Update: A much easier way is to use gdbserver.
Start qemu with the following parameters:
$ qemu-system-x86_64 -s -S -m 512 -hda winxp.img
And connect with gdb like this:
$ gdb (gdb) target remote localhost:1234 (gdb) set architecture i8086 (gdb) break *0x7c00 (gdb) cont
This will breakpoint at 0x7c00, which is when the boot sector has been loaded into memory by the BIOS and control is passed to the boot sector.
You can use ordinary gdb commands to disassemble and debug the guest.
Thanks for this. I was really struggling trying to figure out why i was always ending up at 0xfff0 instead of 0x7c00. The breakpoint did the trick. Interestingly, I had a ‘layout asm’ in there before the breakpoint and nothing at all seems to work in that mode.
Pingback: ForbiddenBITS CTF 2013 – Old 50 Write up | sysexit
Pingback: Tip: Poor man’s qemu breakpoint | Richard WM Jones