set $eflags does not change eflags value.
The old eflags value remains after eg. =>$set $eflag=0x243 [this is just an example input].
Alternatively, is there any way to set individual flags of eflags?
I'm looking for something like: set ZF[zero flag]. Is there a gdb command to do that?
set $eflags without parenthesis works in GDB 7.7.1
To set an individual flag, use its index. E.g., ZF is the 6th bit, so we can set it with:
set $ZF = 6 # define a GDB variable: no effect on registers
set $eflags |= (1 << $ZF) # set bit 6 in EFLAGS, the ZF bit.
The same goes for all other bitwise operations: How do you set, clear, and toggle a single bit?
# Clear
set $eflags &= ~(1 << $ZF)
# Toggle
set $eflags ^= (1 << $ZF)
What causes confusion is that many bits are either reserved, cannot be modified directly by any instruction, or cannot be modified from user mode, see also: How to read and write x86 flags registers directly? and so GDB does not touch them.
For example:
(gdb) set $eflags = 0
(gdb) i r eflags
eflags 0x202 [ IF ]
(gdb) set $eflags = 0xFFFFFFFF
(gdb) i r eflags
eflags 0x54fd7 [ CF PF AF ZF SF TF IF DF OF NT RF AC ]
0x202 in binary is:
0010 0000 0010
0x54fd7 in binary is:
0101 0100 1111 1101 0111
TODO understand why each of those bits were set or not, by looking at the manual http://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-vol-1-manual.pdf and GDB source code.
Ones that I understand:
set ($eflags)=0x243
worked in my tests for any hex value.
It's wrong to set all flags in eflags register. So some bits reserved and must be 0.(3,5,15,22 and greater) bit 1 must be 1. There is rflags too. But all hi dword is zero. So there is no need to use rflags instead of eflags for all operations changed flags. But I know peoples that use free bits for own usage.
More suitable rflags hi dword. So in 64-bit architecture enough free registers to use. But in 32-bit architecture, no. So strongly recommend to do so.
Because in future architectures some of these bits may be used. But these flags are not touched from changing 32-bit to 64-bit. If the only register that may be not changed at all. So all possible reasons for any case already used. I don't imagine any situation that may be used some additional flag don't be used till now. It may be to some cardinal processor architecture change. I don't think some decide to do so for obvious reason all soft must be thrown out and rewritten from the very beginning. It's extremely hard and huge work.
eflags [ ZF ]
And if you want to set arbitrary value use this
eflags 0x42
