diff --git a/Ghidra/Debug/Debugger-agent-gdb/certification.manifest b/Ghidra/Debug/Debugger-agent-gdb/certification.manifest index a3c4a5d5fa..4e32539fa4 100644 --- a/Ghidra/Debug/Debugger-agent-gdb/certification.manifest +++ b/Ghidra/Debug/Debugger-agent-gdb/certification.manifest @@ -1,4 +1,6 @@ ##VERSION: 2.0 ##MODULE IP: JSch License Module.manifest||GHIDRA||||END| -data/scripts/define_info_proc_mappings||GHIDRA||||END| +data/scripts/fallback_info_proc_mappings.gdb||GHIDRA||||END| +data/scripts/getpid-linux-i386.gdb||GHIDRA||||END| +data/scripts/wine32_info_proc_mappings.gdb||GHIDRA||||END| diff --git a/Ghidra/Debug/Debugger-agent-gdb/data/scripts/define_info_proc_mappings b/Ghidra/Debug/Debugger-agent-gdb/data/scripts/define_info_proc_mappings deleted file mode 100644 index 16b55477c8..0000000000 --- a/Ghidra/Debug/Debugger-agent-gdb/data/scripts/define_info_proc_mappings +++ /dev/null @@ -1,4 +0,0 @@ -define info proc mappings -echo 0x0 0x7FFFFFFFFFFFFFFF 0x8000000000000000 0x0 lomem \n -echo 0x8000000000000000 0xFFFFFFFFFFFFFFFF 0x8000000000000000 0x0 himem -end diff --git a/Ghidra/Debug/Debugger-agent-gdb/data/scripts/fallback_info_proc_mappings.gdb b/Ghidra/Debug/Debugger-agent-gdb/data/scripts/fallback_info_proc_mappings.gdb new file mode 100644 index 0000000000..b13fd97865 --- /dev/null +++ b/Ghidra/Debug/Debugger-agent-gdb/data/scripts/fallback_info_proc_mappings.gdb @@ -0,0 +1,26 @@ +# Override the "info proc mappings" command in GDB to report the full 64-bit address space +# +# This presents the space in two regions, low and high, to avoid signedness bugs in Ghidra. +# +# To use: +# 1. Consider the actual memory size of your target and copy and/or adjust this script +# 2. Connect Ghidra to GDB on Linux +# 3. From the interpreter, run: +# +# source fallback_info_proc_mappings.gdb +# +# Note that you may need to provide the full path to the script +# +# You can now launch or connect to your target in the usual way. This may cause Ghidra to display +# more memory than is actually present on the target. As a result, randomly scrolling in the +# dynamic listing may cause several erroneous reads, which may in turn may cause the target and/or +# GDB to crash. Use with caution. The more accurate your memory map, the safer. +# +# Note that the connection should only be used with the target for which this script was tailored. +# Re-using the connection for another target may result in sub-optimal performance and/or undefined +# behavior. + +define info proc mappings +echo 0x0 0x7FFFFFFFFFFFFFFF 0x8000000000000000 0x0 lomem \n +echo 0x8000000000000000 0xFFFFFFFFFFFFFFFF 0x8000000000000000 0x0 himem +end diff --git a/Ghidra/Debug/Debugger-agent-gdb/data/scripts/getpid-linux-i386.gdb b/Ghidra/Debug/Debugger-agent-gdb/data/scripts/getpid-linux-i386.gdb new file mode 100644 index 0000000000..3b45a68c26 --- /dev/null +++ b/Ghidra/Debug/Debugger-agent-gdb/data/scripts/getpid-linux-i386.gdb @@ -0,0 +1,22 @@ +# A GDB command to obtain the PID of a traced process, which must be running +# on an x86 Linux host. This is primarily useful when running gdbserver.exe +# under Wine. +# +# Note that binaries linked with non-executable stacks, such as those +# created by the `-z,noexecstack` or `/NXCOMPAT` options, should replace +# `($esp-7)` with an address that will be mapped to an executable region. +# Selection of such an address is platform- and binary-specific. + +define getpid-linux-i386 + # MOV eax,20 [SYS_getpid] + # INT 0x80 + # RET + set $linux_getpid = {int (void)}($esp-7) + set {unsigned char[8]}($linux_getpid) = {\ + 0xB8, 0x14, 0x00, 0x00, 0x00, \ + 0xCD, 0x80, \ + 0xC3 \ + } + output $linux_getpid() + echo \n +end diff --git a/Ghidra/Debug/Debugger-agent-gdb/data/scripts/remote-proc-mappings.py b/Ghidra/Debug/Debugger-agent-gdb/data/scripts/remote-proc-mappings.py new file mode 100644 index 0000000000..8093932ccd --- /dev/null +++ b/Ghidra/Debug/Debugger-agent-gdb/data/scripts/remote-proc-mappings.py @@ -0,0 +1,94 @@ +## ### +# IP: GHIDRA +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +## +# A GDB command for fetching /proc/{pid}/maps from a remote gdbserver, +# formatted in the style of `info proc mappings`. +# +# usage: remote-proc-mappings PID + +import contextlib +import os +import threading + +@contextlib.contextmanager +def pipe_fds(): + r_fd, w_fd = os.pipe() + r_file = os.fdopen(r_fd, mode="rb") + w_file = os.fdopen(w_fd, mode="wb") + try: + yield (r_file, w_file) + finally: + r_file.close() + w_file.close() + +class ReadThread(threading.Thread): + def __init__(self, reader): + super(ReadThread, self).__init__() + self.__r = reader + self.bytes = None + + def run(self): + self.bytes = bytearray(self.__r.read()) + +def reformat_line(raw_line): + split = raw_line.decode("utf-8").split(None, 5) + # split[0] range + # split[1] mode + # split[2] offset + # split[3] major_minor + # split[4] inode + # split[5] object name + start_addr_s, end_addr_s = split[0].split("-") + start_addr = int(start_addr_s, 16) + end_addr = int(end_addr_s, 16) + if len(split) == 6: + objfile = split[5] + else: + objfile = "" + return "0x{:X} 0x{:X} 0x{:X} 0x{:X} {} {}\n".format( + start_addr, end_addr, + end_addr - start_addr, + int(split[2], 16), + split[1], + objfile, + ) + +class RemoteProcMappings(gdb.Command): + def __init__(self): + super(RemoteProcMappings, self).__init__("remote-proc-mappings", gdb.COMMAND_STATUS) + + def invoke(self, arg, from_tty): + argv = gdb.string_to_argv(arg) + if len(argv) != 1: + gdb.write("usage: remote-proc-mappings PID\n", gdb.STDERR) + return + + remote_pid = int(argv[0]) + + with pipe_fds() as (r_file, w_file): + read_thread = ReadThread(reader = r_file) + read_thread.start() + maps_path = "/proc/{}/maps".format(remote_pid) + pipe_writer_path = "/dev/fd/{}".format(w_file.fileno()) + gdb.execute("remote get {} {}".format(maps_path, pipe_writer_path)) + w_file.close() + read_thread.join() + raw_bytes = read_thread.bytes + + for raw_line in raw_bytes.split(b"\n"): + if raw_line: + gdb.write(reformat_line(raw_line)) + +RemoteProcMappings() diff --git a/Ghidra/Debug/Debugger-agent-gdb/data/scripts/wine32_info_proc_mappings.gdb b/Ghidra/Debug/Debugger-agent-gdb/data/scripts/wine32_info_proc_mappings.gdb new file mode 100644 index 0000000000..ef08095ed9 --- /dev/null +++ b/Ghidra/Debug/Debugger-agent-gdb/data/scripts/wine32_info_proc_mappings.gdb @@ -0,0 +1,27 @@ +# Override the "info proc mappings" command in GDB to fetch them from a remote wine32 target +# +# To use: +# 1. Read the documentation for getpid-linux-i386.gdb carefully! You may need to copy and/or make +# target-specific adjustments, since it needs to inject machine code. Some preliminary static +# analysis may be required. +# 2. Use Wine on Linux to launch gdbserver.exe with your target binary +# 3. Connect Ghidra to GDB on Linux +# 4. From the interpreter, run: +# +# source getpid-linux-i386.gdb +# source remote-proc-mappings.py +# source wine32_info_proc_mappings.gdb +# +# Note that you may need to provide full paths to the scripts +# +# You can now connect to the "remote" gdbserver.exe in the usual way, and Ghidra's Debugger should +# work as usual. Note that the connection should only be used for 32-bit x86 Windows targets +# running under Wine for Linux. Re-using the connection for another target may result in undefined +# behavior. + +define info proc mappings + python +remote_pid = gdb.execute("getpid-linux-i386", to_string=True).strip() +gdb.execute("remote-proc-mappings {}".format(remote_pid)) + end +end