📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  IDA Pro  >>  breakpoint with gdb on IDA offset?

Topic created on: January 18, 2009 16:05 CST by Billabong .

Hi, just got a quick question I cannot solve. I have a offset in IDA like:

__text:000021E4

and want to set a breakpoint there with gdb but *0x000021E4 does not work, what I am doing wrong? How to get the offset to set the breakpoint?

The file I am debugging is OSX Macho.

  Dreg     January 18, 2009 16:29.09 CST
I think... First you know the __text address and then: __text addr + 21E4. 21E4 is the offset inside __text.

With objdump, gdb, elfdump or other tools you know the address of the sections.

You can use inside gdb the command: maintenance info sections

Dreg@system [~]# gdb poc
... banner ...
(gdb) maintenance info sections
Exec file:
    `/root/poc', file type elf32-i386.
    0x080480b4->0x080480cb at 0x000000b4: .init ALLOC LOAD READONLY CODE HAS_CONTENTS
    0x080480e0->0x0808f2bf at 0x000000e0: .text ALLOC LOAD READONLY CODE HAS_CONTENTS
....

Then, text section starts in 0x080480e0, now only you need:
0x080480e0 + 0x21E4 and the result is your breakpoint address :-).

Sincerly, Dreg.

  Billabong   January 19, 2009 11:53.58 CST
Many thanks for the advice.

Well what I get is:

    0x00001000->0x000a4000 at 0x00000000: LC_SEGMENT.__TEXT ALLOC LOAD CODE HAS_CONTENTS
    0x000021e4->0x0008f832 at 0x000011e4: LC_SEGMENT.__TEXT.__text ALLOC LOAD READONLY CODE HAS_CONTENTS

But doesnt work either :S It's already what IDA gives me.

Code starts at 0x000021e4 in IDA already so offset is 1:1 but if I try to disas this location in gdb I get errors it is not in a function?

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit