mirror of
https://github.com/NationalSecurityAgency/ghidra.git
synced 2025-10-05 19:42:36 +02:00
Add GDB scripts for dynamic debugging of Win32 binaries via Wine.
This commit is contained in:
parent
92b15fed6e
commit
38eb0448b5
3 changed files with 107 additions and 0 deletions
|
@ -0,0 +1,22 @@
|
|||
# A GDB command to obtain the PID of a traced process, which must be running
|
||||
# on an x86 Linux host. This is primarily useful when running gdbserver.exe
|
||||
# under Wine.
|
||||
#
|
||||
# Note that binaries linked with non-executable stacks, such as those
|
||||
# created by the `-z,noexecstack` or `/NXCOMPAT` options, should replace
|
||||
# `($esp-7)` with an address that will be mapped to an executable region.
|
||||
# Selection of such an address is platform- and binary-specific.
|
||||
|
||||
define getpid-linux-i386
|
||||
# MOV eax,20 [SYS_getpid]
|
||||
# INT 0x80
|
||||
# RET
|
||||
set $linux_getpid = {int (void)}($esp-7)
|
||||
set {unsigned char[8]}($linux_getpid) = {\
|
||||
0xB8, 0x14, 0x00, 0x00, 0x00, \
|
||||
0xCD, 0x80, \
|
||||
0xC3 \
|
||||
}
|
||||
output $linux_getpid()
|
||||
echo \n
|
||||
end
|
|
@ -0,0 +1,79 @@
|
|||
# A GDB command for fetching /proc/{pid}/maps from a remote gdbserver,
|
||||
# formatted in the style of `info proc mappings`.
|
||||
#
|
||||
# usage: remote-proc-mappings PID
|
||||
|
||||
import contextlib
|
||||
import os
|
||||
import threading
|
||||
|
||||
@contextlib.contextmanager
|
||||
def pipe_fds():
|
||||
r_fd, w_fd = os.pipe()
|
||||
r_file = os.fdopen(r_fd, mode="rb")
|
||||
w_file = os.fdopen(w_fd, mode="wb")
|
||||
try:
|
||||
yield (r_file, w_file)
|
||||
finally:
|
||||
r_file.close()
|
||||
w_file.close()
|
||||
|
||||
class ReadThread(threading.Thread):
|
||||
def __init__(self, reader):
|
||||
super(ReadThread, self).__init__()
|
||||
self.__r = reader
|
||||
self.bytes = None
|
||||
|
||||
def run(self):
|
||||
self.bytes = bytearray(self.__r.read())
|
||||
|
||||
def reformat_line(raw_line):
|
||||
split = raw_line.decode("utf-8").split(None, 5)
|
||||
# split[0] range
|
||||
# split[1] mode
|
||||
# split[2] offset
|
||||
# split[3] major_minor
|
||||
# split[4] inode
|
||||
# split[5] object name
|
||||
start_addr_s, end_addr_s = split[0].split("-")
|
||||
start_addr = int(start_addr_s, 16)
|
||||
end_addr = int(end_addr_s, 16)
|
||||
if len(split) == 6:
|
||||
objfile = split[5]
|
||||
else:
|
||||
objfile = ""
|
||||
return "0x{:X} 0x{:X} 0x{:X} 0x{:X} {} {}\n".format(
|
||||
start_addr, end_addr,
|
||||
end_addr - start_addr,
|
||||
int(split[2], 16),
|
||||
split[1],
|
||||
objfile,
|
||||
)
|
||||
|
||||
class RemoteProcMappings(gdb.Command):
|
||||
def __init__(self):
|
||||
super(RemoteProcMappings, self).__init__("remote-proc-mappings", gdb.COMMAND_STATUS)
|
||||
|
||||
def invoke(self, arg, from_tty):
|
||||
argv = gdb.string_to_argv(arg)
|
||||
if len(argv) != 1:
|
||||
gdb.write("usage: remote-proc-mappings PID\n", gdb.STDERR)
|
||||
return
|
||||
|
||||
remote_pid = int(argv[0])
|
||||
|
||||
with pipe_fds() as (r_file, w_file):
|
||||
read_thread = ReadThread(reader = r_file)
|
||||
read_thread.start()
|
||||
maps_path = "/proc/{}/maps".format(remote_pid)
|
||||
pipe_writer_path = "/dev/fd/{}".format(w_file.fileno())
|
||||
gdb.execute("remote get {} {}".format(maps_path, pipe_writer_path))
|
||||
w_file.close()
|
||||
read_thread.join()
|
||||
raw_bytes = read_thread.bytes
|
||||
|
||||
for raw_line in raw_bytes.split(b"\n"):
|
||||
if raw_line:
|
||||
gdb.write(reformat_line(raw_line))
|
||||
|
||||
RemoteProcMappings()
|
|
@ -0,0 +1,6 @@
|
|||
define info proc mappings
|
||||
python
|
||||
remote_pid = gdb.execute("getpid-linux-i386", to_string=True).strip()
|
||||
gdb.execute("remote-proc-mappings {}".format(remote_pid))
|
||||
end
|
||||
end
|
Loading…
Add table
Add a link
Reference in a new issue