-
Notifications
You must be signed in to change notification settings - Fork 1.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Bugfix gdb.debug: exe parameter now respected #2233
Conversation
This commit now properly supports the exe parameter in `pwnlib/gdb.py:debug()`, allowing a different argv[0] than the executable. It achieves this by leveraging the gdbsever`--wrapper` argument with a python script that calls execve with the specified args.
Hi, just wanted to ask if there are any changes you require me to make to the pull request or is it ready to merge? |
I didn't have time to test this yet :/ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sorry for the huge delay!
This check checks prevents the use of "=" in the key of an environment variable, which is generally impossible.
Co-authored-by: peace-maker <[email protected]>
1. explicit ctypes.CDLL('libc.so.6'), handle execve failing 2. consistent namedTempFile 3. drop packing._encode() since it's done earlier 4. testcases solve argv-args confusion
Please have a look at the test failures here: https://github.com/Gallopsled/pwntools/actions/runs/6259779607/job/16996463774?pr=2233#step:16:303 |
Ok, that passes the tests now. |
Actually the wrapper script could (and maybe should?) be reused with spawning carefully tailored remote processes over ssh, we already have a big Python function there. I think that function is not the best piece of code currently, but having two such functions is too many probably. |
I addressed the wrapper script now by creating a new function in Anything else that needs to be resolved? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Very cool, thank you for your persistence working on this!
I've changed the few things I noticed myself to speed this up.
Reopening #2227, since the Coverage tests didn't seem to handle changing the target branch correctly.
This commit now properly supports the exe parameter in
pwnlib/gdb.py:debug()
, allowing a different argv[0] than the executable. (See Issue #1273 )It achieves this by leveraging the gdbsever
--wrapper
argument with a python script that calls execve with the specified args.For remote connections
ssh.process(run=False)
already creates a python script that we can use.Details
/tmp/pwn-XXXXXX.py
gdbserver
has no native support forargv[0]
Therefore we leverage the
--wrapper
flag, which allows us to execute an arbitrary command.gdbserver
will attach to the first unforkedexecve
system call.The command will then be
gdbserver --wrapper /tmp/pwn-XXXXXX.py -- <other gdbserver args>