Why won't gdb stop on packed (UPX) file breakpoint at entrypoint?

Why won't gdb stop on packed (UPX) file breakpoint at entrypoint?

[gdb guy]

I am hoping someone can suggest a solution around this, because it
seems like it limits malware analysis on *nix systems where you want
to use gdb rather than some windows tool...

I wanted to see what UPX was doing for linux files, so I went and got
UPX v 3.02 (http://upx.sourceforge.net/#download). I compiled it, and
did
$ upx `which ps` -o UPXps
and got my UPXps which functions just fine as a normal ps command.
Then I did
$ readelf -a UPXps
ELF Header:
  Magic:   7f 45 4c 46 01 01 01 03 00 00 00 00 00 00 00 00
  Class:                             ELF32
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - Linux
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           Intel 80386
  Version:                           0x1
  Entry point address:               0xc07fd0
  Start of program headers:          52 (bytes into file)
  Start of section headers:          0 (bytes into file)
  Flags:                             0x0
  Size of this header:               52 (bytes)
  Size of program headers:           32 (bytes)
  Number of program headers:         2
  Size of section headers:           40 (bytes)
  Number of section headers:         0
  Section header string table index: 0
There are no sections in this file.
There are no sections in this file.
Program Headers:
  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align
  LOAD           0x000000 0x00c01000 0x00c01000 0x077b8 0x077b8 R E 0x1000
  LOAD           0x000df4 0x08078df4 0x08078df4 0x00000 0x00000 RW  0x1000
There is no dynamic section in this file.
There are no relocations in this file.
There are no unwind sections in this file.
No version information found in this file.

Next comes
$gdb ./UPXps
GNU gdb 6.4
Copyright 2005 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i686-pc-linux-gnu"...(no debugging symbols found)
Using host libthread_db library "/lib/tls/i686/cmov/libthread_db.so.1".

(gdb) b *0xc07fd0
Breakpoint 1 at 0xc07fd0
(gdb) r
Starting program: /home/user/ELF/upx-3.02-src/UPXps
warning: shared library handler failed to enable breakpoint
Failed to read a valid object file image from memory.
  PID TTY          TIME CMD
11524 pts/7    00:00:00 bash
17683 pts/7    00:00:00 gdb
17688 pts/7    00:00:00 UPXps
17690 pts/7    00:00:00 gdb
Program exited normally.

So my question is, is there any way to *force* gdb to just load the
program and just break at the entry point address?

Also, just for my own benefit, and those who google after me, on GDB
6.3 (which I have on another older VM) what does DSO stand for when it
says "Loading system supplied DSO at 0xc00000"?

Thanks

Gary Guy

Re: Why won't gdb stop on packed (UPX) file breakpoint at entrypoint?

[Daniel Jacobowitz]

On Wed, Mar 26, 2008 at 04:57:02PM -0400, gdb guy wrote:
> (gdb) b *0xc07fd0
> Breakpoint 1 at 0xc07fd0
> (gdb) r

Known bug (well, sort of a bug, sort of a feature) in GDB.  Use x/2i
0xc07fd0 and set the breakpoint at the second instruction.

> Also, just for my own benefit, and those who google after me, on GDB
> 6.3 (which I have on another older VM) what does DSO stand for when it
> says "Loading system supplied DSO at 0xc00000"?

Dynamic Shared Object.  Google for vDSO.

-- 
Daniel Jacobowitz
CodeSourcery

Re: Why won't gdb stop on packed (UPX) file breakpoint at entrypoint?

[gdb guy]

I get the following error.
(gdb) x/2i 0xc07fd0
0xc07fd0:       Cannot access memory at address 0xc07fd0

Gary Guy

On Wed, Mar 26, 2008 at 5:00 PM, Daniel Jacobowitz <drow@false.org> wrote:
> On Wed, Mar 26, 2008 at 04:57:02PM -0400, gdb guy wrote:
> > (gdb) b *0xc07fd0
> > Breakpoint 1 at 0xc07fd0
> > (gdb) r
>
> Known bug (well, sort of a bug, sort of a feature) in GDB.  Use x/2i
> 0xc07fd0 and set the breakpoint at the second instruction.
>
> > Also, just for my own benefit, and those who google after me, on GDB
> > 6.3 (which I have on another older VM) what does DSO stand for when it
> > says "Loading system supplied DSO at 0xc00000"?
>
> Dynamic Shared Object.  Google for vDSO.
>
> --
> Daniel Jacobowitz
> CodeSourcery
>

Re: Why won't gdb stop on packed (UPX) file breakpoint at entrypoint?

[Daniel Jacobowitz]

On Wed, Mar 26, 2008 at 05:09:33PM -0400, gdb guy wrote:
> I get the following error.
> (gdb) x/2i 0xc07fd0
> 0xc07fd0:       Cannot access memory at address 0xc07fd0

Do it before the first time you run and that may help.

-- 
Daniel Jacobowitz
CodeSourcery

Re: Why won't gdb stop on packed (UPX) file breakpoint at entrypoint?

[gdb guy]

Sorry to not be clear, but I was doing it before running:
$gdb ./UPXps
GNU gdb 6.4
Copyright 2005 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i686-pc-linux-gnu"...(no debugging symbols found)
Using host libthread_db library "/lib/tls/i686/cmov/libthread_db.so.1".

(gdb) x/2i 0xc07fd0
0xc07fd0:       Cannot access memory at address 0xc07fd0

Gary Guy

On Wed, Mar 26, 2008 at 5:10 PM, Daniel Jacobowitz <drow@false.org> wrote:
> On Wed, Mar 26, 2008 at 05:09:33PM -0400, gdb guy wrote:
> > I get the following error.
> > (gdb) x/2i 0xc07fd0
> > 0xc07fd0:       Cannot access memory at address 0xc07fd0
>
> Do it before the first time you run and that may help.
>
> --
> Daniel Jacobowitz
> CodeSourcery
>

Re: Why won't gdb stop on packed (UPX) file breakpoint at entrypoint?

[Daniel Jacobowitz]

On Wed, Mar 26, 2008 at 05:13:50PM -0400, gdb guy wrote:
> Sorry to not be clear, but I was doing it before running:
> $gdb ./UPXps
> GNU gdb 6.4

You might want to try a newer GDB.  Other than that, sorry, I do not
know what might be wrong.

-- 
Daniel Jacobowitz
CodeSourcery