1

I am trying to debug a segfault without code a binary in a nonstandard path (specifically in /frs/alg/alg/bin/) and I was noticing that the decompiled code has fewer symbols than when debugging under gdb. I am assuming that the debug symbols are detached, but Where should I look to find them?

  • Given that it’s in a non-standard path, you should really ask whoever provided and/or installed the software... – Stephen Kitt Oct 12 '17 at 21:24
  • @StephenKitt, I think I would have just as much luck as I jot asking for source which was thousands of dollars and no (with free laughter). On the other hand gdb does find them. – hildred Oct 12 '17 at 21:32
  • You can't really "decompile" a program. gdb can only disassemble it, then you are left trying to read assembly language. You aren't really going to be able to debug the program without source code. – psusi Oct 12 '17 at 23:59
  • @psusi. I realize gdb cannot decompile code, that is why I am using a separate decompiler. – hildred Oct 15 '17 at 13:58
  • @hildred, that made no sense at all. If it can not be done, then using a different program to do it isn't going to help. Over the years there have been programs claiming to "decompile" but they never work very well at all. If you want to debug a program, you need its source code. – psusi Oct 17 '17 at 1:40
2

Presumably the binary has detached debug information; if gdb is able to find this without any particular configuration, it should be in one of

  • a build-id based file under /usr/lib/debug/.build-id;
  • a .debug file alongside the binary;
  • a .debug file in /frs/alg/alg/bin/.debug;
  • a .debug file in /usr/lib/debug/frs/alg/alg/bin.

The binary might have a debug link pointing at the detached information; look for a .gnu_debuglink section in the binary. To find its build-id (if any), look for a section named .note.gnu.build-id or something along those lines.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.