1.计算一个结构体成员offset
p/x &((struct A *)0)->b 其中A表示结构体,b是成员
2.输入被调试程序输入参数:
r -sysdir /home/skyeye/android_test -system initrd_96M.img -data userdata.img -ramdisk ramdisk.img -kernel zImage -show-kernel -verbose
3.breakpoint
b cpu_arm_exec or
(gdb) b *0x40000000
Breakpoint 3 at 0x40000000
查看断点信息:
(gdb) info breakpoints
Num Type Disp Enb Address What
1 breakpoint keep y 0x000000000057bf50 in qemu_cpu_exec at /home/skyeye/s2e/s2e/qemu_android/cpus.c:562
breakpoint already hit 2 times
2 breakpoint keep y 0x0000000000513bb0 in cpu_arm_exec at /home/skyeye/s2e/s2e/qemu_android/cpu-exec.c:248
breakpoint already hit 1 time
3 breakpoint keep y 0x0000000040000000
4.查看某个变量
(gdb) p/x *(struct CPUARMState *)0x0x1d9a010
5.查看某个地址的值:
(gdb) x/20i 0x40000000
6.查看寄存器
(gdb) info registers
7.查看变量类型:
(gdb) ptype env
(gdb) whatis env
8.查找变量:
(gdb) info variables env (查找env变量,可以着正则式);info variables查看所以变量。类似的查看函数,info functions 以及info functions REX
9.查看类型定义:
(gdb) info types env 使用方法跟上面类似
10.signals :
info signals
- Change the way GDB handles signal signal. signalcan be the number of a signal or its name (with or without the `SIG' at the beginning); a list of signal numbers of the form `low-high'; or the word `all', meaning all theknown signals. The keywords say what change to make.
handle signal keywords...
The keywords allowed by the handle
command can be abbreviated.Their full names are:
- GDB should not stop your program when this signal happens. It maystill print a message telling you that the signal has come in.
-
GDB should stop your program when this signal happens. This impliesthe
print
keyword as well. - GDB should print a message when this signal happens.
-
GDB should not mention the occurrence of the signal at all. Thisimplies the
nostop
keyword as well. -
-
GDB should allow your program to see this signal; your programcan handle the signal, or else it may terminate if the signal is fataland not handled.
pass
andnoignore
are synonyms. -
-
To enable core dumps on the target:
ulimit -c unlimited
-
pseudo-files that control how the core file will be named (cat these to see the current configuration, write to them to change the configuration):
/proc/sys/kernel/core_pattern /proc/sys/kernel/core_uses_pid
nostop
stop
print
noprint
pass
noignore
nopass
ignore
GDB should not allow your program to see this signal.nopass
and ignore
are synonyms.
core dump:
If you can enable core dumps on that system, just run the program, let it crash, then pull the core dump off the target machine onto your development machine and load it into a GDB built to debug the target architecture - that should tell you exactly where the crash occurred. Just use GDB's core
command to load the core file into the debugger.
On my system, once core dumps are enabled, a crashing program will write a file simply named "core" in the working directory. That's probably good enough for your purposes, but changing how the core dump file is named lets you keep a history of core dumps if that's necessary (maybe for a more intermittent problem).