$30 off During Our Annual Pro Sale. View Details »

Debuggers from scratch

Liz Rice
November 06, 2017

Debuggers from scratch

See how a debugger sets breakpoints and generates stack traces. The pdf version of this slide deck doesn't show the animations, so you might prefer to watch the video of this presentation at dotGo EU: https://youtu.be/TBrv17QyUE0

Liz Rice

November 06, 2017
Tweet

More Decks by Liz Rice

Other Decks in Technology

Transcript

  1. Copyright @ 2017 Aqua Security Software Ltd. All Rights Reserved.
    A debugger from scratch
    Liz Rice
    @lizrice

    View Slide

  2. 2
    @lizrice
    ptrace
    The ptrace() system call provides a means by which one process (the
    "tracer") may observe and control the execution of another process
    (the "tracee"), and examine and change the tracee's memory and
    registers. It is primarily used to implement breakpoint debugging
    and system call tracing.

    View Slide

  3. 3
    @lizrice
    ptrace

    View Slide

  4. 4
    @lizrice
    func f3() int {
    var j int
    j = 0x44444444
    return i + j
    }
    Source code
    MOVQ BP, 0x8(SP)
    LEAQ 0x8(SP), BP
    MOVQ $0x0, 0x20(SP)
    MOVQ $0x0, 0(SP)
    MOVQ $0x44444444, 0(SP)
    MOVQ 0x18(SP), AX
    ADDQ $0x44444444, AX
    MOVQ AX, 0x20(SP)
    MOVQ 0x8(SP), BP
    ADDQ $0x10, SP
    SUBQ $0x10, SP
    JMP main.f2(SB)
    Machine code

    View Slide

  5. 5
    @lizrice
    MOVQ BP, 0x8(SP)
    LEAQ 0x8(SP), BP
    MOVQ $0x0, 0x20(SP)
    MOVQ $0x0, 0(SP)
    MOVQ $0x44444444, 0(SP)
    MOVQ 0x18(SP), AX
    ADDQ $0x44444444, AX
    MOVQ AX, 0x20(SP)
    MOVQ 0x8(SP), BP
    ADDQ $0x10, SP
    Program Counter
    CPU Registers SUBQ $0x10, SP
    JMP main.f2(SB)
    Machine code

    View Slide

  6. 6
    @lizrice
    MOVQ BP, 0x8(SP)
    LEAQ 0x8(SP), BP
    MOVQ $0x0, 0x20(SP)
    MOVQ $0x0, 0(SP)
    MOVQ 0x18(SP), AX
    ADDQ $0x44444444, AX
    MOVQ AX, 0x20(SP)
    MOVQ 0x8(SP), BP
    ADDQ $0x10, SP
    Program Counter
    CPU Registers
    0xCC
    SUBQ $0x10, SP
    JMP main.f2(SB)
    Machine code

    View Slide

  7. 7
    @lizrice
    MOVQ BP, 0x8(SP)
    LEAQ 0x8(SP), BP
    MOVQ $0x0, 0x20(SP)
    MOVQ $0x0, 0(SP)
    MOVQ 0x18(SP), AX
    ADDQ $0x44444444, AX
    MOVQ AX, 0x20(SP)
    MOVQ 0x8(SP), BP
    ADDQ $0x10, SP
    0xCC
    SUBQ $0x10, SP
    JMP main.f2(SB)
    Machine code
    func f3() int {
    var j int
    j = 0x44444444
    return i + j
    }
    Source code

    View Slide

  8. 8
    @lizrice
    address to return to
    parameters & return values
    local variables
    CPU Registers
    Base Pointer
    address to return to
    Stack Pointer
    Program Counter
    Program Counter
    Base Pointer
    Call Stack
    Previous stack frame
    Previous stack frame
    address to return to
    parameters & return values

    View Slide

  9. Copyright @ 2017 Aqua Security Software Ltd. All Rights Reserved.
    github.com/lizrice/debugger-from-scratch
    with thanks to @mlowicki & @philpearl
    @lizrice

    View Slide