I am very new to Ghidra, so please accept my apologies if my question sounds too simple. Despite the poor quality of the Internet in my country, I tried my best to find an answer online before asking but I could not find much.
Imagine we have a Linux shared object named CustLib.so
, that exports one single function named Func
.
Furthermore, imagine a program (let's call it ClientProg
) imports Func
from CustLib.so
and calls it from its main
.
What I have been trying to do with Ghidra is:
Load
CustLib.so
into Ghidra, Analyze it, and put a breakpoint somewhere within the decompiled code pertaining toFunc
.Load
ClientProg
into Ghidra, Analyze it, and start it in the Debugger.Wait until
ClientProg
callsFunc
, at which point I expect Ghidra to break on the breakpoint I had previously set atFunc
.
To my surprise, the last step above never happens. ClientProg
runs from start to completion (in GDB IN-VM mode), without ever breaking on Func
.
Could I ask whether I am actually missing something? Or am I expecting an unsupported functionality? Many thanks.
ClientProg
in Ghidra, only breakpoints inClientProg
will hit, notCustLib.so
. Instead, you should do something like start debugging the.so
but with the application path (not the file path) pointing toClientProg
, soClientProg
can be started andCustLib.so
will be debugged. I don't know how to do this in Ghidra (due to my lack experiences with Ghidra), but that is how I would do in IDA