Question

我的Ubuntu 12.04（64位）上有一个程序（不是shell脚本），它运行正常但是，当我使用gdb附加它时，得到消息文件格式无法识别。这非常令人费解。知道为什么吗？感谢。

# gdb -p 25016
GNU gdb (Ubuntu/Linaro 7.4-2012.04-0ubuntu2.1) 7.4-2012.04
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://bugs.launchpad.net/gdb-linaro/>.
Attaching to process 25016
"/home/test/engine": not in executable format: **File format not recognized**


# file /home/test/engine
engine: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), for GNU/Linux 2.4.0, dynamically linked (uses shared libs), stripped
# which gdb
/usr/bin/gdb
# file /usr/bin/gdb
/usr/bin/gdb: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, BuildID[sha1]=0x8cd6c593fd6ffe6fd72266bf3d3407ea599b8143, stripped
root@jin1-HP:~/projs/jsStress_compile

Answer 1

GNU gdb（Ubuntu / Linaro 7.4-2012.04-0ubuntu2.1）7.4-2012.04

这个GDB已经很老了（目前的GDB版本是7.7）。尝试使用较新的GDB重现此问题。

如果问题仍然存在，则可能

GDB中存在错误
engine程序是故意损坏的ELF文件，采用某种反调试/反逆向工程技术。

如果你可以在某处提供engine二进制文件，我可以看看。

Answer 2

也许这个程序是发行版，而不是调试版。

gdb无法识别正在运行的程序的格式

2 个答案: