Comments for technochakra.com

Comment on Assembly And The Art Of Debugging by gdb – Assembly Language Debugging 101 | technochakra.com

gdb – Assembly Language Debugging 101 | technochakra.com — Wed, 20 Jul 2011 18:43:29 +0000

[...] If you would like to understand an assembly language listing, jump to this article [...]

Comment on strace Those Crashes On Linux by 64 bit JVM crash on RHEL 5.5 64 bit ( JRE 1.6 update 23 ) - strace attached

64 bit JVM crash on RHEL 5.5 64 bit ( JRE 1.6 update 23 ) - strace attached — Thu, 14 Jul 2011 15:00:23 +0000

[...] can be found using Google to help you: http://www.linuxintro.org/wiki.....27s_output http://www.technochakra.com/st.....-on-linux/ But, since you're using RedHat Enterprise, you can call RedHat support, and get them to help you [...]

Comment on GDB – Debugging In Assembly by Security | The Blog

Security | The Blog — Tue, 12 Apr 2011 13:29:17 +0000

[...] it doesn’t. Time for gdb. Stepping thought ASM is explained [...]

Comment on Debugging – Using Breakpoint Hit Count For Fun And Profit. by Aiden

Aiden — Fri, 25 Feb 2011 13:09:38 +0000

Thanks for the mac friendly help!

Comment on Software Breakpoints by tc

tc — Fri, 08 Oct 2010 13:08:53 +0000

User level debugger requires permissions from the OS to be able to debug a child program (Windows debugging APIs / ptrace on Unix). Whenever an int 3 instruction is executed, the control is passed to the operating system’s interrupt vector. The OS then notifies the debugger that the child it was monitoring has hit a breakpoint. WaitForDebugEvent (Win) and waitpid (on Unix) calls are some ways how the OS notifies the debugger. The OS acts as the authority in order to grant debugging permissions and also routes the notifications back to the debugger.

Comment on Software Breakpoints by Sumedh S

Sumedh S — Thu, 07 Oct 2010 22:21:51 +0000

I guess the above thing I mentioned wont work, because, cc would call some routine described by segment descriptor in IDT for int3.
Will it be possible to modify the segment selector and offset for int3 segment and point it to our code.

Comment on Software Breakpoints by Sumedh

Sumedh — Thu, 07 Oct 2010 21:15:01 +0000

In case one is writing a debugger,
our option would be to replace the instruction at an addr ‘x’ with the opcode ’0xcc’.
At the same time we should be having a debug exception handler in place.
so with the above opcode should we be replacing a ‘call our_debug_handler’ instruction.
Our debug handler let says shows some values and then makes sure that the replaced instructions are brought back into the memory for resumed execution.
Am I right?

Comment on Debugging – Modifying Code At Runtime by tc

tc — Sat, 25 Sep 2010 20:09:08 +0000

@maverick – I have never run into such a situation when I debug however the same should hold true for a debugger when inserting software breakpoints where the debugger too needs to change instructions in memory to insert the “int 3″ instruction.

Comment on Debugging – Modifying Code At Runtime by maverick

maverick — Wed, 01 Sep 2010 20:06:17 +0000

how could we change the assembly instructon in the text segment which is read+execute ? Shouldn’t OS generate an exception ?

Comment on Debugging – Modifying Code At Runtime by tc

tc — Tue, 27 Jul 2010 03:08:27 +0000

@Chris,
Thanks for the comments. Edit and Continue is a great feature in Visual Studio however if you are missing the build environment or do not have the sources (in case of a third party library) or are using a different debugger (or a different platform), then it is handy to know how to tweak logic by changing opcodes in memory in any debugger.