Week 6 lab topics:

1. tools for examining binary files
2. gdb (and ddd) for examining binary executable run state

---

Create a week06 subdirectory in your weeklylab subdirectory and copy over some files:

    cd cs31/weeklylab		
    pwd
    mkdir week06
    ls
    cd week06
    pwd
    cp ~newhall/public/cs31/week06/* .
    ls

First, let's open up simplefuncs.c in vim.

We are going to look again at how to use gcc to create an assembly version of this file, and how to create a object .o file, and how to examine its contents.

If you open up the Makefile you can see the rules for building .s, .o and executable files from simplefuncs.c. We will be compiling the 32-bit version of instructions, so we will use the -m32 flag to gcc:

gcc-4.4 -m32 -S simplefuncs.c   # just runs the assembler to create a .s text file
gcc-4.4 -m32 -c simplefuncs.c   # compiles to a relocatable object binary file (.o) 
gcc-4.4 -m32 -o simplefuncs simplefuncs.o  # creates a 32-bit executable file

To see the machine code and assembly code mappings in the .o file:

objdump -d simplefuncs.o

You can compare this to the assembly file:

cat simplefuncs.s

Some tools for examining binary files:

1. strings dumps all the strings in a binary file:

     strings simplefuncs 
   

2. nm (or objdump -t) to list symbol table contents:

     objdump -t  simplefuncs   # list symbol table in the executable (a.out) file
     nm --format sysv  simplefuncs  # list symbol table in the executable file
   

   The symbol table includes the names of all functions and global variables in the program. There is a lot of information in the symbol table that looks odd, but you should be able to see an entry for the two funcitons main and func1, and see where their start addresses are in memory.

3. gdb and ddd and disass

We covered using gdb to step through IA32 assembly in the week 4 Wednesday Lab, but let's try it out again with the simplefuncs program. And let's try out a few new things with simplefuncs too.

First, let's open up simplefuncs.c in vim. Then, let's try some things out in gdb:

gdb simplefuncs
(gdb) break main
(gdb) break func1
(gdb) run

In gdb you can disassemble code using the disass command:

(gdb) disass main

You can set a break point at a specific instruction:

(gdb) break *0x08048477   # set breakpoint at specified address 

And you can step or next at the instruction level using ni or si (si steps into function calls, ni skips over them):

(gdb) ni	  # execute the next instruction then gdb gets control again 
(gdb) ni
(gdb) ni
(gdb) ni
(gdb) ni
(gdb) disass
(gdb) cont      # continue to next break point

Now we are at the call to func1, let's step into this function using si (we also have a breakpoint at this function, let's see when it is hit):

(gdb) si	  # step into instructions in the called function (func1)
(gdb) disass
(gdb) ni 
(gdb) where
(gdb) disass
(gdb) cont

The difference between si and ni is shows up in what each does on a call instruction. si gives gdb control again at instructions at the begining of the called function. ni gives gdb control again at the instruction immediately after the call instruction (the instruction at the return address). si "steps into" the called function, "ni" lets the called function code continue, and only after the function returns does gdb get control again.

You can print out the values of individual registers like this:

(gdb) print $eax

Or the memory contents at a given address, providing either the absolute numeric address or its value stored in registers:

(gdb) p *(int *)($ebp + 8)
(gdb) x     $ebp + 8
(gdb) x/d     $ebp + 8   # x/d display as decimal value

You can also view all register values:

(gdb) info registers

You can also use the display command to automatically display values each time a breakpoint is reached:

(gdb) display $eax
(gdb) display $edx

You can use the examine command (x) to display the contents of a memory location. The memory address operand to (x) can be specified as the name of the register storing the address value or as an absolute memory address value. Here are some examples (x is shorthand for examine, and p is shorthand for the print command):

x $esp-0x8  # see what p and x display for the same value
p $esp-0x8    

p *(int *)($ebp-0x8)    # here is how to print value at memory location

x $ebp-0x8              # or a much easier way using x

# here is an example of examining the contents at a memory location
# specifying the address in two different ways (the exact address
# value in the second depends on what $esp - 0x1c is, it can vary run to run)
x $esp + 0x1c    
x 0xffffd2fc     

ddd

We are going to try running this in ddd instead of gdb, because ddd has a nicer interface for viewing assembly, registers, and stepping through program execution:

ddd simplefuncs

The gdb prompt is in the bottom window. There are also menu options and buttons for gdb commands, but I find using the gdb prompt at the bottom easier to use.

You can view the register values as the program runs (choose Status->Registers to open the register window).

More Info

• Quick summary of some useful gdb commands for debugging at the assembly code level (this is a made up code example):

    ddd a.out
    (gdb) break main          
    (gdb) run  6              # run with the command line argument 6
    (gdb) disass main         # disassemble the main function
    (gdb) break sum           # set a break point at the beginning of a function
    (gdb) cont                # continue execution of the program
    (gdb) break *0x0804851a   # set a break point at memory address 0x0804851a
    (gdb) ni                  # execute the next instruction
    (gdb) si                  # step into a function call (step instruction)
    (gdb) info registers      # list the register contents
    (gdb) p $eax              # print the value stored in register %eax
    (gdb) p  *(int *)($ebp+8) # print out value of an int at addr (%ebp+8)
    (gdb) x/d $ebp+8          # examine the contents of memory at the given 
                              # address (/d: prints the value as an int)
                              # display type in x is sticky: subsequent x commands
                              # will display values in decimal until another type
                              # is specified (e.g. x/x $ebp+8   # in hex)
  

• IA32 resources
• My GDB Guide for more information about using gdb and ddd. (see the "using gdb to debug assembly code and examine memory and register values" section).
• Figure 3.30 on p.255 of the textbook lists gdb commands.
• Tools for examining .o, .so, and a.out files