逆向工程 - GDB - eu-unstrip

一般Release給客戶的檔案都是移掉Debug資訊的檔案，不過，在編譯Release檔案時，通常會額外編譯一份具有Debug Symbol的檔案，而在Debug時，雖然可以在GDB動態載入Debug Symbol，不過，還是不方便，其實elfutils提供一個好用的工具eu-unstrip，它可以把Debug Symbol塞回原本ELF檔案

main.c

#include <stdio.h>
 
int main(int argc, char** argv)
{
    printf("testing\n");
    return 0;
}

編譯

$ gcc main.c -o main
$ gcc main.c -ggdb -o main.debug

模擬Release Build

$ strip main
$ file main
    main: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=44edbb6ef58938fde04de6b6943a640edeb37b77, stripped

Unstrip

$ eu-unstrip main main.debug
$ mv main.debug main
$ file main
    main: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=44edbb6ef58938fde04de6b6943a640edeb37b77, with debug_info, not stripped

Debug

$ gdb main
    GNU gdb (Debian 8.2.1-2+b3) 8.2.1
    Copyright (C) 2018 Free Software Foundation, Inc.
    License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
    This is free software: you are free to change and redistribute it.
    There is NO WARRANTY, to the extent permitted by law.
    Type "show copying" and "show warranty" for details.
    This GDB was configured as "x86_64-linux-gnu".
    Type "show configuration" for configuration details.
    For bug reporting instructions, please see:
    <http://www.gnu.org/software/gdb/bugs/>.
    Find the GDB manual and other documentation resources online at:
        <http://www.gnu.org/software/gdb/documentation/>.

    For help, type "help".
    Type "apropos word" to search for commands related to "word"...
    Reading symbols from main...done.

(gdb) b main
    Breakpoint 1 at 0x1114: file main.c, line 5.

(gdb) r
    Starting program: /home/steward/Downloads/main

    Program received signal SIGSEGV, Segmentation fault.
    0x0000000000000001 in ?? ()

(gdb) list
    1	#include <stdio.h>
    2
    3	int main(int argc, char** argv)
    4	{
    5	    printf("testing\n");
    6	    return 0;
    7	}