GDB seems to set breakpoints on functions at the wrong place

GDB seems to set breakpoints on functions at the wrong place

[Steven Murdoch]

[-- Attachment #1: Type: text/plain, Size: 3094 bytes --]

I am writing a tool to print out the arguments passed to certain
functions, and have based it on GDB, but have a problem where GDB
sometimes sets the breakpoints before $ebp is set, and sometimes after
which makes getting arguments difficult.

For example, the output below is from GDB 5.3 on Debian Sarge. In it I
set breakpoints on both scanf and strcpy. The strcpy breakpoint is set
after "mov %esp,%ebp" which seems to be the normal behaviour. This means I
can get the second argument using "print *((char**)($ebp+0x08))", just
as is done in the function. Whereas the breakpoint in scanf is set
before the "%esp,%ebp" which means I have to get the arguments as if I
am in the calling function - "print *((char**)($esp+0x04))"

I think this is a bug, but would like to check before reporting it.
Any advice would be appreciated. Is there a reliable mechanism for
finding the arguments to a function? Currently I am thinking about
setting breakpoints at *function_name, which seems to consistently set
breakpoints before $ebp is set. This is not as nice as doing it after
(as it is different from the way arguments are used in the function),
but since I am writing an automated tool, consistency is the most
important thing.

Thank you,
Steven Murdoch.

--- begin output ---

GNU gdb 5.3-debian
[...]
This GDB was configured as "i386-linux"...
(gdb) break scanf
Breakpoint 1 at 0x80482c0

(gdb) break strcpy
Breakpoint 2 at 0x80482f0

(gdb) run
Starting program: /home/sjm217/gdb_test 
Breakpoint 1 at 0x40081840
Breakpoint 2 at 0x40099413

Breakpoint 1, 0x40081840 in scanf () from /lib/libc.so.6
(gdb) disass scanf
Dump of assembler code for function scanf:
[breakpoint is triggered here, before %ebp is set]
0x40081840 <scanf>:     push   %ebp
0x40081841 <scanf+1>:   xor    %edx,%edx
0x40081843 <scanf+3>:   mov    %esp,%ebp
0x40081845 <scanf+5>:   lea    0xc(%ebp),%eax
0x40081848 <scanf+8>:   sub    $0x14,%esp
0x4008184b <scanf+11>:  mov    %eax,0x8(%esp,1)
[...]
End of assembler dump.

(gdb) print *((char**)($ebp+0x08))
$1 = 0x1 <Address 0x1 out of bounds>
[Normal method of getting variable doesn't work]

(gdb) print *((char**)($esp+0x04))
$2 = 0x8048524 "%s"
[It has to be done as if in the calling function]

(gdb) cont
Continuing.
Hello
Breakpoint 2, 0x40099413 in strcpy () from /lib/libc.so.6

(gdb) disass strcpy
Dump of assembler code for function strcpy:
0x40099410 <strcpy>:    push   %ebp
0x40099411 <strcpy+1>:  mov    %esp,%ebp
[breakpoint is set here, after %ebp is set]
0x40099413 <strcpy+3>:  mov    0xc(%ebp),%edx
0x40099416 <strcpy+6>:  push   %esi
0x40099417 <strcpy+7>:  mov    0x8(%ebp),%esi
0x4009941a <strcpy+10>: mov    %esi,%eax
[...]
End of assembler dump.

(gdb) print *((char**)($ebp+0x0c))
$3 = 0x8048527 "bar"
[But in strcpy it works normally]

--- end output ---


--- begin gdb_test.c ---

#include <stdio.h>
#include <string.h>

int main() {
  char foo[10];
  scanf("%s",foo);
  strcpy(foo, "bar");
  printf("%s\n",foo);
}

--- end gdb_test.c ---


[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: GDB seems to set breakpoints on functions at the wrong place

[Andrew Cagney]

> I am writing a tool to print out the arguments passed to certain
> functions, and have based it on GDB, but have a problem where GDB
> sometimes sets the breakpoints before $ebp is set, and sometimes after
> which makes getting arguments difficult.
> 
> For example, the output below is from GDB 5.3 on Debian Sarge. In it I
> set breakpoints on both scanf and strcpy. The strcpy breakpoint is set
> after "mov %esp,%ebp" which seems to be the normal behaviour. This means I
> can get the second argument using "print *((char**)($ebp+0x08))", just
> as is done in the function. Whereas the breakpoint in scanf is set
> before the "%esp,%ebp" which means I have to get the arguments as if I
> am in the calling function - "print *((char**)($esp+0x04))"
> 
> I think this is a bug, but would like to check before reporting it.
> Any advice would be appreciated. Is there a reliable mechanism for
> finding the arguments to a function? Currently I am thinking about
> setting breakpoints at *function_name, which seems to consistently set
> breakpoints before $ebp is set. This is not as nice as doing it after
> (as it is different from the way arguments are used in the function),
> but since I am writing an automated tool, consistency is the most
> important thing.

Can you try reproducing this with a current (6.1.1) GDB?  GDB 5.3 is 
very old.

Andrew