Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bugfix gdb.debug: exe parameter now respected #2233

Merged
merged 25 commits into from
Feb 16, 2024

Conversation

goreil
Copy link
Contributor

@goreil goreil commented Jul 19, 2023

Reopening #2227, since the Coverage tests didn't seem to handle changing the target branch correctly.

This commit now properly supports the exe parameter in pwnlib/gdb.py:debug(), allowing a different argv[0] than the executable. (See Issue #1273 )

It achieves this by leveraging the gdbsever--wrapper argument with a python script that calls execve with the specified args.
For remote connections ssh.process(run=False) already creates a python script that we can use.

Details

  1. We create a python script, that calls execve with our arguments
    /tmp/pwn-XXXXXX.py
#!<local python version>
import ctypes
...
ctypes.CDLL(None).execve(exe, argv, env)
  1. gdbserver has no native support for argv[0]

Therefore we leverage the --wrapper flag, which allows us to execute an arbitrary command. gdbserver will attach to the first unforked execve system call.

The command will then be
gdbserver --wrapper /tmp/pwn-XXXXXX.py -- <other gdbserver args>

goreil and others added 8 commits July 12, 2023 14:37
This commit now properly supports the exe parameter in
`pwnlib/gdb.py:debug()`, allowing a different argv[0] than the
executable.

It achieves this by leveraging the gdbsever`--wrapper` argument
with a python script that calls execve with the specified args.
@goreil goreil marked this pull request as ready for review July 19, 2023 13:05
@goreil
Copy link
Contributor Author

goreil commented Jul 24, 2023

Hi, just wanted to ask if there are any changes you require me to make to the pull request or is it ready to merge?

@peace-maker
Copy link
Member

I didn't have time to test this yet :/

@Arusekk Arusekk linked an issue Jul 24, 2023 that may be closed by this pull request
@peace-maker peace-maker added this to the 4.12.0 milestone Jul 25, 2023
Copy link
Member

@peace-maker peace-maker left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry for the huge delay!

pwnlib/gdb.py Outdated Show resolved Hide resolved
pwnlib/gdb.py Show resolved Hide resolved
pwnlib/gdb.py Show resolved Hide resolved
pwnlib/gdb.py Outdated Show resolved Hide resolved
pwnlib/gdb.py Outdated Show resolved Hide resolved
pwnlib/gdb.py Outdated Show resolved Hide resolved
pwnlib/gdb.py Outdated Show resolved Hide resolved
pwnlib/gdb.py Outdated Show resolved Hide resolved
pwnlib/gdb.py Outdated Show resolved Hide resolved
pwnlib/gdb.py Outdated Show resolved Hide resolved
pwnlib/gdb.py Outdated Show resolved Hide resolved
@peace-maker peace-maker modified the milestones: 4.12.0, 4.13.0 Sep 18, 2023
goreil and others added 3 commits September 21, 2023 11:06
Co-authored-by: peace-maker <[email protected]>
1. explicit ctypes.CDLL('libc.so.6'), handle execve failing
2. consistent namedTempFile
3. drop packing._encode() since it's done earlier
4. testcases solve argv-args confusion
@peace-maker
Copy link
Member

@goreil
Copy link
Contributor Author

goreil commented Sep 30, 2023

Ok, that passes the tests now.

@goreil goreil requested a review from peace-maker October 9, 2023 15:28
@Arusekk
Copy link
Member

Arusekk commented Nov 24, 2023

Actually the wrapper script could (and maybe should?) be reused with spawning carefully tailored remote processes over ssh, we already have a big Python function there. I think that function is not the best piece of code currently, but having two such functions is too many probably.

@goreil
Copy link
Contributor Author

goreil commented Nov 26, 2023

I addressed the wrapper script now by creating a new function in
misc.create_execve_script

Anything else that needs to be resolved?

Copy link
Member

@peace-maker peace-maker left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Very cool, thank you for your persistence working on this!

I've changed the few things I noticed myself to speed this up.

@peace-maker peace-maker merged commit d9b3e17 into Gallopsled:dev Feb 16, 2024
11 of 13 checks passed
@goreil goreil deleted the stable-gdb-exe branch February 17, 2024 06:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

gdb.debug() - exe parameter is not respected
3 participants