Re: Is GDB just for bug hunting?

[Paul Koning <paulkoning@comcast.net>]

I'll give some comments from the point of view of a user of gdb.

	paul

> On Apr 14, 2021, at 1:48 PM, Jason Long via Gdb <gdb@sourceware.org> wrote:
> 
> Hello,
> I have some questions and I'm thankful if someone answer to them clearly:
> 
> 1- I want to know, is GDB just useful for bug hunting or a security researcher can use it to find vulnerabilities too?
> 
> 2- Is bug vs vulnerability? Consider someone that find an exploit in a program. He/she found a bug or Vulnerability? He/she used a debugger to find that or any special tool?

A bug is any unintended behavior of a program, and more specifically an unintended behavior that has "bad" consequences.  So a vulnerability is a bug -- obviously by the first definition and almost certainly by the second as well.  But a lot of bugs are not vulnerabilities in the sense that the word is typically used.

I don't know what tools are specific to vulnerability search.  GDB does several things.  It lets you examine and modify a running process, and control the execution of a process (via breakpoints or stepping or the like) to find defects and especially to identify the exact cause of a previously observed defect.

It seems to me that finding a vulnerability (exploit) is more like discovering a bug (learnings of its existence) in the first place.  That's more likely to involve test tools or code reviews rather than GDB sessions.  Once a vulnerability (bug) has been recognized, the debugger can help understand the precise mechanism that caused it to exist, and suggest a solution.

I suppose another thing a GDB session could do is show sensitive data exposure; if a program handles sensitive data and allows that to exist in memory longer than strictly necessary, that's a risk and examining memory with GDB may be an easy way to spot such mistakes.  That would show potential risks like missing zeroization, though it would not necessarily tell you whether that's merely sloppy code or an actual weakness.

> 3- A debugger could be a Vulnerability researcher or vice versa?

I think mostly not.   While there's an overlap in tools and in what you look for, it seems to me the mindset of the two are rather different.  As an analogy, there's some overlap between cryptographers and programmers, but very few programmers are cryptographers.

	paul