How do I break at the entry point or a specific address in a NASM-compiled ELF?

[D01B0EB]

section .text
global _start
_start:
    xor eax, eax
    push 0xD01b0eb1
    push 0xD01b0eb2
    push 0xD01b0eb3
    mov eax, 1
    int 0x80

I tried set value (0x08049000) in "Run/Break in" field but give "Program exited noramally".

[epasveer]

Are you in the Assembly tab?

If so, you can create a breakpoint on the address by double-clicking on it. Or, use RightMouseButton.

[epasveer]

Or provide more details on how you're trying to enter the breakpoint.

[epasveer]

Here's a Wiki page on setting breakpoints.

https://github.com/epasveer/seer/wiki/Breakpoints

[D01B0EB]

I don't have C source file, but ASM.

1. Debug -> Choose executeable ELF file
2. Paste an address (get from lldb) to "Run/Break in" field: 0x8049000
3. Press Launch.

I can debug the file by GDB or LLDB. For example:

(lldb) target create "STACK"
Current executable set to '/home/ASMPROJECTS/TEST/OUT/STACK' (i386).
(lldb) process launch --stop-at-entry
Process 133441 stopped
* thread #1, name = 'STACK', stop reason = signal SIGSTOP
    frame #0: 0x08049000 STACK`___lldb_unnamed_symbol_8049000
STACK`___lldb_unnamed_symbol_8049000:
->  0x8049000 <+0>:  xorl   %eax, %eax
    0x8049002 <+2>:  pushl  $0xd01b0eb1    ; imm = 0xD01B0EB1 
    0x8049007 <+7>:  pushl  $0xd01b0eb2    ; imm = 0xD01B0EB2 
    0x804900c <+12>: pushl  $0xd01b0eb3    ; imm = 0xD01B0EB3 
Process 133441 launched: '/home/herurg/PUBLIC-DECRYPTED/DEVELOP/ASMPROJECTS/TEST/OUT/STACK' (i386)

Seer does't stop the program at the breakpoint address. The program still exits.
I attempted to create a breakpoint manually, but clicking OK in the 'Create a breakpoint' dialog does not actually add it.

[epasveer]

Ah, I see now what you mean. Let me do some testing.

You're trying something like this?

[D01B0EB]

Exactly. The Best solution is to have an option to stop the program at the first instruction,
TO avoid having to know the entry address.

Second.
There are gdb commands before "run". it should stop the program if you use starti, but that didn't happen.

gdb test.elf
Reading symbols from test.elf...
(No debugging symbols found in test.elf)
(gdb) starti
Starting program: ../test.elf 

Program stopped.
0x08049000 in ?? ()
(gdb) si
0x08049002 in ?? ()
(gdb) si
0x08049007 in ?? ()
(gdb)

[epasveer]

Is "test.elf" something you can give me? Is it a simple program? And instructions how to compile/link it?

[D01B0EB]

What OS are you using - win, mac, linux? I use Linux.
My answer will depend on your environment.

[epasveer]

Linux. OpenSUSE. I should have all the bits for your test program.

I have some asm test programs myself. But I want to duplicate your test.

BTW, when you manually set the breakpoint, does it show up in the breakpoint list?

If not, look for messages in the GDB and Seer tabs. Make sure the logging in those tabs are enabled first.

[epasveer]

Okay. I found the regression. Stupid bug on my part.

There's nothing you can do until I release a new flatpak. Hopefully in the next couple days. When I release it, I'll update this thread with the steps for you to take to debug your program (after you install the new flat pack).

Stay tuned!

[epasveer]

Note, the new flatpack will have the fix for showing your custom UpperCase font. As well, it will have an option to convert assembly text to uppercase (if you don't want to use your custom font).

[D01B0EB]

Works well when the asm file compiled (NASM + crt1.o and so on are linked by gcc) with main function. Then SEER stopped correct at "Break in main:" or at "Break in:" address , for example, 0x08049190 (entry main).

test.asm

section .text
global _start
_start:
    xor eax, eax
    push 0xD01b0eb1
    push 0xD01b0eb2
    push 0xD01b0eb3
    mov eax, 1
    int 0x80

In the case test.asm file compiled and linked (NASM+LD), an entry point named, for example, _start and "Break in:" address was set, SEEr shows the error dialog:

how to compile and link:

nasm -f elf32 test.asm -g -o test.o
ld -m elf_i386 -s test.o -o test.elf

How to get entry point address:

readelf -h test.elf | grep Entry

GDB_output.txt
SEER_output.txt

[epasveer]

Can you try this?

The difference is one of your binaries has debug information that Seer can use when bringing up the assembly tab. If there's debug information, Seer will look for the address you give and gdb will give the start and end address of the frame. Thus the assembly tab shows the code before and after your address.

If there's no debug information, the Seer can't do this as gdb will error out with the message you see. You can tell Seer to use a different call. It will present the assembly beginning at your address and some number of bytes afterwards.

I suspect the two different ways you're compiling/linking results with one binary with debug and the other without.

Anyway, try this. It will work for both compiling/linking methods. Set this in the Assembly config tab. Make sure to save the settings.

[epasveer]

BTW, I noticed in the "GDB log.txt" file there are some errors with Seer using "/tmp". Is there no "/tmp" on your machine? Or is protected?

I may have to use a different directory for Seer's temp files.

For help, type "help".
Type "apropos word" to search for commands related to "word".
source /tmp/MICatchpoint.py
/tmp/MICatchpoint.py: No such file or directory.
source /tmp/MICheckpoint.py
/tmp/MICheckpoint.py: No such file or directory.

[D01B0EB]

Seer uses Flatpak, I don't know what cause of /tmp messages. The settings are default.

[epasveer]

Okay. THanks. I'll do some digging around for information.

[epasveer]

Can you try this for me?

$ flatpak run --command=bash io.github.epasveer.seer
$ ls -ld /tmp
$ exit

And let me know the results of the "ls" command.

[D01B0EB]

λ flatpak run --command=bash io.github.epasveer.seer
[📦 io.github.epasveer.seer ~]$ ls -ld /tmp
drwx------ 3 herurg herurg 60 Apr 12 06:34 /tmp
[📦 io.github.epasveer.seer ~]$ exit
exit

[epasveer]

Thanks. That looks normal.

I'll continue looking.