修改被调试程序的二进制文件

#include <stdio.h>
#include <stdlib.h>

void drawing (int n)
{
  if (n != 0)
    puts ("Try again?\nAll you need is a dollar, and a dream.");
  else
    puts ("You win $3000!");
}

int main (void)
{
  int n;

  srand (time (0));
  n = rand () % 10;
  printf ("Your number is %d\n", n);
  drawing (n);

  return 0;
}

技巧

gdb不仅可以用来调试程序，还可以修改程序的二进制代码。

缺省情况下，gdb是以只读方式加载程序的。可以通过命令行选项指定为可写：

$ gcc -write ./a.out
(gdb) show write
Writing into executable and core files is on.

也可以在gdb中，使用命令设置并重新加载程序：

(gdb) set write on
(gdb) file ./a.out

接下来，查看反汇编：

(gdb) disassemble /mr drawing 
Dump of assembler code for function drawing:
5    {
   0x0000000000400642 <+0>:    55    push   %rbp
   0x0000000000400643 <+1>:    48 89 e5    mov    %rsp,%rbp
   0x0000000000400646 <+4>:    48 83 ec 10    sub    $0x10,%rsp
   0x000000000040064a <+8>:    89 7d fc    mov    %edi,-0x4(%rbp)

6      if (n != 0)
   0x000000000040064d <+11>:    83 7d fc 00    cmpl   $0x0,-0x4(%rbp)
   0x0000000000400651 <+15>:    74 0c    je     0x40065f <drawing+29>

7        puts ("Try again?\nAll you need is a dollar, and a dream.");
   0x0000000000400653 <+17>:    bf e0 07 40 00    mov    $0x4007e0,%edi
   0x0000000000400658 <+22>:    e8 b3 fe ff ff    callq  0x400510 <puts@plt>
   0x000000000040065d <+27>:    eb 0a    jmp    0x400669 <drawing+39>

8      else
9        puts ("You win $3000!");
   0x000000000040065f <+29>:    bf 12 08 40 00    mov    $0x400812,%edi
   0x0000000000400664 <+34>:    e8 a7 fe ff ff    callq  0x400510 <puts@plt>

10    }
   0x0000000000400669 <+39>:    c9    leaveq 
   0x000000000040066a <+40>:    c3    retq   

End of assembler dump.

修改二进制代码（注意大小端和指令长度）：

(gdb) set variable *(short*)0x400651=0x0ceb
(gdb) disassemble /mr drawing 
Dump of assembler code for function drawing:
5    {
   0x0000000000400642 <+0>:    55    push   %rbp
   0x0000000000400643 <+1>:    48 89 e5    mov    %rsp,%rbp
   0x0000000000400646 <+4>:    48 83 ec 10    sub    $0x10,%rsp
   0x000000000040064a <+8>:    89 7d fc    mov    %edi,-0x4(%rbp)

6      if (n != 0)
   0x000000000040064d <+11>:    83 7d fc 00    cmpl   $0x0,-0x4(%rbp)
   0x0000000000400651 <+15>:    eb 0c    jmp    0x40065f <drawing+29>

7        puts ("Try again?\nAll you need is a dollar, and a dream.");
   0x0000000000400653 <+17>:    bf e0 07 40 00    mov    $0x4007e0,%edi
   0x0000000000400658 <+22>:    e8 b3 fe ff ff    callq  0x400510 <puts@plt>
   0x000000000040065d <+27>:    eb 0a    jmp    0x400669 <drawing+39>

8      else
9        puts ("You win $3000!");
   0x000000000040065f <+29>:    bf 12 08 40 00    mov    $0x400812,%edi
   0x0000000000400664 <+34>:    e8 a7 fe ff ff    callq  0x400510 <puts@plt>

10    }
   0x0000000000400669 <+39>:    c9    leaveq 
   0x000000000040066a <+40>:    c3    retq   

End of assembler dump.

可以看到，条件跳转指令“je”已经被改为无条件跳转“jmp”了。

退出，运行一下：

$ ./a.out 
Your number is 2
You win $3000!

详情参见 gdb手册