在 x86_64平台下 调试 arm 的用户态程序

在 x86_64平台下 调试 arm 的用户态程序

实验：arm 用户态程序是本地交叉编译出来的，如果是别的程序直接拷贝过来，可能会有兼容性问题；

file hello
hello: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.3, for GNU/Linux 3.2.0, BuildID[sha1]=dcfe92f8af30811bd3ca027195f43c75ca910a48, not stripped

需要安装以下程序
sudo apt-get install qemu
sudo apt-get install gdb-multiarch

在本地用 qemu 启动 用户态程序

$ qemu-arm -g 1234 -L /usr/arm-linux-gnueabi -cpu cortex-a7  ./hello

-g port 指定调试端口

在另外一个 shell 中用 gdb-multiarch 去调试它

$ gdb-multiarch
GNU gdb (Ubuntu 8.1-0ubuntu3.2) 8.1.0.20180409-git
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word".
pwndbg: loaded 189 commands. Type pwndbg [filter] for a list.
pwndbg: created $rebase, $ida gdb functions (can be used with print/break)
pwndbg> target  remote:1234

target remote:1234 就是连接前面监听的端口
可以开始调试了

 0xff7bdc70    ldr    sl, [pc, #0x94]
 ► 0xff7bdc74    ldr    r4, [pc, #0x94]
   0xff7bdc78    mov    r0, sp
   0xff7bdc7c    bl     #0xff7be3ac

   0xff7bdc80    add    r6, pc, #0x84
   0xff7bdc84    add    sl, sl, r6
   0xff7bdc88    ldr    r4, [sl, r4]
   0xff7bdc8c    mov    r6, r0
   0xff7bdc90    ldr    r1, [sp]
   0xff7bdc94    add    r2, sp, #4
   0xff7bdc98    cmp    r4, #0

下面这个就是进入到 main 函数的汇编了

► 0x1055c    push   {fp, lr}
   0x10560    add    fp, sp, #4
   0x10564    sub    sp, sp, #8
   0x10568    ldr    r3, [pc, #0x88]
   0x1056c    ldr    r3, [r3]
   0x10570    str    r3, [fp, #-8]
   0x10574    ldr    r3, [pc, #0x80]
   0x10578    str    r3, [fp, #-0xc]
   0x1057c    ldr    r3, [fp, #-0xc]
   0x10580    ldr    r3, [r3, #-8]
   0x10584    ldr    r2, [pc, #0x74]