CODEWITHSUNDEEP
gdbtrace
Lucky Man
Lucky Man

Reputation: 1518

How to get the whole trace list of program with help of GDB?

I want to get a whole trace list of my program "./myprog" - I have GDB 7.0-ubuntu (The newer version for my architecture doesn't exist). My GDB-script ("./trace_list.gdb"):

gdb -q -x ./trace_list.gdb 


file ./myprog
set print address off
display/x $r0
display/x $r1
display/x $r2
display/x $r3
display/x $r4
display/x $r5
display/x $r6
display/x $r7
display/x $r8
display/x $r9
display/x $r10
display/x $r11
display/x $r12
display/x $sp
display/x $lr
display/x $fps
b *0x323d0
set logging on
run
while 1
x/i $pc
ni
end
quit

It works good for certain moment. Then writes: 

"./trace_list.gdb":26: Error in sourced command file:
Cannot access memory at address 0x6b980000

and doesn't execute further.

Why does this error occur? What should I do to get the whole trace list of my program? May be I should use other tool? I haven't any idea.

Upvotes: 0

Views: 299

Answers (1)

Employed Russian
Employed Russian

Reputation: 213526

Cannot access memory at address 0x6b980000 Why does this error occur?

The error means that GDB tried to access memory at 0x6b980000, but couldn't (it told you that much ;-)

Most likely your target processor (which processor is it?) lacks hardware single-step (or GDB doesn't know how to use it), so in order to perform ni, GDB sets a temporary breakpoint on what it thinks is the next instruction. If GDB made a mistake, or if the instruction is in memory that GDB can't write to (e.g. part of kernel), you lose.

What should I do to get the whole trace list of my program?

Whole trace is very rarely useful in practice -- there are just way too many instructions, and the overhead of single-stepping is too great. Perhaps you should abandon this approach, and use divide-and-conquer debugging instead?

Update:

"Whole trace is very rarely useful in practice" - even when the program is obfuscated?

Yes, especially if the program is obfuscated.

The program could be employing anti-debugging techniques as well. It is quite simple to make a program that behaves differently under debugger, and you may spend hours looking at whole trace that has nothing to do with actual program operation:

if (running_under_debugger()) {
  compute_one_million_digits_of_pi();
} else {
  do_something_useful();
}

Upvotes: 1

Related Questions