Hi,
I am trying to understand the inner workings of a debugger and I found
a gdb behaviour that puzzles me.
I understand that if I set a software breakpoint (as opposed to
an hw breakpoint), gdb will insert an architecture-dependent
instruction
in the .text section that will cause an exception, that will be handled
by gdb.
I am using gdb 6.1.1 on FreeBSD i386, so looking at the gdb source,
the i386 has the breakpoint instruction 0xcc.
I tought of doing something like (in various incantations):
(gdb) disassemble foo
(gdb) break foo
(gdb) disassemble foo
and was expecting of seeing the 0xcc instruction in the output of
the second disassemble command; instead the output is the same
as the first disassemble. Same results with the x command.
It seems that gdb wants to "protect" me from seing that the executable
is changed?
Finally I came up with a function that scans the .text section of
the same program (a sort of very naive debugger detector)
and hex dumps it. I ran the same program with and without
breakpoint and my scan function works as expected: when the breakpoint
is
set I see it in the hex dump.
So somehow I have my sanity back, but the question remains: how
can I see the breakpoint instruction from gdb itself?
thanks
marco
--
panic("The moon has moved again.");