逆向工程 - GDB - eu-unstrip

一般Release給客戶的檔案都是移掉Debug資訊的檔案，不過，在編譯Release檔案時，通常會額外編譯一份具有Debug Symbol的檔案，而在Debug時，雖然可以在GDB動態載入Debug Symbol，不過，還是不方便，其實elfutils提供一個好用的工具eu-unstrip，它可以把Debug Symbol塞回原本ELF檔案

main.c

#include <stdio.h>
 
int main(int argc, char** argv)
{
    printf("testing\n");
    return 0;
}

編譯

$ gcc main.c -o main
$ gcc main.c -ggdb -o main.debug

模擬Release Build

$ strip main
$ file main
    main: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=44edbb6ef58938fde04de6b6943a640edeb37b77, stripped

Unstrip

$ eu-unstrip -f main main.debug -o test
$ mv test main
$ file main
    main: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=44edbb6ef58938fde04de6b6943a640edeb37b77, with debug_info, not stripped

Debug

$ gdb main

(gdb) b main
    Breakpoint 1 at 0x1114: file main.c, line 5.

(gdb) r
    Starting program: /home/steward/Downloads/main

    Program received signal SIGSEGV, Segmentation fault.
    0x0000000000000001 in ?? ()

(gdb) list
    1	#include <stdio.h>
    2
    3	int main(int argc, char** argv)
    4	{
    5	    printf("testing\n");
    6	    return 0;
    7	}