Debugging

​

Overview

• Full register access (read/write)
• Memory inspection and modification
• Breakpoint support (software and hardware)
• Single-stepping execution
• Thread enumeration and switching
• Library/module information

​

Enabling GDB Mode

​

Basic GDB Mode

analyzer.exe -d myapp.exe

​

Custom Host and Port

analyzer.exe -d --bind 0.0.0.0 --port 2345 myapp.exe

​

GDB Connection Flow

analyzer.exe -d --port 28960 c:/target.exe

Waiting for GDB connection on 127.0.0.1:28960...

gdb
(gdb) target remote 127.0.0.1:28960

​

Using GDB

​

Connecting to Sogen

# Start GDB without a local binary
gdb

# Connect to the Sogen emulator
(gdb) target remote 127.0.0.1:28960

# Check current state
(gdb) info registers
(gdb) info threads

​

Basic Debugging Commands

# Continue execution
(gdb) continue

# Single step
(gdb) step
(gdb) stepi

# Set breakpoint
(gdb) break *0x140001000

# Examine memory
(gdb) x/16xb 0x140001000
(gdb) x/s 0x140001000

# Examine registers  
(gdb) info registers
(gdb) print $rax
(gdb) set $rax = 0x1234

# Backtrace
(gdb) backtrace

​

Thread Debugging

# List all threads
(gdb) info threads

# Switch to thread
(gdb) thread 2

# Show current thread
(gdb) thread

​

Using LLDB

# Start LLDB
lldb

# Connect to Sogen
(lldb) gdb-remote 127.0.0.1:28960

# Set breakpoint
(lldb) breakpoint set --address 0x140001000

# Continue
(lldb) continue

# Read memory
(lldb) memory read 0x140001000

# Read registers
(lldb) register read

​

Using IDA Pro

analyzer.exe -d --port 28960 c:/malware.exe

​

Using Visual Studio Code

​

Install Extension

1. Install the “Native Debug” extension
2. Create a .vscode/launch.json configuration

​

Configuration

{
  "version": "0.2.0",
  "configurations": [
    {
      "name": "Sogen GDB",
      "type": "gdb",
      "request": "attach",
      "executable": "./target.exe",
      "target": "127.0.0.1:28960",
      "remote": true,
      "cwd": "${workspaceRoot}",
      "valuesFormatting": "parseText"
    }
  ]
}

​

Debugging Workflow

analyzer.exe -d c:/target.exe

​

GDB Stub Implementation Details

​

Supported Commands

• Memory operations: Read (m), Write (M, X)
• Register operations: Read all (g), Write all (G), Read single (p), Write single (P)
• Breakpoints: Set (Z), Delete (z) for all types
• Execution control: Continue (c), Step (s), Continue with signal (S)
• Thread operations: Query (qfThreadInfo), Switch (H)
• Information queries: Target description (qXfer:features), Libraries (qXfer:libraries), Executable path (qXfer:exec-file)

​

Breakpoint Types

enum class breakpoint_type : uint8_t
{
    software = 0,           // Software breakpoint (INT3)
    hardware_exec = 1,      // Hardware execution breakpoint
    hardware_write = 2,     // Hardware write watchpoint
    hardware_read = 3,      // Hardware read watchpoint
    hardware_read_write = 4 // Hardware access watchpoint
};

​

Target Architecture

• General purpose registers (RAX, RBX, RCX, etc.)
• Segment registers (CS, DS, SS, ES, FS, GS)
• Control registers
• Instruction pointer (RIP)
• Flags register (RFLAGS)

​

Advanced Debugging Techniques

​

Conditional Breakpoints

# Break when RAX equals specific value
(gdb) break *0x140001000 if $rax == 0x1234

# Break when memory contains value
(gdb) break *0x140001000 if *(long*)0x140020000 == 0x5678

​

Watchpoints

# Watch memory location for changes
(gdb) watch *(long*)0x140020000

# Watch memory for reads
(gdb) rwatch *(long*)0x140020000

# Watch for reads or writes
(gdb) awatch *(long*)0x140020000

​

Scripting

import gdb

class BreakpointHandler(gdb.Breakpoint):
    def __init__(self, spec):
        super().__init__(spec)
        
    def stop(self):
        rax = gdb.parse_and_eval('$rax')
        print(f"RAX = {rax}")
        return True  # Stop execution

# Set breakpoint with handler
BreakpointHandler('*0x140001000')

# Continue execution
gdb.execute('continue')

(gdb) source debug_script.py

​

Troubleshooting

​

Connection Refused

1. Check that analyzer is running in debug mode (-d)
2. Verify the correct host and port
3. Check firewall settings
4. Ensure no other service is using the port

​

Symbols Not Loading

1. Load the executable in your debugger separately
2. Use IDA Pro to analyze the binary and debug simultaneously
3. Generate symbol files from the PE executable

​

Breakpoints Not Working

1. Verify the address is within executable code
2. Check that the module is loaded
3. Use hardware breakpoints for memory-mapped regions
4. Ensure the code hasn’t been relocated