Cannot insert breakpoints. Addresses with low values

by

Your code was most probably compiled as Position-Independent Executable (PIE) to allow Address Space Layout Randomization (ASLR). On some systems, gcc is configured to create PIEs by default (that implies the options -pie -fPIE being passed to gcc).

When you start GDB to debug a PIE, it starts reading addresses from 0, since your executable was not started yet, and therefore not relocated (in PIEs, all addresses including the .text section are relocatable and they start at 0, similar to a dynamic shared object). This is a sample output:

$ gcc -o prog main.c -pie -fPIE
$ gdb -q prog
Reading symbols from prog...(no debugging symbols found)...done.
gdb-peda$ disassemble main
Dump of assembler code for function main:
   0x000000000000071a <+0>:     push   rbp
   0x000000000000071b <+1>:     mov    rbp,rsp
   0x000000000000071e <+4>:     sub    rsp,0x10
   0x0000000000000722 <+8>:     mov    DWORD PTR [rbp-0x4],edi
   0x0000000000000725 <+11>:    mov    QWORD PTR [rbp-0x10],rsi
   0x0000000000000729 <+15>:    lea    rdi,[rip+0x94]        # 0x7c4
   0x0000000000000730 <+22>:    call   0x5d0 <puts@plt>
   0x0000000000000735 <+27>:    mov    eax,0x0
   0x000000000000073a <+32>:    leave
   0x000000000000073b <+33>:    ret
End of assembler dump.

As you can see, this shows a similar output to yours, with .text adresses starting at low values.

Relocation takes place once you start your executable, so after that, your code will be placed at some random address in your process memory:

gdb-peda$ start
...
gdb-peda$ disassemble main
Dump of assembler code for function main:
   0x00002b1c8f17271a <+0>:     push   rbp
   0x00002b1c8f17271b <+1>:     mov    rbp,rsp
=> 0x00002b1c8f17271e <+4>:     sub    rsp,0x10
   0x00002b1c8f172722 <+8>:     mov    DWORD PTR [rbp-0x4],edi
   0x00002b1c8f172725 <+11>:    mov    QWORD PTR [rbp-0x10],rsi
   0x00002b1c8f172729 <+15>:    lea    rdi,[rip+0x94]        # 0x2b1c8f1727c4
   0x00002b1c8f172730 <+22>:    call   0x2b1c8f1725d0 <puts@plt>
   0x00002b1c8f172735 <+27>:    mov    eax,0x0
   0x00002b1c8f17273a <+32>:    leave
   0x00002b1c8f17273b <+33>:    ret
End of assembler dump.

As you can see, the addresses now take “real” values that you can set breakpoints to. Note that usually you will still not see the effect of ASLR in GDB though, since it disables randomization by default (debugging a program with randomized location would be cumbersome). You can check this with show disable-randomization. If you really want to see the effects of ASLR in your PIE, set disable-randomization off. Then every run will relocate your code to random addresses.

So the bottom line is: When debugging PIE code, start your program in GDB first and then figure out the addresses.

Alternatively, you can explicitly disable the creation of PIE code and compile your application using gcc filename.c -o filename -no-pie -fno-PIE.
My system does not enforce PIE creation by default, so unfortunately I don’t know about the implications of disabling PIE on such a system (would be glad to see comments on that).

For a more comprehensive explanation of position-independent code (PIC) in general (which is of utmost importance for shared libraries), have a look at Ulrich Drepper’s paper “How to Write Shared Libraries”.

More Related Contents:

  1. How to solve “ptrace operation not permitted” when trying to attach GDB to a process?
  2. How do I pass a command line argument while starting up GDB in Linux? [duplicate]
  3. Debugging core files generated on a Customer’s box
  4. Best way to invoke gdb from inside program to print its stacktrace?
  5. How can I tell if a library was compiled with -g?
  6. How to print every executed line in GDB automatically until a given breakpoint is reached?
  7. Include source code of malloc.c in gdb?
  8. How Can I debug a C program on Linux?
  9. Is it possible to “jump”/”skip” in GDB debugger?
  10. How to pretty-print STL containers in GDB?
  11. How to make backtrace()/backtrace_symbols() print the function names?
  12. How to modify memory contents using GDB?
  13. segfault only when NOT using debugger
  14. Where is the header file on Linux? Why can’t I find ? [duplicate]
  15. Creating a daemon in Linux
  16. What is the behavior of printing NULL with printf’s %s specifier?
  17. How to create a high resolution timer in Linux to measure program performance?
  18. strtok function thread safety
  19. Set ALSA master volume from C code
  20. What is the Windows equivalent to the capabilities defined in sys/select.h and termios.h
  21. Printing all global variables/local variables?
  22. Set environment variables in C
  23. What is the difference between a Linux platform driver and normal device driver?
  24. Finding out if a message over tcp was delivered
  25. why C clock() returns 0
  26. calling assembly function from c
  27. Returning struct containing array
  28. Why does malloc allocate a different number of bytes than requested?
  29. Efficient way to find task_struct by pid
  30. What is the difference between AF_INET and PF_INET in socket programming?

Leave a Comment