Re: breaking on open(2) on linux

[Nick Roberts <nickrob@snap.net.nz>]

Marty Leisner writes:
 > I've used gdb for 20 years...I've found the ability to 
 > break on a system call and then backtrace very useful when
 > reverse engineering code
 > 
 > Now, I can't do it (not sure when I last could -- I recall its been
 > a problem before, but I worked around it).
 > 
 > strace shows open(2) calls...

The breakpoint is probably being set elsewhere, e.g. open in libpthread.so

To find out do:

(gdb) inf addr open
Symbol "open" is at 0xb77e69c0 in a file compiled without debugging.

(gdb) inf sharedlibrary

...
0xb7800450  0xb784b444  Yes         /usr/lib/libglib-2.0.so.0
0xb77de250  0xb77e9264  Yes         /lib/tls/i686/cmov/libpthread.so.0
^^^^^^^^^^^^^^^^^^^^^^
0xb77d3150  0xb77d7bd4  Yes         /usr/lib/libSM.so.6
...

You probably want the one here:

0xb74abca0  0xb75a3306  Yes         /lib/tls/i686/cmov/libc.so.6


I don't know the official way to get round this but you could do

(gdb) set auto-solib-add off
(gdb) start
(gdb) share libc.so
(gdb) b open

to set the breakpoint where you want it.

-- 
Nick                                           http://www.inet.net.nz/~nickrob