mirror of
https://github.com/NationalSecurityAgency/ghidra
synced 2024-08-28 13:30:21 +00:00
Merge remote-tracking branch
'origin/GP-2495_Dan_PR-4546_jmillikin_wine-win32-gdb-scripts' (Closes #4546)
This commit is contained in:
commit
0d52a4dfc2
|
@ -1,4 +1,6 @@
|
|||
##VERSION: 2.0
|
||||
##MODULE IP: JSch License
|
||||
Module.manifest||GHIDRA||||END|
|
||||
data/scripts/define_info_proc_mappings||GHIDRA||||END|
|
||||
data/scripts/fallback_info_proc_mappings.gdb||GHIDRA||||END|
|
||||
data/scripts/getpid-linux-i386.gdb||GHIDRA||||END|
|
||||
data/scripts/wine32_info_proc_mappings.gdb||GHIDRA||||END|
|
||||
|
|
|
@ -1,4 +0,0 @@
|
|||
define info proc mappings
|
||||
echo 0x0 0x7FFFFFFFFFFFFFFF 0x8000000000000000 0x0 lomem \n
|
||||
echo 0x8000000000000000 0xFFFFFFFFFFFFFFFF 0x8000000000000000 0x0 himem
|
||||
end
|
|
@ -0,0 +1,26 @@
|
|||
# Override the "info proc mappings" command in GDB to report the full 64-bit address space
|
||||
#
|
||||
# This presents the space in two regions, low and high, to avoid signedness bugs in Ghidra.
|
||||
#
|
||||
# To use:
|
||||
# 1. Consider the actual memory size of your target and copy and/or adjust this script
|
||||
# 2. Connect Ghidra to GDB on Linux
|
||||
# 3. From the interpreter, run:
|
||||
#
|
||||
# source fallback_info_proc_mappings.gdb
|
||||
#
|
||||
# Note that you may need to provide the full path to the script
|
||||
#
|
||||
# You can now launch or connect to your target in the usual way. This may cause Ghidra to display
|
||||
# more memory than is actually present on the target. As a result, randomly scrolling in the
|
||||
# dynamic listing may cause several erroneous reads, which may in turn may cause the target and/or
|
||||
# GDB to crash. Use with caution. The more accurate your memory map, the safer.
|
||||
#
|
||||
# Note that the connection should only be used with the target for which this script was tailored.
|
||||
# Re-using the connection for another target may result in sub-optimal performance and/or undefined
|
||||
# behavior.
|
||||
|
||||
define info proc mappings
|
||||
echo 0x0 0x7FFFFFFFFFFFFFFF 0x8000000000000000 0x0 lomem \n
|
||||
echo 0x8000000000000000 0xFFFFFFFFFFFFFFFF 0x8000000000000000 0x0 himem
|
||||
end
|
|
@ -0,0 +1,22 @@
|
|||
# A GDB command to obtain the PID of a traced process, which must be running
|
||||
# on an x86 Linux host. This is primarily useful when running gdbserver.exe
|
||||
# under Wine.
|
||||
#
|
||||
# Note that binaries linked with non-executable stacks, such as those
|
||||
# created by the `-z,noexecstack` or `/NXCOMPAT` options, should replace
|
||||
# `($esp-7)` with an address that will be mapped to an executable region.
|
||||
# Selection of such an address is platform- and binary-specific.
|
||||
|
||||
define getpid-linux-i386
|
||||
# MOV eax,20 [SYS_getpid]
|
||||
# INT 0x80
|
||||
# RET
|
||||
set $linux_getpid = {int (void)}($esp-7)
|
||||
set {unsigned char[8]}($linux_getpid) = {\
|
||||
0xB8, 0x14, 0x00, 0x00, 0x00, \
|
||||
0xCD, 0x80, \
|
||||
0xC3 \
|
||||
}
|
||||
output $linux_getpid()
|
||||
echo \n
|
||||
end
|
|
@ -0,0 +1,94 @@
|
|||
## ###
|
||||
# IP: GHIDRA
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
##
|
||||
# A GDB command for fetching /proc/{pid}/maps from a remote gdbserver,
|
||||
# formatted in the style of `info proc mappings`.
|
||||
#
|
||||
# usage: remote-proc-mappings PID
|
||||
|
||||
import contextlib
|
||||
import os
|
||||
import threading
|
||||
|
||||
@contextlib.contextmanager
|
||||
def pipe_fds():
|
||||
r_fd, w_fd = os.pipe()
|
||||
r_file = os.fdopen(r_fd, mode="rb")
|
||||
w_file = os.fdopen(w_fd, mode="wb")
|
||||
try:
|
||||
yield (r_file, w_file)
|
||||
finally:
|
||||
r_file.close()
|
||||
w_file.close()
|
||||
|
||||
class ReadThread(threading.Thread):
|
||||
def __init__(self, reader):
|
||||
super(ReadThread, self).__init__()
|
||||
self.__r = reader
|
||||
self.bytes = None
|
||||
|
||||
def run(self):
|
||||
self.bytes = bytearray(self.__r.read())
|
||||
|
||||
def reformat_line(raw_line):
|
||||
split = raw_line.decode("utf-8").split(None, 5)
|
||||
# split[0] range
|
||||
# split[1] mode
|
||||
# split[2] offset
|
||||
# split[3] major_minor
|
||||
# split[4] inode
|
||||
# split[5] object name
|
||||
start_addr_s, end_addr_s = split[0].split("-")
|
||||
start_addr = int(start_addr_s, 16)
|
||||
end_addr = int(end_addr_s, 16)
|
||||
if len(split) == 6:
|
||||
objfile = split[5]
|
||||
else:
|
||||
objfile = ""
|
||||
return "0x{:X} 0x{:X} 0x{:X} 0x{:X} {} {}\n".format(
|
||||
start_addr, end_addr,
|
||||
end_addr - start_addr,
|
||||
int(split[2], 16),
|
||||
split[1],
|
||||
objfile,
|
||||
)
|
||||
|
||||
class RemoteProcMappings(gdb.Command):
|
||||
def __init__(self):
|
||||
super(RemoteProcMappings, self).__init__("remote-proc-mappings", gdb.COMMAND_STATUS)
|
||||
|
||||
def invoke(self, arg, from_tty):
|
||||
argv = gdb.string_to_argv(arg)
|
||||
if len(argv) != 1:
|
||||
gdb.write("usage: remote-proc-mappings PID\n", gdb.STDERR)
|
||||
return
|
||||
|
||||
remote_pid = int(argv[0])
|
||||
|
||||
with pipe_fds() as (r_file, w_file):
|
||||
read_thread = ReadThread(reader = r_file)
|
||||
read_thread.start()
|
||||
maps_path = "/proc/{}/maps".format(remote_pid)
|
||||
pipe_writer_path = "/dev/fd/{}".format(w_file.fileno())
|
||||
gdb.execute("remote get {} {}".format(maps_path, pipe_writer_path))
|
||||
w_file.close()
|
||||
read_thread.join()
|
||||
raw_bytes = read_thread.bytes
|
||||
|
||||
for raw_line in raw_bytes.split(b"\n"):
|
||||
if raw_line:
|
||||
gdb.write(reformat_line(raw_line))
|
||||
|
||||
RemoteProcMappings()
|
|
@ -0,0 +1,27 @@
|
|||
# Override the "info proc mappings" command in GDB to fetch them from a remote wine32 target
|
||||
#
|
||||
# To use:
|
||||
# 1. Read the documentation for getpid-linux-i386.gdb carefully! You may need to copy and/or make
|
||||
# target-specific adjustments, since it needs to inject machine code. Some preliminary static
|
||||
# analysis may be required.
|
||||
# 2. Use Wine on Linux to launch gdbserver.exe with your target binary
|
||||
# 3. Connect Ghidra to GDB on Linux
|
||||
# 4. From the interpreter, run:
|
||||
#
|
||||
# source getpid-linux-i386.gdb
|
||||
# source remote-proc-mappings.py
|
||||
# source wine32_info_proc_mappings.gdb
|
||||
#
|
||||
# Note that you may need to provide full paths to the scripts
|
||||
#
|
||||
# You can now connect to the "remote" gdbserver.exe in the usual way, and Ghidra's Debugger should
|
||||
# work as usual. Note that the connection should only be used for 32-bit x86 Windows targets
|
||||
# running under Wine for Linux. Re-using the connection for another target may result in undefined
|
||||
# behavior.
|
||||
|
||||
define info proc mappings
|
||||
python
|
||||
remote_pid = gdb.execute("getpid-linux-i386", to_string=True).strip()
|
||||
gdb.execute("remote-proc-mappings {}".format(remote_pid))
|
||||
end
|
||||
end
|
Loading…
Reference in a new issue