. This is how you stop the program at a point of interest.

To set a breakpoint, use the break or b command, followed by a function name, label, or memory address. For assembly, we often use labels.

• (gdb) break _start: Sets a breakpoint at the program's entry point.
• (gdb) b *0x80480a0: Sets a breakpoint at a specific memory address (example address).

After setting breakpoints, you can start your program or resume its execution.

• run (or r): Starts your program from the beginning. It will run until it hits the first breakpoint, finishes, or crashes.
• continue (or c): Resumes execution after your program has hit a breakpoint. It will continue running until the next breakpoint or program termination.

Try setting a breakpoint at _start and then using run. You'll see GDB pause right at the beginning of your program!

Once your program is paused at a breakpoint, you can execute instructions one at a time. This is invaluable for seeing the exact effect of each instruction.

• stepi (or si): Executes the next single instruction. If the instruction is a call to a procedure, si will enter that procedure.
• nexti (or ni): Executes the next single instruction. If the instruction is a call, ni will execute the entire procedure and stop at the instruction immediately *after* the call.

Use si to meticulously trace through every instruction, or ni to skip over procedure calls you're not interested in.

Registers are the CPU's small, super-fast storage locations. In assembly, you're constantly moving data in and out of them. GDB lets you inspect their current values.

• info registers (or i r): Displays the current values of all general-purpose registers, segment registers, and the instruction pointer (EIP/RIP) and flags.
• info registers eax: Displays the value of a specific register, like EAX.
• print $eax: Another way to print a specific register's value. The $ prefix tells GDB it's a register.

After our add eax, ebx instruction, you could check eax to see its new value (15).

Beyond registers, you'll often need to inspect what's stored in memory. The x command (examine) is your friend here.

Its format is x/<count><format><unit-size> <address>:

• count (N): How many units to display.
• format (F): How to display (e.g., x for hex, d for decimal, s for string, i for instructions).
• unit-size (U): Size of each unit (e.g., b for byte, h for halfword/2 bytes, w for word/4 bytes, g for giant/8 bytes).

Examples:

• (gdb) x/s hello_msg: Display the string at hello_msg.
• (gdb) x/4xw $esp: Display 4 words (4 bytes each) in hex starting from the stack pointer.

Sometimes you're debugging and need to see the assembly instructions around your current execution point. The disassemble command (or disas) converts machine code back into assembly.

• (gdb) disassemble: Disassembles the function currently being executed.
• (gdb) disas _start: Disassembles the entire _start function.
• (gdb) disas $eip, +20: Disassembles 20 bytes of instructions starting from the current instruction pointer (EIP).

This helps you quickly orient yourself and see the surrounding code context.

Which of the following GDB commands are used to control program execution (start, pause, resume, step)?

Congratulations! You've taken your first steps into mastering GDB for assembly debugging. We covered:

• Why GDB is essential for low-level programming.
• How to compile assembly with debug symbols.
• Basic GDB commands like run, break, and continue.
• Stepping through code with stepi and nexti.
• Inspecting registers (info registers) and memory (x).
• Disassembling code on the fly (disassemble).

These fundamental skills will empower you to understand and troubleshoot complex assembly programs, revealing their inner workings instruction by instruction. Keep practicing!