Search code examples
cdebugginggdb

Breakpoint on strcpy using GDB


I use GDB to debug my code and get stuck when make breakpoint at a function( eg: use strcpy from string.h).

  1. At this code, the gdb stop at breakpoint inside strcpy function.
(gdb) list
1   #include<stdio.h>
2   #include<string.h>
3   main()
4   {
5   char a[20],b[]="ffff";
6   strcpy(a,b);
7   printf("%s\n",a);
8   }
(gdb) break 6
Breakpoint 1 at 0x8048486: file thu.c, line 6.
(gdb) break strcpy
Breakpoint 2 at 0x8048370
(gdb) break 7
Breakpoint 3 at 0x804849a: file thu.c, line 7.
(gdb) run
Starting program: /home/m/a.out 

Breakpoint 1, main () at thu.c:6
6   strcpy(a,b);
(gdb) c
Continuing.

Breakpoint 2, 0xb7ea2490 in ?? () from /lib/i386-linux-gnu/libc.so.6
(gdb) c
Continuing.

Breakpoint 3, main () at thu.c:7
7   printf("%s\n",a);

You can see that gdb stop at breakpoint2 (inside strcpy).

  1. At this code, GDB not stop at breakpoint 2 (inside strcpy) but go to breakpoint3.
(gdb) list
1   #include<stdio.h>
2   #include<string.h>
3   main()
4   {
5   char a[20];
6   strcpy(a,"hello world!");
7   printf("%s\n",a);
8   }
(gdb) break 6
Breakpoint 1 at 0x8048449: file thu.c, line 6.
(gdb) break strcpy
Function "strcpy" not defined.
Make breakpoint pending on future shared library load? (y or [n]) y

Breakpoint 2 (strcpy) pending.
(gdb) break 7
Breakpoint 3 at 0x8048469: file thu.c, line 7.
(gdb) run
Starting program: /home/m/a.out 

Breakpoint 1, main () at thu.c:6
6   strcpy(a,"hello world!");
(gdb) c
Continuing.

Breakpoint 3, main () at thu.c:7
7   printf("%s\n",a);

So what make two cases different? I am following the book "Hacking: The Art of Exploitation" Jon Erickson, this is a example from the book, the case 2 is similar with code char_array2.c at page 39, but the output is not similar from the book in case of breakpoint 2.


Solution

  • in the first case, the compiler has all the details (all parameters are variables at known offsets on the stack. So the compiler probably replaced the call to strcpy with a macro. In the second case, not all the details about the parameters are known, so an actual call to strcpy was inserted by the compiler