Log in

View Full Version : IDA Pro v5.2 debugging problem


sailor__eda
January 16th, 2008, 21:00
I'm using IDA Pro v5.2 to debug an x86-64 program in linux.
I'm using the native IDA Pro version for linux. My problem is when I start to debug (I know IDA isn't the best proggy for debugging but in linux there isn't much of a choice esp for x86-64 stuff).

The problem happens when I set a breakpoint. After the breakpoint hits, I can single step some instructions but not function calls. When I single step over or into a function call, I get a sigsegv warning. Some instructions like pop also give a sigsegv fault. It is really strange because I can move my breakpoint to right after the function call and if I restart the debugging session, everything works fine that is until I have another function call that is.

I've played with various debug options and none of them seem to work. I've got the same code in x86 and using the 32bit version of ida, the single stepping works fine. This problem is only with the 64bit version. The same error happens if I try to do a remote debug session from windows.

Needless to say, we can't post to datarescue's website so I was wondering if anybody has any experience with this. Googling on this doesn't reveal anything related to this problem.

thanks,

Sailor_eda

Aimless
January 16th, 2008, 23:12
On a slightly unknown point...

It seems that EVERY release of IDA (Say, Ida v5.0, v5.1 or v5.2 and no doubt in the future) PURPOSELY has bugs. In this case, its not "bugs for bucks" but "bugs for protection". And so far this approach has worked very well. This is a protection mechanism that Ilfak implements (I think). Whenever a genuine customer complains, he is given a PATCH to update and solve this issue. This ensures, in the remote event that the latest version of IDA is warezed, it STILL will not work correctly. For eg. v5.1 did not have the capacity to properly trace.

So, this could be a genuine issue in configuration of your linux (doubtful), a bug in IDA (possible) OR a fault introduced to limit warezed copies of IDA being useful (very likely).

Just my two cents...

Have Phun