Debug Assembly with GDB

When Source Lies, GDB Shows Machine Truth

Optimized builds drop variables, reorder code, and inline everything. Kernel engineers and exploit analysts then live in GDB stepping machine instructions. The same muscle memory transfers to LLDB on macOS and rr for deterministic replay.

bashCopy
Loading…

• starti: begin at the first instruction, not libc main
• si / ni: step one instruction, or step over call
• x/10x $rsp: examine stack memory as hex
• *break label: breakpoint at an assembly symbol

Flags Explain Branches

After cmp, watch ZF (zero), SF (sign), CF (unsigned borrow), OF (signed overflow). The next jcc reads those bits.

For this exercise, you will compile a small loop with -g and step it in GDB, printing register snapshots. This task asks you to narrate what each instruction did, because production segfaults with stripped binaries only yield to this workflow.

Keep the relevant man page, ABI doc, or Rust reference chapter open while you work. When your output disagrees with the reference implementation on the same machine, the mismatch is usually an alignment rule, an off-by-one terminator, or a register slot you misread in GDB. Skim the official documentation for the tool or ABI named in the exercise; the prose changes, but register roles, syscall numbers, and ownership rules stay stable across releases.