How to change the eflags register value in GDB?

问题

set $eflags does not change eflags value.

The old eflags value remains after eg. =>$set $eflag=0x243 [this is just an example input].

Alternatively, is there any way to set individual flags of eflags?

I'm looking for something like: set ZF[zero flag]. Is there a gdb command to do that?

回答1:

set $eflags without parenthesis works in GDB 7.7.1

To set an individual flag, use its index. E.g., ZF is the 6th bit, so we can set it with:

set $ZF = 6                 # define a GDB variable: no effect on registers
set $eflags |= (1 << $ZF)   # set bit 6 in EFLAGS, the ZF bit.

The same goes for all other bitwise operations: How do you set, clear, and toggle a single bit?

# Clear
set $eflags &= ~(1 << $ZF)

# Toggle
set $eflags ^= (1 << $ZF)

What causes confusion is that many bits are either reserved, cannot be modified directly by any instruction, or cannot be modified from user mode, see also: How to read and write x86 flags registers directly? and so GDB does not touch them.

For example:

(gdb) set $eflags = 0
(gdb) i r eflags
eflags         0x202    [ IF ]
(gdb) set $eflags = 0xFFFFFFFF
(gdb) i r eflags
eflags         0x54fd7  [ CF PF AF ZF SF TF IF DF OF NT RF AC ]

0x202 in binary is:

0010 0000 0010

0x54fd7 in binary is:

0101  0100 1111 1101 0111

TODO understand why each of those bits were set or not, by looking at the manual http://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-vol-1-manual.pdf and GDB source code.

Ones that I understand:

all reserved registers were left at their fixed value: 1 for bit 1, and 0 for bits 3, 5, 15 and 22-31

回答2:

set ($eflags)=0x243

worked in my tests for any hex value.

回答3:

It's wrong to set all flags in eflags register. So some bits reserved and must be 0.(3,5,15,22 and greater) bit 1 must be 1. There is rflags too. But all hi dword is zero. So there is no need to use rflags instead of eflags for all operations changed flags. But I know peoples that use free bits for own usage.

More suitable rflags hi dword. So in 64-bit architecture enough free registers to use. But in 32-bit architecture, no. So strongly recommend to do so.

Because in future architectures some of these bits may be used. But these flags are not touched from changing 32-bit to 64-bit. If the only register that may be not changed at all. So all possible reasons for any case already used. I don't imagine any situation that may be used some additional flag don't be used till now. It may be to some cardinal processor architecture change. I don't think some decide to do so for obvious reason all soft must be thrown out and rewritten from the very beginning. It's extremely hard and huge work.