Hot answers tagged

16

You can only debug a setuid or setgid program if the debugger is running as root. The kernel won't let you call ptrace on a program running with extra privileges. If it did, you would be able to make the program execute anything, which would effectively mean you could e.g. run a root shell by calling a debugger on /bin/su. If you run Gdb as root, you'll be ...


10

You can do this with gdb: commands ni and si run a single instruction at time. Command n runs the next line of code, for most values of "next". For n (and the corresponding s) you have to have compiled so that debugging symbols appear in the executable. This stackoverflow answer gives a couple of methods of doing this more-or-less visually. The gdb ...


8

The usual trick is to have something (possibly a signal like SIGUSR1) trigger the program to fork(), then the child calls abort() to make itself dump core. from os import fork, abort (...) def onUSR1(sig, frame): if os.fork == 0: os.abort and during initialization from signal import signal, SIGUSR1 from wherever import onUSR1 (...) signal....


6

Run ps -l on the process ID and check the S (“state”) column. If the state is R, then your process is executing code. If the process remains in state R and strace doesn't show it executing any system call, then the process is trapped in a very long, possibly infinite computation. If the process is and remains in state D, then it is blocked in a system call. ...


6

eval does a printf of its arguments and then runs it as a command. So you can take your printf argument list, insert set $MyVar = at the beginning, and eval it. (gdb) eval "set $MyVar = \"Hello %d\"", 7 (gdb) print $MyVar $2 = "Hello 7"


5

The octal representation eases the interpretation of the exit code for small values, which are the most commonly used. Should this number, which is a byte, been printed in decimal, finding which signal interrupted a process would require a little bit of calculation while in octal, they can be read as they are: a process exits with status 5, gdb displays 05 ...


4

On Linux, you could enable mtrace in your program, but it is a code change. On OpenBSD, you could try the malloc stats. Google's leak checker might also be worth a look, and unlike mtrace you may be able to use LD_PRELOAD to avoid recompilation.


4

Norman Matloff's book on debugging: The Art of Debugging is quite good, though I don't know if you would consider it advanced. There is also his online tutorial, Guide to Faster, Less Frustrating Debugging, which might be an earlier version of the book. There is also a tutorial My debugging tutorial, linked from the page Norm Matloff's DDD Tutorial. ...


4

gdb will ask you to confirm certain commands, if the value of the confirm setting is on. From Optional Warnings and Messages: set confirm off Disables confirmation requests. Note that running GDB with the --batch option (see -batch) also automatically disables confirmation requests. set confirm on Enables confirmation requests (the default). ...


4

First you need to understand the basics of virtual memory. You don't need to understand how a MMU works, but you do need to understand what a virtual address space is, and when you're dealing with virtual addresses or physical addresses. Otherwise you won't be able to make any sense of what you see. Under Linux, you can access the system's physical memory ...


4

0x is a very common prefix for numbers written in hexadecimal, i.e. in base 16. x is a GDB command to display the content of a part of the memory. The digits and letters after the / indicate what to print: 300 words (w), in hexadecimal (x). The number after that is the address at which to start printing. “r=4 w=2 x=1” is about the numerical and symbolic ...


3

No. gdb is packaged by a maintainer, glibc is packaged by another maintainer, gcc, libstdc and so on all all packaged by different maintainers. To package the debuginfo for these along with gdb would take considerable coordination. Each time one of the packages changed, the gdb maintainer would have to repackage and release. It would become quite ...


3

I think memleax, which detects memory leak of running process, is exact what you want. It works like gdb and strace. It attaches a running process, hooks memory allocate/free APIs, records all memory blocks, and reports the blocks which lives longer than 5 seconds (you can change this time by -e option). It's very convenient and suitable for production ...


3

Here's a way to start the process in a stopped state if you will. Use a bash script doing: echo $BASHPID; kill -STOP $BASHPID; exec sudo -u unpriviledged_user -g the_group_if_not_primary command Make that run in the background. Then start gdb, and attach to the pid that was printed. You'll have to step through the exec command with gdb, but you'll be ...


3

This blurb on the Sun Studio 12 website would seem to imply that they're basically useless. excerpt - http://docs.oracle.com/cd/E19205-01/819-5257/blabs/index.html If Your Core File Is Truncated If you have problems loading a core file, check whether you have a truncated core file. If you have the maximum allowable size of core files set too ...


3

In gdb you can use the command show environment. Also as an alternative to examine the environment of a process is: $ sed 's/\x0/\n/g' /proc/<PID>/environ The sed command is necessary to convert the NUL separators into newlines for readability. The advantage of either of these approaches (besides simplicity) is that it doesn't matter if your symbol ...


3

Has your binary been stripped of its symbols? If so, there will be no symbol table and you will have no hope of finding this symbol. You can find out with readelf - here my hello binary does have its symbol table: $ readelf -S hello | grep -i symtab [28] .symtab SYMTAB 0000000000000000 000018f8 $ Also when you run GDB, has your ...


3

After a lot more searching I think I have convinced myself that there is no simple way to get what I want. So, what did I end up doing? I installed LiME from github (https://github.com/504ensicsLabs/LiME) git clone https://github.com/504ensicsLabs/LiMe cd /LiME/src make -C /lib/modules/`uname -r`/build M=$PWD modules The above commands create the lime.ko ...


2

You could try using gcore. Is that an option for you?


2

%:8 is a valid filename-modifier, so it is being interpreted by Vim as a part of the :! command. You can use expand('%') to manually expand %, and then properly quote it with shellescape(…,1): :map <F9> :exe '!gdbset bp' shellescape(expand('%').':'.line('.'),1)<CR><CR> :map <F8> :exe '!gdbset clear bp' shellescape(expand('%').'...


2

Of course it won't stop, you didn't even set a break point. i.e b __libc_start_main Look at this message: Program exited normally. means gdb started it, and completed execution normally.


2

You can debug a program even if not all the libraries have debuginfo, you just won't be able to follow into the library in terms of source code. Most of the time the problems aren't in the library anyway.


2

Enable and refresh the debug repos. http://download.opensuse.org/debug/distribution/11.4/repo/oss/ http://download.opensuse.org/debug/update/11.4/ zypper ar -f -n "openSUSE-11.4-Debug" http://download.opensuse.org/debug/distribution/11.4/repo/oss/ repo-debug zypper ar -f -n "openSUSE-11.4-Update-Debug" http://download.opensuse.org/debug/update/11.4/ ...


2

Gdb doesn't automatically run the executable for you, it just loads it. This way you can set things up (e.g. breakpoints) as you wish first. The "run" command at the (gdb) prompt will start execution. This also allows you to specify command-line arguments to tshark, eg: (gdb) run -i lo Will run tshark the same way tshark -i lo would.


2

A quick solution would be to simply remove whole /usr/local in case you haven't installed anything else there (according to out little detour in comments, I think that is the case). So sudo mv /usr/local /usr/_local will get rid of whatever gunk is there (you can delete the directory later, when you're sure it contains nothing important). Then instead of ...


2

I don't think the permission denied is necessarily talking about the traditional permissions bits (rwx..), rather I'd be suspicious of something like SELinux or AppArmor which might be denying your process access. I do not have access to a ArchLinux system but there is something similar under Fedora that is discussed here in this Fedora Wiki topic: Features/...


2

I think the application you're looking for is called cpulimit. This isn't a command that's normally included with a system so you'll have to install it either via your distros package manager (Ubuntu/Debian) or from source. Ubuntu/Debian $ apt-cache search cpulimit cpulimit - tool for limiting the CPU usage of a process So installation would go like this:...


2

Compilers can be configured to generate extra information with the executable and/or libraries that aid debugging. With this extra information, your debugger can show the original source code and variable names amongst other things. Unfortunately, this debugging information take up a lot of space on the system. Considering that they are hardly ever used (...


2

It might because of your history size is 0. You can check your gdb history size: (gdb) show history size The size of the command history is 0. (gdb) If the history maximum size is 0, then up arrow is of course not working because no history could be saved. The main reason i found is because the bash environment variable HISTSIZE is 0 or empty. It's ...


2

In order to read /proc/[pid]/mem, a process must now PTRACE_ATTACH to it. A commonly available utility that does this is gdb Pick a running process (in my case I just opened cat in another window), then attach gdb to that process: [root@qemu ~]# gdb --pid 423 #MORE OUTPUT 0xb771dbac in __kernel_vsyscall () As part of its output while loading symbols, gdb ...



Only top voted, non community-wiki answers of a minimum length are eligible