Debugging GDB断点命中时未还原指令

背景

我正在使用

gdb

和

gdbserver

（gdbversion7.11）调试一个Android（ARM）应用程序。我的主机

gdb

运行在windows10上，而经过调试的安卓系统是三星galaxyj7，通过USB连接

主机和目标连接良好，

gdb

似乎工作正常。我能够在目标/调试的应用程序中的某个位置设置断点，并使断点被命中

问题

当遇到断点时，会观察到以下问题：

• 断点地址处的ARM指令读取的是

  udf#16

  ，而不是原始指令。
  • ARM

    udf

    指令是一个“”，它似乎用于实现断点捕获内部机制。执行

    udf#16

    指令时，抛出调试器拾取的陷阱信号
• 当遇到断点时，调试器应始终还原原始指令。我的系统上没有发生这种情况
• 执行

  ni

  （下一条指令）命令会反复执行

  udf#16

  指令
• 删除断点不会还原原始指令。相反，

  udf#16

  指令保留在内存中
• 将$pc寄存器增加四（4）只会跳过原本应该存在的原始指令
• 删除所有断点并继续gdb只需反复点击

  udf#16

  命令

以下是命中断点前的说明：

(gdb) x/3i 0xd04dc520
0xd04dc520:  mov     r0, r4
0xd04dc524:  bl      0xd04d7af4 <avio_rb32>
0xd04dc528:  ldr     r6, [sp, #40]   ; 0x28

 (gdb) x/3i 0xd04dc520
 0xd04dc520:  udf     #16
 0xd04dc524:  bl      0xd04d7af4 <avio_rb32>
 0xd04dc528:  ldr     r6, [sp, #40]   ; 0x28

第2-8行：GDB版本为7.11，为x86_64-w64-mingw32配置

第16-21行：处理SIG33和SIGSEGV信号

第31-33行：确定libFFmpeg共享对象的加载地址。文本段（0xd04b2f80）。这允许我计算所需的精确指令断点地址（0xd04dc520）

第35-38行：在预期断点地址处及其后转储指令

第39行：在0xd04dc520处设置断点1

第41-44行：设置断点后，在预期断点地址处和之后转储指令

第48行：继续执行

第50-68行：执行继续，与设备的交互导致断点被命中

第69行：断点1被命中

第70-73行：列出断点地址处的指令。该指令最初是

mov r0，r4

，现在是

udf#16

第74-80行：执行

ni

命令将$pc保持在同一位置，

udf#16

将我们完全困住

第81-89行：多个

ni

将我们保持在同一位置

第90-93行：

continue

命令同样让我们陷入困境

第94-102行：删除所有断点不会恢复指令，

continue

命令会命中未恢复的

udf#16

---

以下是一些相关的gdb可设置参数：

architecture:  The target architecture is set automatically (currently arm)
arm abi:  The current ARM ABI is "auto" (currently "AAPCS").
arm apcs32:  Usage of ARM 32-bit mode is on.
arm disassembler:  The disassembly style is "std".
arm fallback-mode:  The current execution mode assumed (when symbols are unavailable) is "auto".
arm force-mode:  The current execution mode assumed (even when symbols are available) is "auto".
arm fpu:  The current ARM floating point model is "auto".
auto-connect-native-target:  Whether GDB may automatically connect to the native target is on.
auto-load gdb-scripts:  Auto-loading of canned sequences of commands scripts is on.
auto-load local-gdbinit:  Auto-loading of .gdbinit script from current directory is on.
auto-load python-scripts:  Auto-loading of Python scripts is on.
auto-load safe-path:  List of directories from which it is safe to auto-load files is $debugdir:$datadir/auto-load.
auto-load scripts-directory:  List of directories from which to load auto-loaded scripts is $debugdir:$datadir/auto-load.
auto-load-scripts:  Auto-loading of Python scripts is on.
auto-solib-add:  Autoloading of shared library symbols is on.
breakpoint always-inserted:  Always inserted breakpoint mode is off.
breakpoint auto-hw:  Automatic usage of hardware breakpoints is on.
breakpoint condition-evaluation:  Breakpoint condition evaluation mode is auto (currently host).
breakpoint pending:  Debugger's behavior regarding pending breakpoints is auto.
can-use-hw-watchpoints:  Debugger's willingness to use watchpoint hardware is 1.
debug aarch64:  AArch64 debugging is off.
debug arch:  Architecture debugging is 0.
debug arm:  ARM debugging is off.
disassemble-next-line:  Debugger's willingness to use disassemble-next-line is off.
disassembly-flavor:  The disassembly flavor is "att".
osabi:  The current OS ABI is "auto" (currently "Cygwin").
The default OS ABI is "Cygwin".remote breakpoint-commands-packet:  Support for the `BreakpointCommands' packet is auto-detected, currently unknown.
remote btrace-conf-bts-size-packet:  Support for the `Qbtrace-conf:bts:size' packet is auto-detected, currently unknown.
remote btrace-conf-pt-size-packet:  Support for the `Qbtrace-conf:pt:size' packet is auto-detected, currently unknown.
remote catch-syscalls-packet:  Support for the `QCatchSyscalls' packet is auto-detected, currently unknown.
remote conditional-breakpoints-packet:  Support for the `ConditionalBreakpoints' packet is auto-detected, currently unknown.
remote conditional-tracepoints-packet:  Support for the `ConditionalTracepoints' packet is auto-detected, currently unknown.
remote ctrl-c-packet:  Support for the `vCtrlC' packet is auto-detected, currently unknown.
remote disable-btrace-packet:  Support for the `Qbtrace:off' packet is auto-detected, currently unknown.
remote disable-randomization-packet:  Support for the `QDisableRandomization' packet is auto-detected, currently unknown.
remote enable-btrace-bts-packet:  Support for the `Qbtrace:bts' packet is auto-detected, currently unknown.
remote enable-btrace-pt-packet:  Support for the `Qbtrace:pt' packet is auto-detected, currently unknown.
remote exec-event-feature-packet:  Support for the `exec-event-feature' packet is auto-detected, currently unknown.
remote exec-file:  (null)
remote fast-tracepoints-packet:  Support for the `FastTracepoints' packet is auto-detected, currently unknown.
remote fetch-register-packet:  Support for the `p' packet is auto-detected, currently unknown.
remote fork-event-feature-packet:  Support for the `fork-event-feature' packet is auto-detected, currently unknown.
remote get-thread-information-block-address-packet:  Support for the `qGetTIBAddr' packet is auto-detected, currently unknown.
remote get-thread-local-storage-address-packet:  Support for the `qGetTLSAddr' packet is auto-detected, currently unknown.
remote hardware-breakpoint-limit:  The maximum number of target hardware breakpoints is -1.
remote hardware-breakpoint-packet:  Support for the `Z1' packet is auto-detected, currently unknown.
remote hardware-watchpoint-length-limit:  The maximum length (in bytes) of a target hardware watchpoint is -1.
remote hardware-watchpoint-limit:  The maximum number of target hardware watchpoints is -1.
remote hostio-close-packet:  Support for the `vFile:close' packet is auto-detected, currently unknown.
remote hostio-fstat-packet:  Support for the `vFile:fstat' packet is auto-detected, currently unknown.
remote hostio-open-packet:  Support for the `vFile:open' packet is auto-detected, currently unknown.
remote hostio-pread-packet:  Support for the `vFile:pread' packet is auto-detected, currently unknown.
remote hostio-pwrite-packet:  Support for the `vFile:pwrite' packet is auto-detected, currently unknown.
remote hostio-readlink-packet:  Support for the `vFile:readlink' packet is auto-detected, currently unknown.
remote hostio-setfs-packet:  Support for the `vFile:setfs' packet is auto-detected, currently unknown.
remote hostio-unlink-packet:  Support for the `vFile:unlink' packet is auto-detected, currently unknown.
remote hwbreak-feature-packet:  Support for the `hwbreak-feature' packet is auto-detected, currently unknown.
remote install-in-trace-packet:  Support for the `InstallInTrace' packet is auto-detected, currently unknown.
remote interrupt-on-connect:  W whether interrupt-sequence is sent to remote target when gdb connects to is off.
remote interrupt-sequence:  Send the ASCII ETX character (Ctrl-c) to the remote target to interrupt the execution of the program.
remote kill-packet:  Support for the `vKill' packet is auto-detected, currently unknown.
remote library-info-packet:  Support for the `qXfer:libraries:read' packet is auto-detected, currently unknown.
remote library-info-svr4-packet:  Support for the `qXfer:libraries-svr4:read' packet is auto-detected, currently unknown.
remote memory-map-packet:  Support for the `qXfer:memory-map:read' packet is auto-detected, currently unknown.
remote memory-read-packet-size:  The memory-read-packet-size is 0. Packets are limited to 648 bytes.
remote memory-write-packet-size:  The memory-write-packet-size is 0. Packets are limited to 648 bytes.
remote multiprocess-feature-packet:  Support for the `multiprocess-feature' packet is auto-detected, currently unknown.
remote no-resumed-stop-reply-packet:  Support for the `N stop reply' packet is auto-detected, currently unknown.
remote noack-packet:  Support for the `QStartNoAckMode' packet is auto-detected, currently unknown.
remote osdata-packet:  Support for the `qXfer:osdata:read' packet is auto-detected, currently unknown.
remote p-packet:  remote pass-signals-packet:  Support for the `QPassSignals' packet is auto-detected, currently unknown.
remote pid-to-exec-file-packet:  Support for the `qXfer:exec-file:read' packet is auto-detected, currently unknown.
remote program-signals-packet:  Support for the `QProgramSignals' packet is auto-detected, currently unknown.
remote query-attached-packet:  Support for the `qAttached' packet is auto-detected, currently unknown.
remote read-aux-vector-packet:  Support for the `qXfer:auxv:read' packet is auto-detected, currently unknown.
remote read-btrace-conf-packet:  Support for the `qXfer:btrace-conf' packet is auto-detected, currently unknown.
remote read-btrace-packet:  Support for the `qXfer:btrace' packet is auto-detected, currently unknown.
remote read-fdpic-loadmap-packet:  Support for the `qXfer:fdpic:read' packet is auto-detected, currently unknown.
remote read-sdata-object-packet:  Support for the `qXfer:statictrace:read' packet is auto-detected, currently unknown.
remote read-siginfo-object-packet:  Support for the `qXfer:siginfo:read' packet is auto-detected, currently unknown.
remote read-spu-object-packet:  Support for the `qXfer:spu:read' packet is auto-detected, currently unknown.
remote read-watchpoint-packet:  Support for the `Z3' packet is auto-detected, currently unknown.
remote reverse-continue-packet:  Support for the `bc' packet is auto-detected, currently unknown.
remote reverse-step-packet:  Support for the `bs' packet is auto-detected, currently unknown.
remote run-packet:  Support for the `vRun' packet is auto-detected, currently unknown.
remote search-memory-packet:  Support for the `qSearch:memory' packet is auto-detected, currently unknown.
remote set-register-packet:  Support for the `P' packet is auto-detected, currently unknown.
remote software-breakpoint-packet:  Support for the `Z0' packet is auto-detected, currently unknown.
remote static-tracepoints-packet:  Support for the `StaticTracepoints' packet is auto-detected, currently unknown.
remote supported-packets-packet:  Support for the `qSupported' packet is auto-detected, currently unknown.
remote swbreak-feature-packet:  Support for the `swbreak-feature' packet is auto-detected, currently unknown.
remote symbol-lookup-packet:  Support for the `qSymbol' packet is auto-detected, currently unknown.
remote system-call-allowed:  Calling host system(3) call from target is not allowed
remote target-features-packet:  Support for the `qXfer:features:read' packet is auto-detected, currently unknown.
remote thread-events-packet:  Support for the `QThreadEvents' packet is auto-detected, currently unknown.
remote threads-packet:  Support for the `qXfer:threads:read' packet is auto-detected, currently unknown.
remote trace-buffer-size-packet:  Support for the `QTBuffer:size' packet is auto-detected, currently unknown.
remote trace-status-packet:  Support for the `qTStatus' packet is auto-detected, currently unknown.
remote traceframe-info-packet:  Support for the `qXfer:traceframe-info:read' packet is auto-detected, currently unknown.
remote unwind-info-block-packet:  Support for the `qXfer:uib:read' packet is auto-detected, currently unknown.
remote verbose-resume-packet:  Support for the `vCont' packet is auto-detected, currently unknown.
remote verbose-resume-supported-packet:  Support for the `vContSupported' packet is auto-detected, currently unknown.
remote vfork-event-feature-packet:  Support for the `vfork-event-feature' packet is auto-detected, currently unknown.
remote write-siginfo-object-packet:  Support for the `qXfer:siginfo:write' packet is auto-detected, currently unknown.
remote write-spu-object-packet:  Support for the `qXfer:spu:write' packet is auto-detected, currently unknown.
remote write-watchpoint-packet:  Support for the `Z2' packet is auto-detected, currently unknown.
remoteaddresssize:  The maximum size of the address (in bits) in a memory packet is 0.
remotebreak:  remotecache:  Deprecated remotecache flag is off.
step-mode:  Mode of the step operation is off.

问题

---

为什么gdb调试器无法执行最简单和最关键的调试器操作之一，即在遇到断点时还原指令？

遇到同样的问题，您是否找到了解决方案？我从未解决过这个问题。最后，我转而使用Frida dynamic instrumentation开放源码项目，这是一个非常棒的项目，强烈推荐。您可能想阅读Chris Coulson的博客条目“调试调试器”（）。它记录了当设置断点时他的ARM二进制文件是如何崩溃的。崩溃是由于拇指模式下的UDF（“未定义”）指令造成的。你可能会从那篇博客文章中收集到一些想法——祝你好运。请务必发布您发现的任何解决方案！

architecture:  The target architecture is set automatically (currently arm)
arm abi:  The current ARM ABI is "auto" (currently "AAPCS").
arm apcs32:  Usage of ARM 32-bit mode is on.
arm disassembler:  The disassembly style is "std".
arm fallback-mode:  The current execution mode assumed (when symbols are unavailable) is "auto".
arm force-mode:  The current execution mode assumed (even when symbols are available) is "auto".
arm fpu:  The current ARM floating point model is "auto".
auto-connect-native-target:  Whether GDB may automatically connect to the native target is on.
auto-load gdb-scripts:  Auto-loading of canned sequences of commands scripts is on.
auto-load local-gdbinit:  Auto-loading of .gdbinit script from current directory is on.
auto-load python-scripts:  Auto-loading of Python scripts is on.
auto-load safe-path:  List of directories from which it is safe to auto-load files is $debugdir:$datadir/auto-load.
auto-load scripts-directory:  List of directories from which to load auto-loaded scripts is $debugdir:$datadir/auto-load.
auto-load-scripts:  Auto-loading of Python scripts is on.
auto-solib-add:  Autoloading of shared library symbols is on.
breakpoint always-inserted:  Always inserted breakpoint mode is off.
breakpoint auto-hw:  Automatic usage of hardware breakpoints is on.
breakpoint condition-evaluation:  Breakpoint condition evaluation mode is auto (currently host).
breakpoint pending:  Debugger's behavior regarding pending breakpoints is auto.
can-use-hw-watchpoints:  Debugger's willingness to use watchpoint hardware is 1.
debug aarch64:  AArch64 debugging is off.
debug arch:  Architecture debugging is 0.
debug arm:  ARM debugging is off.
disassemble-next-line:  Debugger's willingness to use disassemble-next-line is off.
disassembly-flavor:  The disassembly flavor is "att".
osabi:  The current OS ABI is "auto" (currently "Cygwin").
The default OS ABI is "Cygwin".remote breakpoint-commands-packet:  Support for the `BreakpointCommands' packet is auto-detected, currently unknown.
remote btrace-conf-bts-size-packet:  Support for the `Qbtrace-conf:bts:size' packet is auto-detected, currently unknown.
remote btrace-conf-pt-size-packet:  Support for the `Qbtrace-conf:pt:size' packet is auto-detected, currently unknown.
remote catch-syscalls-packet:  Support for the `QCatchSyscalls' packet is auto-detected, currently unknown.
remote conditional-breakpoints-packet:  Support for the `ConditionalBreakpoints' packet is auto-detected, currently unknown.
remote conditional-tracepoints-packet:  Support for the `ConditionalTracepoints' packet is auto-detected, currently unknown.
remote ctrl-c-packet:  Support for the `vCtrlC' packet is auto-detected, currently unknown.
remote disable-btrace-packet:  Support for the `Qbtrace:off' packet is auto-detected, currently unknown.
remote disable-randomization-packet:  Support for the `QDisableRandomization' packet is auto-detected, currently unknown.
remote enable-btrace-bts-packet:  Support for the `Qbtrace:bts' packet is auto-detected, currently unknown.
remote enable-btrace-pt-packet:  Support for the `Qbtrace:pt' packet is auto-detected, currently unknown.
remote exec-event-feature-packet:  Support for the `exec-event-feature' packet is auto-detected, currently unknown.
remote exec-file:  (null)
remote fast-tracepoints-packet:  Support for the `FastTracepoints' packet is auto-detected, currently unknown.
remote fetch-register-packet:  Support for the `p' packet is auto-detected, currently unknown.
remote fork-event-feature-packet:  Support for the `fork-event-feature' packet is auto-detected, currently unknown.
remote get-thread-information-block-address-packet:  Support for the `qGetTIBAddr' packet is auto-detected, currently unknown.
remote get-thread-local-storage-address-packet:  Support for the `qGetTLSAddr' packet is auto-detected, currently unknown.
remote hardware-breakpoint-limit:  The maximum number of target hardware breakpoints is -1.
remote hardware-breakpoint-packet:  Support for the `Z1' packet is auto-detected, currently unknown.
remote hardware-watchpoint-length-limit:  The maximum length (in bytes) of a target hardware watchpoint is -1.
remote hardware-watchpoint-limit:  The maximum number of target hardware watchpoints is -1.
remote hostio-close-packet:  Support for the `vFile:close' packet is auto-detected, currently unknown.
remote hostio-fstat-packet:  Support for the `vFile:fstat' packet is auto-detected, currently unknown.
remote hostio-open-packet:  Support for the `vFile:open' packet is auto-detected, currently unknown.
remote hostio-pread-packet:  Support for the `vFile:pread' packet is auto-detected, currently unknown.
remote hostio-pwrite-packet:  Support for the `vFile:pwrite' packet is auto-detected, currently unknown.
remote hostio-readlink-packet:  Support for the `vFile:readlink' packet is auto-detected, currently unknown.
remote hostio-setfs-packet:  Support for the `vFile:setfs' packet is auto-detected, currently unknown.
remote hostio-unlink-packet:  Support for the `vFile:unlink' packet is auto-detected, currently unknown.
remote hwbreak-feature-packet:  Support for the `hwbreak-feature' packet is auto-detected, currently unknown.
remote install-in-trace-packet:  Support for the `InstallInTrace' packet is auto-detected, currently unknown.
remote interrupt-on-connect:  W whether interrupt-sequence is sent to remote target when gdb connects to is off.
remote interrupt-sequence:  Send the ASCII ETX character (Ctrl-c) to the remote target to interrupt the execution of the program.
remote kill-packet:  Support for the `vKill' packet is auto-detected, currently unknown.
remote library-info-packet:  Support for the `qXfer:libraries:read' packet is auto-detected, currently unknown.
remote library-info-svr4-packet:  Support for the `qXfer:libraries-svr4:read' packet is auto-detected, currently unknown.
remote memory-map-packet:  Support for the `qXfer:memory-map:read' packet is auto-detected, currently unknown.
remote memory-read-packet-size:  The memory-read-packet-size is 0. Packets are limited to 648 bytes.
remote memory-write-packet-size:  The memory-write-packet-size is 0. Packets are limited to 648 bytes.
remote multiprocess-feature-packet:  Support for the `multiprocess-feature' packet is auto-detected, currently unknown.
remote no-resumed-stop-reply-packet:  Support for the `N stop reply' packet is auto-detected, currently unknown.
remote noack-packet:  Support for the `QStartNoAckMode' packet is auto-detected, currently unknown.
remote osdata-packet:  Support for the `qXfer:osdata:read' packet is auto-detected, currently unknown.
remote p-packet:  remote pass-signals-packet:  Support for the `QPassSignals' packet is auto-detected, currently unknown.
remote pid-to-exec-file-packet:  Support for the `qXfer:exec-file:read' packet is auto-detected, currently unknown.
remote program-signals-packet:  Support for the `QProgramSignals' packet is auto-detected, currently unknown.
remote query-attached-packet:  Support for the `qAttached' packet is auto-detected, currently unknown.
remote read-aux-vector-packet:  Support for the `qXfer:auxv:read' packet is auto-detected, currently unknown.
remote read-btrace-conf-packet:  Support for the `qXfer:btrace-conf' packet is auto-detected, currently unknown.
remote read-btrace-packet:  Support for the `qXfer:btrace' packet is auto-detected, currently unknown.
remote read-fdpic-loadmap-packet:  Support for the `qXfer:fdpic:read' packet is auto-detected, currently unknown.
remote read-sdata-object-packet:  Support for the `qXfer:statictrace:read' packet is auto-detected, currently unknown.
remote read-siginfo-object-packet:  Support for the `qXfer:siginfo:read' packet is auto-detected, currently unknown.
remote read-spu-object-packet:  Support for the `qXfer:spu:read' packet is auto-detected, currently unknown.
remote read-watchpoint-packet:  Support for the `Z3' packet is auto-detected, currently unknown.
remote reverse-continue-packet:  Support for the `bc' packet is auto-detected, currently unknown.
remote reverse-step-packet:  Support for the `bs' packet is auto-detected, currently unknown.
remote run-packet:  Support for the `vRun' packet is auto-detected, currently unknown.
remote search-memory-packet:  Support for the `qSearch:memory' packet is auto-detected, currently unknown.
remote set-register-packet:  Support for the `P' packet is auto-detected, currently unknown.
remote software-breakpoint-packet:  Support for the `Z0' packet is auto-detected, currently unknown.
remote static-tracepoints-packet:  Support for the `StaticTracepoints' packet is auto-detected, currently unknown.
remote supported-packets-packet:  Support for the `qSupported' packet is auto-detected, currently unknown.
remote swbreak-feature-packet:  Support for the `swbreak-feature' packet is auto-detected, currently unknown.
remote symbol-lookup-packet:  Support for the `qSymbol' packet is auto-detected, currently unknown.
remote system-call-allowed:  Calling host system(3) call from target is not allowed
remote target-features-packet:  Support for the `qXfer:features:read' packet is auto-detected, currently unknown.
remote thread-events-packet:  Support for the `QThreadEvents' packet is auto-detected, currently unknown.
remote threads-packet:  Support for the `qXfer:threads:read' packet is auto-detected, currently unknown.
remote trace-buffer-size-packet:  Support for the `QTBuffer:size' packet is auto-detected, currently unknown.
remote trace-status-packet:  Support for the `qTStatus' packet is auto-detected, currently unknown.
remote traceframe-info-packet:  Support for the `qXfer:traceframe-info:read' packet is auto-detected, currently unknown.
remote unwind-info-block-packet:  Support for the `qXfer:uib:read' packet is auto-detected, currently unknown.
remote verbose-resume-packet:  Support for the `vCont' packet is auto-detected, currently unknown.
remote verbose-resume-supported-packet:  Support for the `vContSupported' packet is auto-detected, currently unknown.
remote vfork-event-feature-packet:  Support for the `vfork-event-feature' packet is auto-detected, currently unknown.
remote write-siginfo-object-packet:  Support for the `qXfer:siginfo:write' packet is auto-detected, currently unknown.
remote write-spu-object-packet:  Support for the `qXfer:spu:write' packet is auto-detected, currently unknown.
remote write-watchpoint-packet:  Support for the `Z2' packet is auto-detected, currently unknown.
remoteaddresssize:  The maximum size of the address (in bits) in a memory packet is 0.
remotebreak:  remotecache:  Deprecated remotecache flag is off.
step-mode:  Mode of the step operation is off.