1 00:00:05,260 --> 00:00:07,191 [MUSIC]. Hi there, I'm just here to do a quick 2 00:00:07,191 --> 00:00:11,230 tutorial on how to use the new debugger inside our virtual machine. 3 00:00:11,230 --> 00:00:19,989 I have a little terminal pulled up here, and we can jump over into that terminal. 4 00:00:21,500 --> 00:00:25,960 And quickly look at the files we have accessible to us. 5 00:00:25,960 --> 00:00:30,580 There's this handy little test.c program that I'll use to do a quick demo of some 6 00:00:30,580 --> 00:00:35,131 simple GDB features. And then, we're going to jump into 7 00:00:35,131 --> 00:00:39,547 looking at the first stage of lab two, which may be useful to you when you start 8 00:00:39,547 --> 00:00:45,400 working on that yourself. So, here's our little test program, it 9 00:00:45,400 --> 00:00:48,518 prints, hello world. You may have seen something like this at 10 00:00:48,518 --> 00:00:53,250 some time previously in your life. we're going to compile it. 11 00:00:53,250 --> 00:00:58,320 but we're going to add the special flag G for adding Debug information. 12 00:00:58,320 --> 00:01:00,790 I know Debug doesn't start with G but it does end in G. 13 00:01:00,790 --> 00:01:05,361 So, small, you know, favors. so we can compile that and then we have 14 00:01:05,361 --> 00:01:10,960 this a.out file. Going to run that in GDB, the new 15 00:01:10,960 --> 00:01:16,440 debugger. And we're going to put a break point at 16 00:01:16,440 --> 00:01:23,578 main, the method that we definitely have, actually a function. 17 00:01:23,578 --> 00:01:27,920 And we're going to say run the program until that point. 18 00:01:27,920 --> 00:01:31,430 Now it's going to stop here, and we can say, let's see what the source code looks 19 00:01:31,430 --> 00:01:35,880 like. Say, List, shows us all our source code. 20 00:01:35,880 --> 00:01:39,845 We can also look at the assembly code that actually executes each of these 21 00:01:39,845 --> 00:01:43,541 steps. There's a number of ways that we can look 22 00:01:43,541 --> 00:01:46,980 at this. we can step through a single step of the 23 00:01:46,980 --> 00:01:51,107 C code. We've already printed hello world now, 24 00:01:51,107 --> 00:01:55,697 and we're about to return 0. Now what if you didn't have all that 25 00:01:55,697 --> 00:02:00,190 handy debug information. What if instead we compiled it maybe 26 00:02:00,190 --> 00:02:05,710 accidentally without the debug information, we left our source file at 27 00:02:05,710 --> 00:02:10,520 home. So, we can now look at this new a.out 28 00:02:10,520 --> 00:02:17,124 compiled without debug info. So again, break at main, run the file, 29 00:02:17,124 --> 00:02:22,620 and what do we try and list? Well, there's no single table listed. 30 00:02:22,620 --> 00:02:24,925 We don't have the debug information, we can't look at our source. 31 00:02:24,925 --> 00:02:28,405 We can still look at our assembly, and this is going to be true pretty much 32 00:02:28,405 --> 00:02:32,572 regardless of what you do or don't put into your file. 33 00:02:32,572 --> 00:02:36,689 Which is a little detail that will come in extremely handy in lab two. 34 00:02:39,400 --> 00:02:43,430 We have also this mysterious executable file called Bomb. 35 00:02:43,430 --> 00:02:47,946 We don't know what's in it. We can run the disassembler against, or 36 00:02:47,946 --> 00:02:53,932 the debugger against it. But if we try to list the source, we 37 00:02:53,932 --> 00:02:59,599 don't have any of it. So, this is a small difficulty for our 38 00:02:59,599 --> 00:03:05,303 debugging, but we can I've learned from my sources that we may have a method 39 00:03:05,303 --> 00:03:11,574 called Phase One. Somewhere in this bond and look there it 40 00:03:11,574 --> 00:03:14,996 is. We tried to break against a function that 41 00:03:14,996 --> 00:03:20,267 didn't exist, it's not going to do it. So, there definitely is a function called 42 00:03:20,267 --> 00:03:23,370 Phase One. If you also try to look at the current 43 00:03:23,370 --> 00:03:26,988 assembly code being executed before you start running the program, you're also 44 00:03:26,988 --> 00:03:31,894 not going to have any luck. Alright, so let's go look at this Phase 45 00:03:31,894 --> 00:03:37,254 One program. put together by a madman I see. 46 00:03:37,254 --> 00:03:41,105 So, what is something that we can recognize in assembly code? 47 00:03:41,105 --> 00:03:45,659 Often programmers like to use words like Foo and Bar to easily detect them later 48 00:03:45,659 --> 00:03:51,340 when they turn up in their tests. But they're not particularly obvious if 49 00:03:51,340 --> 00:03:55,764 they're not represented as strings. So, maybe we should use something that we 50 00:03:55,764 --> 00:03:58,880 can definitely recognize like a whole bunch of A's. 51 00:03:58,880 --> 00:04:02,910 All the A's will be represented the same way, and we can definitely see them 52 00:04:02,910 --> 00:04:06,397 later. Alright, so well put this input in, now 53 00:04:06,397 --> 00:04:10,648 we've hit our break point. Well again we can't list we don't have 54 00:04:10,648 --> 00:04:14,181 any source, so what if we disassemble instead. 55 00:04:14,181 --> 00:04:18,213 Alright here's an assembly code that looks pretty interesting to us pretty 56 00:04:18,213 --> 00:04:21,854 familiar too. GDB, by the way has a vast amount of help 57 00:04:21,854 --> 00:04:26,528 you can get help on pretty much any topic you are interested in. 58 00:04:26,528 --> 00:04:31,559 And then once you've looked at the help for it, you can get help on your help. 59 00:04:31,559 --> 00:04:35,591 So, for instance if we want to look at health info, it gives us a whole bunch of 60 00:04:35,591 --> 00:04:39,578 different commands that we can do with info. 61 00:04:39,578 --> 00:04:42,628 We can look at sources, we can look at records, we can look at, well, in this 62 00:04:42,628 --> 00:04:45,975 case, I guess we can't look at sources, can we? 63 00:04:45,975 --> 00:04:53,365 But, we can definitely look at Registers. so here's our SP, which you may already 64 00:04:53,365 --> 00:05:01,338 have learned is the Stack Pointer, this is pointing into the stack. 65 00:05:01,338 --> 00:05:05,350 Here's our IP, the Instruction Pointer. C, here's the name of the function that 66 00:05:05,350 --> 00:05:10,060 we're inside of. RAX often holds a return, and the first 67 00:05:10,060 --> 00:05:16,580 two parameters to a function, will often be an RDI, and RSI. 68 00:05:16,580 --> 00:05:20,050 Certainly in a 62-bit machine like this, 62? 69 00:05:20,050 --> 00:05:23,237 Goodness. Certainly in a 64-bit machine like this 70 00:05:23,237 --> 00:05:25,602 one. Alright, so we will go back to the 71 00:05:25,602 --> 00:05:29,384 assembly code, and if you take a step like we did before we're going to run all 72 00:05:29,384 --> 00:05:36,012 the way to the single line of execution in the source code and blow off the Bomb. 73 00:05:36,012 --> 00:05:42,480 So, instead we're going to type all those A's back in, and we're going to take one 74 00:05:42,480 --> 00:05:49,996 step instruction by instruction. So, now if you see this little arrow on 75 00:05:49,996 --> 00:05:55,776 the screen here, this is pointing to the func, or the instruction that we're about 76 00:05:55,776 --> 00:06:03,228 to execute, not the one we've just done. This one is particular is pretty 77 00:06:03,228 --> 00:06:06,674 interesting. We're about to make a call to a function 78 00:06:06,674 --> 00:06:10,812 called Strings not equal. Well that sounds like the kind of thing 79 00:06:10,812 --> 00:06:15,374 that we might care about. So, let's look again at these registers, 80 00:06:15,374 --> 00:06:21,370 and it looks like there's a little more going on here than there was before. 81 00:06:21,370 --> 00:06:26,476 So, you may recall that we can look at what's on the stack. 82 00:06:26,476 --> 00:06:33,913 That could be interesting, looking at the stack, NGDB, can be a little bit complex. 83 00:06:33,913 --> 00:06:39,198 but, basically, any, data source that you want to look at, you can type this X. 84 00:06:39,198 --> 00:06:43,848 And then what we're going to type in is in the format number, number of units 85 00:06:43,848 --> 00:06:50,910 that we want to look at and format, how we want to see this data represented. 86 00:06:50,910 --> 00:06:53,052 If you just type it like this it'll get confused, it doesn't understand what 87 00:06:53,052 --> 00:06:57,727 you're talking about. So we say, X, we're going to look at 88 00:06:57,727 --> 00:07:06,350 let's say 24 words, quad words in this case, and oh, let's say HEX. 89 00:07:06,350 --> 00:07:10,566 Everybody likes HEX, and we're going to look at it on the stack so we'll say RSP. 90 00:07:10,566 --> 00:07:13,489 And here we have all of the things on the stack. 91 00:07:13,489 --> 00:07:17,714 And you'll recognize this address from previously when we looked at RSP to see 92 00:07:17,714 --> 00:07:20,408 where it is. Alright, great. 93 00:07:20,408 --> 00:07:23,250 But, the stack isn't too interesting to us because we're looking at a 64 bit 94 00:07:23,250 --> 00:07:25,704 program. So, it's going to be putting its 95 00:07:25,704 --> 00:07:28,938 arguments to this string's not equal function that we're interested in, right 96 00:07:28,938 --> 00:07:34,170 into registers. Well, specifically, the registers that 97 00:07:34,170 --> 00:07:38,130 we're interested in are likely to be the first two registers that arguments get 98 00:07:38,130 --> 00:07:42,175 stored in. So, again we can look at this X, and we 99 00:07:42,175 --> 00:07:47,555 can say look at two words maybe. And we'll represent them in HEX, and 100 00:07:47,555 --> 00:07:51,460 we'll look at the first argument register RDI. 101 00:07:51,460 --> 00:07:56,278 It's a bunch of 61's, it's almost as if a single value is being repeated a bunch of 102 00:07:56,278 --> 00:08:02,034 times like those A's we typed in. Now if there's an easy way that we can 103 00:08:02,034 --> 00:08:07,705 look at them, that might be better. We could say, let's look at these as 104 00:08:07,705 --> 00:08:14,654 Strings instead of as HEX numbers. Oops RDI, sorry about that. 105 00:08:14,654 --> 00:08:18,879 And look, there's our A's, you can also look at them as integers which is not 106 00:08:18,879 --> 00:08:24,860 particularly useful for us right now. by the way, just a quick tangent, I know 107 00:08:24,860 --> 00:08:28,880 that the way we are representing registers in GDB is an awful lot like the 108 00:08:28,880 --> 00:08:35,413 way that assembly represents Constance. This is an unfortunate, but true fact 109 00:08:35,413 --> 00:08:37,700 that you're just going to have to get used to. 110 00:08:37,700 --> 00:08:41,895 It can be a little confusing at first. if we try and tell it to look at a 111 00:08:41,895 --> 00:08:48,510 register using the assembly code method of a percent sign. 112 00:08:48,510 --> 00:08:51,240 It's not going to know what we're talking about. 113 00:08:51,240 --> 00:08:53,634 I'm not sure why they decided to do it this way, they just did. 114 00:08:53,634 --> 00:08:57,520 Alright, so let's look at that other register because we already found our 115 00:08:57,520 --> 00:09:00,866 input. But what could we be looking to see if 116 00:09:00,866 --> 00:09:04,438 it's equal to. Well, we could say let's look, and if 117 00:09:04,438 --> 00:09:08,530 looking for Strings not equal, so we probably want to look at them in String 118 00:09:08,530 --> 00:09:12,750 format. And we'll look at RSI, oh, now there's an 119 00:09:12,750 --> 00:09:16,408 interesting String. I'll put a couple breaks in so that you 120 00:09:16,408 --> 00:09:19,610 can see it more clearly higher on the screen. 121 00:09:19,610 --> 00:09:22,895 Well I didn't type that string in so I wonder where it could have come from. 122 00:09:22,895 --> 00:09:32,960 Maybe it's important to look at in HEX, 59? 123 00:09:32,960 --> 00:09:36,220 That doesn't look nearly as meaningful, but let's copy it. 124 00:09:36,220 --> 00:09:40,352 Oops, that's the wrong kind of copying. Copy it, and we'll leave GDB, so I can 125 00:09:40,352 --> 00:09:45,162 show you really quickly one last feature of this Bomb that we have prepared for 126 00:09:45,162 --> 00:09:52,150 you. You can look at a text file, user.txt. 127 00:09:52,150 --> 00:10:03,600 And we can paste in this value that we've just received. 128 00:10:03,600 --> 00:10:06,823 And we can run this Bomb. First let's just run it without any 129 00:10:06,823 --> 00:10:09,764 input. We say Foo Bar Baz, I know what computer 130 00:10:09,764 --> 00:10:16,610 scientists like, that's not the key. Alright, we'll say bomb diffuser.text. 131 00:10:16,610 --> 00:10:21,734 Well, that's not the key either, but you see that I didn't need to enter any 132 00:10:21,734 --> 00:10:26,846 input. It's taking input from this diffuser.text 133 00:10:26,846 --> 00:10:29,317 file. So, is there any input that we've seen 134 00:10:29,317 --> 00:10:32,274 earlier? That might actually be the key to this 135 00:10:32,274 --> 00:10:34,840 Bomb? You should check it out.