GDB for WinDbg Users

With memory dump analysis pattern examples for Mac OS X we resume our table of command correspondence between WinDbg and GDB we started in Volume 1 providing some corrections on the way. For example, in the previous version of table we omitted a correspondence to ub WinDbg command. Now we provide such an equivalent (by default offsets are decimal):

(gdb) bt
[...]
#1 0×000000010e8cce73 in bar (ps=0×7fff6e4cbac0)
[...]


(gdb) disas 0×000000010e8cce73-10 0×000000010e8cce73
Dump of assembler code from 0×10e8cce69 to 0×10e8cce73:
0×000000010e8cce69 : mov %edi,-0×8(%rbp)
0×000000010e8cce6c : mov -0×8(%rbp),%rdi
0×000000010e8cce70 : callq *0×8(%rdi)
End of assembler dump.

Please note that the beginning of assembly will be dependent on how good we guessed the offset:

(gdb) disas 0x000000010e8cce73-0×10 0×000000010e8cce73
Dump of assembler code from 0×10e8cce63 to 0×10e8cce73:
0×000000010e8cce63 : in $0×48,%eax
0×000000010e8cce65 : sub $0×10,%esp
0×000000010e8cce68 : mov %rdi,-0×8(%rbp)
0×000000010e8cce6c : mov -0×8(%rbp),%rdi
0×000000010e8cce70 : callq *0×8(%rdi)
End of assembler dump.

(gdb) disas 0x000000010e8cce73-0×13 0×000000010e8cce73
Dump of assembler code from 0×10e8cce60 to 0×10e8cce73:
0×000000010e8cce60 : push %rbp
0×000000010e8cce61 : mov %rsp,%rbp
0×000000010e8cce64 : sub $0×10,%rsp
0×000000010e8cce68 : mov %rdi,-0×8(%rbp)
0×000000010e8cce6c : mov -0×8(%rbp),%rdi
0×000000010e8cce70 : callq *0×8(%rdi)
End of assembler dump.

However, we can ignore that because usually when analyzing raw stack data symbolic references our goal is to check whether a CPU instruction before a return address is a call.

Additional commands we add are x/<N>bc for db (WinDbg), thread <N> for ~<N>s (WinDbg, process dumps), maintenance info sections for !address (WinDbg), add-symbol-file for .reload (WinDbg), info r for r (WinDbg).

Action                      | GDB                  | WinDbg
----------------------------------------------------------------
Start the process           | run                  | g
Exit                        | (q)uit               | q
Disassemble (forward)       | (disas)semble        | uf, u
Disassemble N instructions  | x/<N>i               | -
Disassemble (backward)      | disas <a-o> <a>      | ub
Stack trace                 | backtrace (bt)       | k
Full stack trace            | bt full              | kv
Stack trace with parameters | bt full              | kP
Partial trace (innermost)   | bt <N>               | k <N>
Partial trace (outermost)   | bt -<N>              | -
Stack trace for all threads | thread apply all bt  | ~*k
Breakpoint                  | break                | bp
Frame numbers               | any bt command       | kn
Select frame                | frame                | .frame
Display parameters          | info args            | dv /t /i /V
Display locals              | info locals          | dv /t /i /V
Dump byte char array        | x/<N>bc              | db
Switch to thread            | thread <N>           | ~<N>s
Sections/regions            | maint info sections  | !address
Load symbol file            | add-symbol-file      | .reload
CPU registers               | i(nfo) r             | r

Note: In Mac OS X Mavericks GDB was replaced by LLDB and Software Diagnostics Services updated its Mac OS X Core Dump Analysis training course²¹.

²¹ Accelerated Mac OS X Core Dump Analysis, Second Edition: Training Course Transcript with GDB and LLDB Practice Exercises (ISBN: 9781908043719)