Android下使用GDB调试无符号ELF文件

以下以adb shell下通过gdb工具调试/system/bin/ping举例：

# /data/local/tmp/gdb --args /system/bin/ping
GNU gdb (GDB) 7.3.1-gg2
...
(gdb) info target
Symbols from "/system/bin/ping".
Local exec file:
        `/system/bin/ping', file type elf32-littlearm.
        Entry point: 0x1078
        0x00000134 - 0x00000147 is .interp
        0x00000148 - 0x00000598 is .dynsym
        0x00000598 - 0x0000081e is .dynstr
        0x00000820 - 0x00000a48 is .hash
        0x00000a48 - 0x00000bf0 is .rel.dyn
        0x00000bf0 - 0x00000db8 is .rel.plt
        0x00000db8 - 0x00001078 is .plt
        0x00001078 - 0x0000436c is .text
        0x0000436c - 0x00004384 is .note.android.ident
        0x00004384 - 0x00004454 is .ARM.exidx
        0x00004454 - 0x0000446c is .ARM.extab
        0x0000446c - 0x00005466 is .rodata
        0x00006d40 - 0x00006d48 is .preinit_array
        0x00006d48 - 0x00006d50 is .init_array
        0x00006d50 - 0x00006d58 is .fini_array
        0x00006d58 - 0x00006e50 is .dynamic
        0x00006e50 - 0x00007000 is .got
        0x00007000 - 0x000070c0 is .data
        0x000070c0 - 0x0001a1ee is .bss
(gdb) b *0x1078    // 设置断点到text段首地址
Breakpoint 1 at 0x1078
(gdb) r
Starting program: /system/bin/ping
warning: Breakpoint address adjusted from 0x40003ca5 to 0x40003ca4.
Warning:
Cannot insert breakpoint 1.
Error accessing memory address 0x1078: Input/output error.


(gdb) d 1   // 在开启了内存布局随机化的kernel中，必然出现上述异常，无视，直接删掉断点1
(gdb) info target
Symbols from "/system/bin/ping".
Unix child process:
        Using the running image of child process 9782.
        While running this, GDB does not access memory from...
Local exec file:
        `/system/bin/ping', file type elf32-littlearm.
        Entry point: 0x2a001078
        0x2a000134 - 0x2a000147 is .interp
        0x2a000148 - 0x2a000598 is .dynsym
        0x2a000598 - 0x2a00081e is .dynstr
        0x2a000820 - 0x2a000a48 is .hash
        0x2a000a48 - 0x2a000bf0 is .rel.dyn
        0x2a000bf0 - 0x2a000db8 is .rel.plt
        0x2a000db8 - 0x2a001078 is .plt
        0x2a001078 - 0x2a00436c is .text
        0x2a00436c - 0x2a004384 is .note.android.ident
        0x2a004384 - 0x2a004454 is .ARM.exidx
        0x2a004454 - 0x2a00446c is .ARM.extab
        0x2a00446c - 0x2a005466 is .rodata
        0x2a006d40 - 0x2a006d48 is .preinit_array
        0x2a006d48 - 0x2a006d50 is .init_array
        0x2a006d50 - 0x2a006d58 is .fini_array
        0x2a006d58 - 0x2a006e50 is .dynamic
        0x2a006e50 - 0x2a007000 is .got
        0x2a007000 - 0x2a0070c0 is .data
        0x2a0070c0 - 0x2a01a1ee is .bss
........

(gdb) x/32i 0x2a001078   // 查看新text段汇编指令，寻找libc_init调用
   0x2a001078:  push    {r11, lr}
   0x2a00107c:  add     r11, sp, #4
   0x2a001080:  sub     sp, sp, #16
   0x2a001084:  ldr     r3, [pc, #80]   ; 0x2a0010dc
   0x2a001088:  add     r3, pc, r3
   0x2a00108c:  ldr     r2, [pc, #76]   ; 0x2a0010e0
   0x2a001090:  ldr     r2, [r3, r2]
   0x2a001094:  str     r2, [r11, #-20]
   0x2a001098:  ldr     r2, [pc, #68]   ; 0x2a0010e4
   0x2a00109c:  ldr     r2, [r3, r2]
   0x2a0010a0:  str     r2, [r11, #-16]
   0x2a0010a4:  ldr     r2, [pc, #60]   ; 0x2a0010e8
   0x2a0010a8:  ldr     r2, [r3, r2]
   0x2a0010ac:  str     r2, [r11, #-12]
   0x2a0010b0:  mov     r2, r11
   0x2a0010b4:  add     r2, r2, #4
   0x2a0010b8:  str     r2, [r11, #-8]
   0x2a0010bc:  sub     r12, r11, #20
   0x2a0010c0:  ldr     r0, [r11, #-8]
   0x2a0010c4:  mov     r1, #0
   0x2a0010c8:  ldr     r2, [pc, #28]   ; 0x2a0010ec
   0x2a0010cc:  ldr     r3, [r3, r2]
   0x2a0010d0:  mov     r2, r3
   0x2a0010d4:  mov     r3, r12
   0x2a0010d8:  bl      0x2a000dcc   （参见附注，r2即为main函数）
   0x2a0010dc:  andeq   r5, r0, r0, lsl #29
   0x2a0010e0:                  ; <UNDEFINED> instruction: 0xffffff40
   0x2a0010e4:                  ; <UNDEFINED> instruction: 0xffffff44
   0x2a0010e8:                  ; <UNDEFINED> instruction: 0xffffff48
   0x2a0010ec:                  ; <UNDEFINED> instruction: 0xffffff4c
   0x2a0010f0:  push    {r11, lr}
   0x2a0010f4:  add     r11, sp, #4
(gdb) b *0x2a0010d8
Breakpoint 2 at 0x2a0010d8
(gdb) c
Continuing.


Breakpoint 2, 0x2a0010d8 in ?? ()
(gdb) p/x $r2     // 查看main函数地址
$1 = 0x2a0017c9
(gdb) b *0x2a0017c9  //main函数上下断点，此时libc.so已加载，还可以b open/fputs/exit ...
warning: Breakpoint address adjusted from 0x2a0017c9 to 0x2a0017c8.
Breakpoint 3 at 0x2a0017c8
(gdb) c
Continuing.
warning: Breakpoint 3 address previously adjusted from 0x2a0017c9 to 0x2a0017c8.


Breakpoint 3, 0x2a0017c8 in ?? ()
(gdb) display /4i $pc
1: x/4i $pc
=> 0x2a0017c8:  stmdb   sp!, {r4, r5, r6, r7, r8, r9, r10, r11, lr}
   0x2a0017cc:  ldr.w   r4, [pc, #2600] ; 0x2a0021f8
   0x2a0017d0:  ldr.w   r3, [pc, #2600] ; 0x2a0021fc
   0x2a0017d4:  add     r4, pc
(gdb) ni
0x2a0017cc in ?? ()
1: x/4i $pc
=> 0x2a0017cc:  ldr.w   r4, [pc, #2600] ; 0x2a0021f8
   0x2a0017d0:  ldr.w   r3, [pc, #2600] ; 0x2a0021fc
   0x2a0017d4:  add     r4, pc
   0x2a0017d6:  mov     r6, r0
(gdb)
0x2a0017d0 in ?? ()
1: x/4i $pc
=> 0x2a0017d0:  ldr.w   r3, [pc, #2600] ; 0x2a0021fc
   0x2a0017d4:  add     r4, pc
   0x2a0017d6:  mov     r6, r0
   0x2a0017d8:  ldr     r0, [r4, r3]
(gdb)

....

附注：

ELF可执行文件入口，__libc_init第3个参数即为main：

bionic\libc\arch-arm\bionic\crtbegin.c

__LIBC_HIDDEN__ void _start() {
......
  void* raw_args = (void*) ((uintptr_t) __builtin_frame_address(0) + sizeof(void*));
  __libc_init(raw_args, NULL, &main, &array);
}

gdb采用的是Android toolchain中的gdb7.3.1-gg2源码编译生成，编译工具使用codesourcery的arm-none-linux-gnueabi。