dmesg 程序崩溃调试

时间：2023-01-09 23:57:09
[root@localhost log]# cat -n /root/xx.c

       #include <stdio.h>

       void func(char *p)

       {

       *p = 'p';

       }

      int main(int argc, char *argv[])

      {

      char *p=NULL;

      func(p);

      return ;

      }

[root@localhost log]# /root/xx
 
[root@localhost log]# dmesg 

xx[8226]: segfault at 0 ip 0000000000400454 sp 00007fffcb8b6360 error 6 in xx[400000+1000]

[root@localhost log]# objdump -d /root/xx

/root/xx:     file format elf64-x86-

Disassembly of section .init:

 <_init>:

  :         ec              sub    $0x8,%rsp

  40033c:       e8 5b             callq  40039c <call_gmon_start>

  :       e8 da             callq   <frame_dummy>

  :       e8 d5             callq   <__do_global_ctors_aux>

  40034b:         c4              add    $0x8,%rsp

  40034f:       c3                      retq

Disassembly of section .plt:

 <__libc_start_main@plt-0x10>:

  :       ff  d2          pushq  (%rip)        #  <_GLOBAL_OFFSET_TABLE_+0x8>

  :       ff  d4          jmpq   *(%rip)        #  <_GLOBAL_OFFSET_TABLE_+0x10>

  40035c:       0f 1f               nopl   0x0(%rax)

 <__libc_start_main@plt>:

  :       ff  d2          jmpq   *(%rip)        #  <_GLOBAL_OFFSET_TABLE_+0x18>

  :                     pushq  $0x0

  40036b:       e9 e0 ff ff ff          jmpq    <_init+0x18>

Disassembly of section .text:

 <_start>:

  :        ed                   xor    %ebp,%ebp

  :         d1                mov    %rdx,%r9

  :       5e                      pop    %rsi

  :         e2                mov    %rsp,%rdx

  :         e4 f0             and    $0xfffffffffffffff0,%rsp

  40037d:                             push   %rax

  40037e:                             push   %rsp

  40037f:        c7 c0        mov    $0x400480,%r8

  :        c7 c1        mov    $0x400490,%rcx

  40038d:        c7 c7        mov    $0x400459,%rdi

  :       e8 c7 ff ff ff          callq   <__libc_start_main@plt>

  :       f4                      hlt0039a:                             nop0039b:                             nop    

000000000040039c <call_gmon_start>:

  40039c:         ec              sub    $0x8,%rsp

  4003a0:        8b         mov    (%rip),%rax        #  <_DYNAMIC+0x190>

  4003a7:         c0                test   %rax,%rax

  4003aa:                           je     4003ae <call_gmon_start+0x12>

  4003ac:       ff d0                   callq  *%rax

  4003ae:         c4              add    $0x8,%rsp

  4003b2:       c3                      retq

  4003b3:                             nop003b4:                             nop003b5:                             nop003b6:                             nop003b7:                             nop003b8:                             nop003b9:                             nop003ba:                             nop003bb:                             nop003bc:                             nop003bd:                             nop003be:                             nop003bf:                             nop    

00000000004003c0 <__do_global_dtors_aux>:

  4003c0:                             push   %rbp

  4003c1:         e5                mov    %rsp,%rbp

  4003c4:                             push   %rbx

  4003c5:         ec              sub    $0x8,%rsp

  4003c9:        3d         cmpb   $0x0,(%rip)        #  <completed.>

  4003d0:                           jne     <__do_global_dtors_aux+0x56>

  4003d2:       b8              mov    $0x600678,%eax

  4003d7:        2d           sub    $0x600670,%rax

  4003dd:        c1 f8              sar    $0x3,%rax

  4003e1:        8d  ff             lea    0xffffffffffffffff(%rax),%rbx

  4003e5:        8b  5c       mov    (%rip),%rax        #  <dtor_idx.>

  4003ec:         c3                cmp    %rax,%rbx

  4003ef:        1e                   jbe    40040f <__do_global_dtors_aux+0x4f>

  4003f1:         c0              add    $0x1,%rax

  4003f5:          4c       mov    %rax,(%rip)        #  <dtor_idx.>

  4003fc:       ff  c5        callq  *0x600670(,%rax,)

  :        8b  3e       mov    (%rip),%rax        #  <dtor_idx.>

  40040a:         c3                cmp    %rax,%rbx

  40040d:        e2                   ja     4003f1 <__do_global_dtors_aux+0x31>

  40040f:       c6  3a        movb   $0x1,(%rip)        #  <completed.>

  :         c4              add    $0x8,%rsp

  40041a:       5b                      pop    %rbx

  40041b:       c9                      leaveq

  40041c:       c3                      retq

  40041d:       0f 1f                 nopl   (%rax)

 <frame_dummy>:

  :                             push   %rbp

  :         3d        cmpq   $0x0,(%rip)        #  <__JCR_END__>

  :

  :         e5                mov    %rsp,%rbp

  40042c:                           je      <frame_dummy+0x24>

  40042e:       b8              mov    $0x0,%eax

  :         c0                test   %rax,%rax

  :        0c                   je      <frame_dummy+0x24>

  :       bf              mov    $0x600680,%edi

  40043d:         c3                mov    %rax,%r11

  :       c9                      leaveq

  :        ff e3                jmpq   *%r11

  :       c9                      leaveq

  :       c3                      retq

  :                             nop

  :                             nop    

 <func>:

  :                             push   %rbp

  :         e5                mov    %rsp,%rbp

  40044c:         7d f8             mov    %rdi,0xfffffffffffffff8(%rbp)

  :        8b  f8             mov    0xfffffffffffffff8(%rbp),%rax

  :       c6                  movb   $0x70,(%rax)

  :       c9                      leaveq

  :       c3                      retq   

 <main>:

  :                             push   %rbp

  40045a:         e5                mov    %rsp,%rbp

  40045d:         ec              sub    $0x20,%rsp

  :        7d ec                mov    %edi,0xffffffffffffffec(%rbp)

  :          e0             mov    %rsi,0xffffffffffffffe0(%rbp)

  :        c7  f8       movq   $0x0,0xfffffffffffffff8(%rbp)

  40046f:

  :        8b 7d f8             mov    0xfffffffffffffff8(%rbp),%rdi

  :       e8 cf ff ff ff          callq   <func>

  :       b8              mov    $0x0,%eax

  40047e:       c9                      leaveq

  40047f:       c3                      retq   

 <__libc_csu_fini>:

  :       f3 c3                   repz retq

  :       0f 1f         nopl   0x0(%rax)

  :       0f 1f         nopl   0x0(%rax)

 <__libc_csu_init>:

  :       4c    e0          mov    %r12,0xffffffffffffffe0(%rsp)

  :       4c  6c  e8          mov    %r13,0xffffffffffffffe8(%rsp)

  40049a:       4c 8d  bb       lea    (%rip),%r12        # 60065c <__fini_array_end>

  4004a1:       4c    f0          mov    %r14,0xfffffffffffffff0(%rsp)

  4004a6:       4c  7c  f8          mov    %r15,0xfffffffffffffff8(%rsp)

  4004ab:         f6                mov    %rsi,%r14

  4004ae:         5c  d0          mov    %rbx,0xffffffffffffffd0(%rsp)

  4004b3:         6c  d8          mov    %rbp,0xffffffffffffffd8(%rsp)

  4004b8:         ec              sub    $0x38,%rsp

  4004bc:         ff                mov    %edi,%r15d

  4004bf:         d5                mov    %rdx,%r13

  4004c2:       e8  fe ff ff          callq   <_init>

  4004c7:        8d  8e       lea    (%rip),%rax        # 60065c <__fini_array_end>

  4004ce:         c4                sub    %rax,%r12

  4004d1:        c1 fc              sar    $0x3,%r12

  4004d5:       4d  e4                test   %r12,%r12

  4004d8:        1e                   je     4004f8 <__libc_csu_init+0x68>

  4004da:        ed                   xor    %ebp,%ebp

  4004dc:         c3                mov    %rax,%rbx

  4004df:                             nop004e0:         c5              add    $0x1,%rbp

  4004e4:       4c  ea                mov    %r13,%rdx

  4004e7:       4c  f6                mov    %r14,%rsi

  4004ea:         ff                mov    %r15d,%edi

  4004ed:       ff                    callq  *(%rbx)

  4004ef:         c3              add    $0x8,%rbx

  4004f3:         ec                cmp    %rbp,%r12

  4004f6:        e8                   jne    4004e0 <__libc_csu_init+0x50>

  4004f8:        8b 5c            mov    0x8(%rsp),%rbx

  4004fd:        8b 6c            mov    0x10(%rsp),%rbp

  :       4c 8b             mov    0x18(%rsp),%r12

  :       4c 8b 6c            mov    0x20(%rsp),%r13

  40050c:       4c 8b             mov    0x28(%rsp),%r14

  :       4c 8b 7c            mov    0x30(%rsp),%r15

  :         c4              add    $0x38,%rsp

  40051a:       c3                      retq

  40051b:                             nop0051c:                             nop0051d:                             nop0051e:                             nop0051f:                             nop    

 <__do_global_ctors_aux>:

  :                             push   %rbp

  :         e5                mov    %rsp,%rbp

  :                             push   %rbx

  :       bb              mov    $0x600660,%ebx

  40052a:         ec              sub    $0x8,%rsp

  40052e:        8b  2b       mov    (%rip),%rax        #  <__CTOR_LIST__>

  :         f8 ff             cmp    $0xffffffffffffffff,%rax

  :                           je     40054f <__do_global_ctors_aux+0x2f>

  40053b:       0f 1f             nopl   0x0(%rax,%rax,)

  :         eb              sub    $0x8,%rbx

  :       ff d0                   callq  *%rax

  :        8b                 mov    (%rbx),%rax

  :         f8 ff             cmp    $0xffffffffffffffff,%rax

  40054d:        f1                   jne     <__do_global_ctors_aux+0x20>

  40054f:         c4              add    $0x8,%rsp

  :       5b                      pop    %rbx

  :       c9                      leaveq

  :       c3                      retq

  :                             nop

  :                             nop

Disassembly of section .fini:

 <_fini>:

  :         ec              sub    $0x8,%rsp

  40055c:       e8 5f fe ff ff          callq  4003c0 <__do_global_dtors_aux>

  :         c4              add    $0x8,%rsp

  :       c3                      retq   


[root@localhost log]# objdump -d /root/xx |grep -C5

 <func>:

  :                             push   %rbp

  :         e5                mov    %rsp,%rbp

  40044c:         7d f8             mov    %rdi,0xfffffffffffffff8(%rbp)

  :        8b  f8             mov    0xfffffffffffffff8(%rbp),%rax

  400454:       c6                  movb   $0x70,(%rax)

  :       c9                      leaveq

  :       c3                      retq   

 <main>:

  :                             push   %rbp
Usage: addr2line [option(s)] [addr(s)]

 Convert addresses into line number/file name pairs.

 If no addresses are specified on the command line, they will be read from stdin

 The options are:

  @<file>                Read options from <file>

  -b --target=<bfdname>  Set the binary file format

  -e --exe=<executable>  Set the input file name (default is a.out)

  -i --inlines           Unwind inlined functions

  -j --section=<name>    Read section-relative offsets instead of addresses

  -s --basenames         Strip directory names

  -f --functions         Show function names

  -C --demangle[=style]  Demangle function names

  -h --help              Display this information

  -v --version           Display the program's version

[root@localhost log]# addr2line -e /root/xx 0x400454

/root/xx.c:7
gdb调试：

[root@localhost ~]# gdb ./xx

GNU gdb (GDB) .

Copyright (C)  Free Software Foundation, Inc.

License GPLv3+: GNU GPL version  or later <http://gnu.org/licenses/gpl.html>

This is free software: you are free to change and redistribute it.

There is NO WARRANTY, to the extent permitted by law.  Type "show copying"

and "show warranty" for details.

This GDB was configured as "x86_64-unknown-linux-gnu".

Type "show configuration" for configuration details.

For bug reporting instructions, please see:

<http://www.gnu.org/software/gdb/bugs/>.

Find the GDB manual and other documentation resources online at:

<http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".

Type "apropos word" to search for commands related to "word"...

Reading symbols from ./xx...done.

(gdb) disas 0x400454

Dump of assembler code for function func:

   0x0000000000400448 <+>:     push   %rbp

   0x0000000000400449 <+>:     mov    %rsp,%rbp

   0x000000000040044c <+>:     mov    %rdi,-0x8(%rbp)

   0x0000000000400450 <+>:     mov    -0x8(%rbp),%rax

   0x0000000000400454 <+>:    movb   $0x70,(%rax)

   0x0000000000400457 <+>:    leaveq

   0x0000000000400458 <+>:    retq

End of assembler dump.

(gdb) list func

       #include <stdio.h>

       void func(char *p)

       {

       *p = 'p';

       }

      int main(int argc, char *argv[])








 




相关文章