IDA 动态调试 ELF 文件

﹏ヽ暗。殇╰゛Y 2023-02-11 10:11 31阅读 0赞

IDA 远程调试配置

*  Windows 下的 IDA     
    
     *  在 IDA 的安装目录/dbgsrc/找到 linux\_server 和 linux\_serverx64 拷贝到 linux 虚拟机中
     *  在 linux 中运行 linux\_server 并在 linux 中运行要调试的 demo  
     *  Debugger -- Attach -- Remote Linux debbuger

[![format_png][]][format_png 1]

[![format_png 2][]][format_png 2 1]

*  Linux 下的 IDA

配置方法和 Windows 相同

\#!/bin/bash cd /home/ubuntu/IDA/dbgsrv/ && ./linux\_server & cd /home/ubuntu/re\_tools/IDA/ && ./idaq

运行 ./demo

\[Debugger\] -> \[Attach\] -> \[Remote Linux debugger\]

[![format_png 3][]][format_png 3 1]

02  IDA 动态调试

*  调试指令

<table> 
 <tbody> 
  <tr> 
   <td>单步步入（F7）</td> 
   <td>遇到函数，将进入函数代码内部</td> 
  </tr> 
  <tr> 
   <td>单步步过（F8）</td> 
   <td>执行下一条指令</td> 
  </tr> 
  <tr> 
   <td>运行到光标处（F4）</td> 
   <td>&nbsp;</td> 
  </tr> 
  <tr> 
   <td>断点（F2）</td> 
   <td>可以通过 [Debugger]-[Breakpoints]-[Breakpoint list] 查看断点，右键 [Edit] 可以设置断点</td> 
  </tr> 
  <tr> 
   <td>继续运行（F9）</td> 
   <td>&nbsp;</td> 
  </tr> 
  <tr> 
   <td>终止（CTRL-F2）</td> 
   <td>终止一个正在运行的调试进程</td> 
  </tr> 
  <tr> 
   <td>运行至返回（CTRL-F7）</td> 
   <td>一直在函数代码内部运行，直到遇到RETN（或断点）时才停止.</td> 
  </tr> 
 </tbody> 
</table>

*  添加寄存器监视

\[Debugger\] -> \[Debugger windows\]  -> \[Watch view\]

[![format_png 4][]][format_png 4 1]

可以添加的类型有

(Object\*)v0  
        (String)v0  
        (char\*)v0  
        (int)v0

[![format_png 5][]][format_png 5 1]

03  参考链接

> http://blog.csdn.net/txx\_683/article/details/53454139  
> http://www.freebuf.com/articles/system/67927.html

[format_png]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9pbWFnZXMyMDE1LmNuYmxvZ3MuY29tL2Jsb2cvNzU0MDg4LzIwMTcwNS83NTQwODgtMjAxNzA1MjEyMDIyNTY2NTAtMjA5OTE1OTEwMi5wbmc?x-oss-process=image/format,png
[format_png 1]: https://images2015.cnblogs.com/blog/754088/201705/754088-20170521202256650-2099159102.png
[format_png 2]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9pbWFnZXMyMDE1LmNuYmxvZ3MuY29tL2Jsb2cvNzU0MDg4LzIwMTcwNS83NTQwODgtMjAxNzA1MjEyMDIzMDkyMjgtMTE3MTA3Mzg2Ny5wbmc?x-oss-process=image/format,png
[format_png 2 1]: https://images2015.cnblogs.com/blog/754088/201705/754088-20170521202309228-1171073867.png
[format_png 3]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9pbWFnZXMyMDE1LmNuYmxvZ3MuY29tL2Jsb2cvNzU0MDg4LzIwMTcwNS83NTQwODgtMjAxNzA1MjEyMDM4MDQ0NDctMTYwMjM0NzE3Mi5wbmc?x-oss-process=image/format,png
[format_png 3 1]: https://images2015.cnblogs.com/blog/754088/201705/754088-20170521203804447-1602347172.png
[format_png 4]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9pbWFnZXMyMDE1LmNuYmxvZ3MuY29tL2Jsb2cvNzU0MDg4LzIwMTcwNS83NTQwODgtMjAxNzA1MjEyMDM5NTI4ODUtNTE5MDEwOTIxLnBuZw?x-oss-process=image/format,png
[format_png 4 1]: https://images2015.cnblogs.com/blog/754088/201705/754088-20170521203952885-519010921.png
[format_png 5]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9pbWFnZXMyMDE1LmNuYmxvZ3MuY29tL2Jsb2cvNzU0MDg4LzIwMTcwNS83NTQwODgtMjAxNzA1MjEyMDQxMDU5MzItMTQ0MTY3NTk3MC5wbmc?x-oss-process=image/format,png
[format_png 5 1]: https://images2015.cnblogs.com/blog/754088/201705/754088-20170521204105932-1441675970.png