Presently, my phone is a Samsung Galaxy S3 GT-I9300. But in general the following steps should be applicable to any Android device.
First, download Android SDK and NDK. From SDK you can get the “adb” to connect into the phone. From NDK you can get the gdbserver in ARM binary, upload that to the phone via “adb”.
Next mount the /system as read-writeable (you need to be root first, ie, a rooted device is assumed):
mount -o rw,remount /dev/block/mmcblk0p9 /system
(the block device “/dev/block/mmcblk0p9” is specific to my device, yours may differ. Just use “mount” to see which block device the “/system” directory is mounted on. If “/system” does not appear in “mount” command, then most probably the root filesystem block device should be used.)
And then copy the gdbserver from the Android NDK into /system/bin directory.
Next, assuming the process ID of the target process is 16835, then run this inside the Android phone (MUST BE ISSUED AS “root” user again):
gdbserver :4567 --attach 16835 Attached; pid = 16835 Listening on port 4567
In another PC (which is accessible by TCP/IP from the phone, download all the ARM-based libraries from the phone and run the gdb client):
Get all the ARM libraries and the target binaries (to be debugged, and in my case, it is called “debuggerd”) from mobile phone:
adb pull /system/lib /tmp/system_lib
And run the gdb client (which is from the NDK) on the PC side (and remember to disable all firewall via “iptables -F” and “ip6tables -F” just in case they are interfering with the network transfer:
/android-ndk-r7/toolchains/arm-linux-androideabi-4.4.3/prebuilt/linux-x86/bin/arm-linux-androideabi-gdb /tmp/debuggerd (gdb) set auto-solib-add on (gdb) target remote 10.10.1.25:7892 (gdb) set solib-search-path /tmp/system_lib
Subsequent messages:
Error while mapping shared library sections: /system/bin/linker: No such file or directory. Symbol file not found for /system/bin/linker Reading symbols from /tmp/system_lib/libc.so...(no debugging symbols found)...done. Loaded symbols for /tmp/system_lib/libc.so Reading symbols from /tmp/system_lib/libstdc++.so...(no debugging symbols found)...done. Loaded symbols for /tmp/system_lib/libstdc++.so
As shown above, all the dynamic libraries files are read and recognized by the gdb client, except for “/system/bin/linker”.
(gdb) info sharedlibrary From To Syms Read Shared Object Library No /system/bin/linker 0x4015a0c0 0x401882d4 Yes /tmp/system_lib/libc.so 0x4019e934 0x4019ea3c Yes /tmp/system_lib/libstdc++.so 0x401a1f70 0x401b1db8 Yes /tmp/system_lib/libm.so 0x400332a0 0x4004441c Yes /tmp/system_lib/libz.so 0x400b1a00 0x401172b8 Yes /tmp/system_lib/libcrypto.so 0x4005f530 0x4007798c Yes /tmp/system_lib/libssl.so (gdb)
After this you can issue “x /100i <addr>” to enumerate the instructions starting from <addr> running on the Android device, or “s” to single step through all the instructions. Just remember that the process is always 16835 as specified earlier.
Done.
My Technical Blog 