GDB

gdb 在 POSIX 系统中的实现主要依赖 ptrace 系统调用。

#include <sys/ptrace.h>
long ptrace(enum __ptrace_request request, pid_t pid, void *addr, void *data);

The ptrace system call provides a means by which a parent process may observe and control the execution of another process, and examine and change its core image and registers. It is primarily used to implement breakpoint debugging and system call tracing.

The parent can initiate a trace by calling fork(2) and having the resulting child do a PTRACE_TRACEME, followed (typically) by an exec(3). Alternatively, the parent may commence trace of an existing process using PTRACE_ATTACH.

ptrace 实例可参考：
http://www.linuxjournal.com/article/6100

调试器的简单实现可参考：
http://eli.thegreenplace.net/2011/01/23/how-debuggers-work-part-1/
http://godorz.info/2011/02/how-debuggers-work-part-1/
http://www.cnblogs.com/quixotic/archive/2012/01/16/2323541.html

MS Windows 调试器原理：
How Windows Debuggers Work
Writing a basic Windows debugger

用 gcc 的 -g[level] 选项可以在编译程序时加入调试符号信息。

gcc -g -o prog prog.c

level 可以是 0 到 3，默认为 2。指定为 0 时禁止生成调试信息；为生成更多的调试信息（如 C 中宏名可见），可以指定为 3。

gcc -g3 -o prog prog.c

用 gcc 的 -ggdb[level] 选项可以生成 GNU 的扩展调试信息，如果是用 GDB 调试程序，则建议用 -ggdb3 进行编译。

gcc -ggdb3 -o prog prog.c

https://gcc.gnu.org/onlinedocs/gcc/Debugging-Options.html#Debugging-Options

方法一：启动时指定 prog，再 run

$ gdb prog
(gdb) run

方法二：启动时不指定，启动后用 file 命令指定 prog，再 run

$ gdb
(gdb) file /path/to/prog
(gdb) run

说明：术语 inferior 在 GDB 中是指被调试程序。

A breakpoint stops your program whenever a particular point in the program is reached.
A watchpoint stops your program whenever the value of a variable or expression changes.
A catchpoint stops your program whenever a particular event occurs.

You can give any breakpoint (or watchpoint or catchpoint) a series of commands to execute when your program stops due to that breakpoint. For example, you might want to print the values of certain expressions, or enable other breakpoints.

commands [range...]
... command-list ...
end

Specify a list of commands for the given breakpoints. With no argument, commands refers to the last breakpoint, watchpoint, or catchpoint.

You can use breakpoint commands to start your program up again. Simply use the continue command, or step, or any other command that resumes execution.

If the first command you specify in a command list is silent, the usual message about stopping at a breakpoint is not printed. This may be desirable for breakpoints that are to print a specific message and then continue. If none of the remaining commands print anything, you see no sign that the breakpoint was reached. silent is meaningful only at the beginning of a breakpoint command list.

参考：
https://sourceware.org/gdb/current/onlinedocs/gdb/Break-Commands.html#Break-Commands

The dynamic printf command dprintf combines a breakpoint with formatted printing of your program’s data to give you the effect of inserting printf calls into your program on-the-fly, without having to recompile it.

注：有了 dprintf 命令，再也不用在源码中插入 printf 语句来辅助调试了。

参考：https://sourceware.org/gdb/current/onlinedocs/gdb/Dynamic-Printf.html#Dynamic-Printf

When your program is started, the stack has only one frame, that of the function main. This is called the initial frame or the outermost frame. Each time a function is called, a new frame is made. Each time a function returns, the frame for that function invocation is eliminated.

参考：https://sourceware.org/gdb/current/onlinedocs/gdb/Backtrace.html#Backtrace

参考：https://sourceware.org/gdb/current/onlinedocs/gdb/Data.html#Data

在 gdb 中，能方便地修改程序执行过程中变量的值，修改代码执行流程（如直接跳到某个位置执行，以指定值作为返回值立刻从函数返回等等）。

参考：https://sourceware.org/gdb/current/onlinedocs/gdb/Altering.html#Altering

-q (--quiet, --silent)不显示启动时的版权信息。
-n (--nx)不加载任何目录中的.gdbinit 配置文件。
-c 检查 core dump 文件，如 gdb -c core.23498。
-ex (--eval-command=COMMAND) 执行单个 GDB 命令。
-iex (--init-eval-command=COMMAND) 在加载 inferior 之前 GDB 命令。

gdb --help 可以得到 gdb 所有命令行参数的描述。

info source 命令的输出类似于：

(gdb) info source
Current source file is 1.c
Compilation directory is /home/cig01/test
Located in /home/cig01/test/1.c
Contains 26 lines.
Source language is c.
Compiled with DWARF 2 debugging format.
Does not include preprocessor macro info.

参考：https://sourceware.org/gdb/current/onlinedocs/gdb/Symbols.html#Symbols

gdb provides convenience variables that you can use within gdb to hold on to a value and refer to it later.
Convenience variables are prefixed with '$'. Any name preceded by '$' can be used for a convenience variable, unless it is one of the predefined machine-specific register names.

用命令 show convenience 或其简写形式 show conv 可以显示所有 convenience variables 和 convenience functions。

在 gdb 中可以自由定义 convenience variable，它们以$开头。如：

(gdb) set var $i=12       # 或 print $i=12
(gdb) p $i
$2 = 12

参考：https://sourceware.org/gdb/current/onlinedocs/gdb/Convenience-Vars.html#Convenience-Vars

GDB also supplies some convenience functions. These have a syntax similar to convenience variables.

用命令 help function 可以显示所有的 Convenience Functions.

参考：https://sourceware.org/gdb/current/onlinedocs/gdb/Convenience-Funs.html#Convenience-Funs

A user-defined command is a sequence of gdb commands to which you assign a new name as a command. This is done with the define command. User commands may accept up to 10 arguments separated by whitespace. Arguments are accessed within the user command via $arg0...$arg9. $argc may be used to find out how many arguments have been passed.

Command document commandname can document a user-defined command, so that it can be accessed by help.

A trivial example:

define adder
  print $arg0 + $arg1 + $arg2
end
document adder
Perform addition operation.
end

参考：https://sourceware.org/gdb/current/onlinedocs/gdb/Define.html#Define

第 1 步：在远程机器上用 gdbserver 启动程序。如：

$ gdbserver :9919 prog
Process prog created; pid = 24845
Listening on port 9919

或直接 attach 到已经运行的进程：

$ gdbserver :9919 --attach <pid>

第 2 步：在本地机器中用 gdb 启动程序，并设置 target。如：

$ gdb -q prog
(gdb) target remote 192.168.1.10:9919
Remote debugging using 192.168.1.10:9919

接下来，就可以在本地机器中调用远程机器上运行的程序了。

参考：
http://www.thegeekstuff.com/2014/04/gdbserver-example/
https://sourceware.org/gdb/onlinedocs/gdb/Remote-Debugging.html#Remote-Debugging

In some applications, it is not feasible for the debugger to interrupt the program's execution long enough for the developer to learn anything helpful about its behavior. If the program's correctness depends on its real-time behavior, delays introduced by a debugger might cause the program to change its behavior drastically, or perhaps fail, even when the code itself is correct. It is useful to be able to observe the program's behavior without interrupting it.

Using gdb's trace and collect commands, you can specify locations in the program, called tracepoints, and arbitrary expressions to evaluate when those tracepoints are reached. Later, using the tfind command, you can examine the values those expressions had when the program hit the tracepoints.

当前，tracepoints 只在远程调试模式下支持（在 gdbserver 7.2 之后才被支持）。

参考：https://sourceware.org/gdb/current/onlinedocs/gdb/Tracepoints.html#Tracepoints

On most systems, gdb has no special support for debugging programs which create additional processes using the fork function. By default, when a program forks, gdb will continue to debug the parent process and the child process will run unimpeded. If you have set a breakpoint in any code which the child then executes, the child will get a SIGTRAP signal which (unless it catches the signal) will cause it to terminate.

参考：
https://sourceware.org/gdb/current/onlinedocs/gdb/Forks.html

参考：
https://sourceware.org/gdb/current/onlinedocs/gdb/Threads.html#Threads
https://sourceware.org/gdb/current/onlinedocs/gdb/Thread-Stops.html#Thread-Stops

用 info signals [signal] 或者 info handle [signal] 可查看 gdb 中所有信号或指定信号的设置。
用 handle signal [nostop|stop print|noprint pass|nopass] 可修改指定信号的设置（pass/nopass 可换为它们的别名 noignore/ignore）。

gdb 信号设置实例：

(gdb) info signals SIGINT
Signal        Stop      Print   Pass to program Description
SIGINT        Yes       Yes     No              Interrupt
(gdb) handle SIGINT pass
(gdb) info signals SIGINT
Signal        Stop      Print   Pass to program Description
SIGINT        Yes       Yes     Yes             Interrupt

The default is set to nostop, noprint, pass for non-erroneous signals such as SIGALRM, SIGWINCH and SIGCHLD, and to stop, print, pass for the erroneous signals.

参考：https://sourceware.org/gdb/current/onlinedocs/gdb/Signals.html#Signals

参考：https://sourceware.org/gdb/current/onlinedocs/gdb/Checkpoint_002fRestart.html#Checkpoint_002fRestart

GDB 有记录输出到文件的功能。注意：记录功能只能记录 GDB 的输出信息，被调试程序(inferior)的输出信息仍然会输出到终端。

注意：在设置 set logging overwrite 或 set logging redirect 时如果记录功能已经打开，需要关闭记录功能再重新打开才能更改生效。

用 gdb -tui 启动 gdb 会进入到 TUI。

如果启动时没有指定-tui，启动后可用下面方法进入 TUI：

(gdb) layout split
# 或者用下面快捷键
Ctrl x 2

http://stackoverflow.com/questions/9970636/view-both-assembly-and-c-code
http://stackoverflow.com/questions/1902901/show-current-instruction-in-gdb

在 gdb 中执行命令 info program 可以查看当前被调试程序的状态，如有没有在运行中，进程 id 是多少等。

如：

(gdb) info program
	Using the running image of child process 2376.
Program stopped at 0x4004ba.
It stopped at a breakpoint that has since been deleted.

如果跟踪函数调用？在 Breakpoint Command Lists 中使用命令 backtrace 1 （只显示最内层的 1 个栈帧）即可。

break function-name
  commands
    silent
    backtrace 1
    continue
  end

上面方法能打印函数的参数，却无法打印函数的返回值（加入 finish 命令，在嵌套的函数调用时无法正常打印函数返回值）。

参考：http://dustymabe.com/2012/10/14/trace-function-calls-using-gdb/

如何在 gdb 中执行 shell 命令？

(gdb) shell ls

或者直接启动 shell，再输入想要执行的命令：

(gdb) shell
bash $ execute_your_shell_commands
bash $ exit
(gdb) # you_have_returned_back_to_gdb_prompt

如何检测程序中是否包含调试信息？

方法 1：
用 gdb 加载程序，在(gdb)提示符的上一行如果出现了 no debugging symbols found ，则说明程序中不包含调试信息。

$ gdb -q ./test
Reading symbols from /home/test/test...(no debugging symbols found)...done.
(gdb)

方法 2：
用命令 objdump -t prog |grep debug ，如果什么都没有输出，则说明不包含调试信息。
若包含调试信息，其输出类似于：

$ objdump -t ./test |grep debug
0000000000000000 l    d  .debug_aranges 0000000000000000              .debug_aranges
0000000000000000 l    d  .debug_pubnames        0000000000000000              .debug_pubnames
0000000000000000 l    d  .debug_info    0000000000000000              .debug_info
0000000000000000 l    d  .debug_abbrev  0000000000000000              .debug_abbrev
0000000000000000 l    d  .debug_line    0000000000000000              .debug_line
0000000000000000 l    d  .debug_frame   0000000000000000              .debug_frame
0000000000000000 l    d  .debug_loc     0000000000000000              .debug_loc

当程序没有 debug 符号时，如何调试它呢？

这时，只能调试汇编代码了。具体操作步骤可参考：
GDB - Debugging stripped binaries: http://felix.abecassis.me/2012/08/gdb-debugging-stripped-binaries/
How to handle stripped binaries with GDB?: http://reverseengineering.stackexchange.com/questions/1935/how-to-handle-stripped-binaries-with-gdb-no-source-no-symbols-and-gdb-only-sho

用 GDB 可以方便实现进制转换，基本格式为 p /FMT num 。如把 31558 转换为 16 进制：

(gdb) p /x  31558
$11 = 0x7b46

其中，/FMT 可以为：
/o(octal), /x(hex), /d(decimal), /t(binary)

参考：http://lldb.llvm.org/lldb-gdb.html

参考：
gdb vs. dbx: commands mapping and feature comparison: https://blogs.oracle.com/dbx/entry/gdb_vs_dbx_commands_mapping