mirror of
https://github.com/hugsy/gef.git
synced 2026-10-11 21:49:56 +00:00
[Docs] Added linting for markdown files (#977)
* adding a note about required common bins (issue #973) * added markdownlint policy * applied markdownlint * customized mdlint config
This commit is contained in:
crazy hugsy
+1
-1
@@ -21,4 +21,4 @@ indent_style = space
|
||||
indent_size = 2
|
||||
|
||||
[*.md]
|
||||
max_line_length=100
|
||||
max_line_length = 100
|
||||
|
||||
@@ -0,0 +1,259 @@
|
||||
# Default state for all rules
|
||||
default: true
|
||||
|
||||
# Path to configuration file to extend
|
||||
extends: null
|
||||
|
||||
# MD001/heading-increment/header-increment - Heading levels should only increment by one level at a time
|
||||
MD001: true
|
||||
|
||||
# MD002/first-heading-h1/first-header-h1 - First heading should be a top-level heading
|
||||
MD002:
|
||||
# Heading level
|
||||
level: 1
|
||||
|
||||
# MD003/heading-style/header-style - Heading style
|
||||
MD003:
|
||||
# Heading style
|
||||
style: "consistent"
|
||||
|
||||
# MD004/ul-style - Unordered list style
|
||||
MD004:
|
||||
# List style
|
||||
style: "consistent"
|
||||
|
||||
# MD005/list-indent - Inconsistent indentation for list items at the same level
|
||||
MD005: true
|
||||
|
||||
# MD006/ul-start-left - Consider starting bulleted lists at the beginning of the line
|
||||
MD006: true
|
||||
|
||||
# MD007/ul-indent - Unordered list indentation
|
||||
MD007:
|
||||
# Spaces for indent
|
||||
indent: 2
|
||||
# Whether to indent the first level of the list
|
||||
start_indented: false
|
||||
# Spaces for first level indent (when start_indented is set)
|
||||
start_indent: 2
|
||||
|
||||
# MD009/no-trailing-spaces - Trailing spaces
|
||||
MD009:
|
||||
# Spaces for line break
|
||||
br_spaces: 2
|
||||
# Allow spaces for empty lines in list items
|
||||
list_item_empty_lines: false
|
||||
# Include unnecessary breaks
|
||||
strict: false
|
||||
|
||||
# MD010/no-hard-tabs - Hard tabs
|
||||
MD010:
|
||||
# Include code blocks
|
||||
code_blocks: false
|
||||
# Fenced code languages to ignore
|
||||
ignore_code_languages: []
|
||||
# Number of spaces for each hard tab
|
||||
spaces_per_tab: 4
|
||||
|
||||
# MD011/no-reversed-links - Reversed link syntax
|
||||
MD011: true
|
||||
|
||||
# MD012/no-multiple-blanks - Multiple consecutive blank lines
|
||||
MD012:
|
||||
# Consecutive blank lines
|
||||
maximum: 2
|
||||
|
||||
# MD013/line-length - Line length
|
||||
MD013:
|
||||
# Number of characters
|
||||
line_length: 100
|
||||
# Number of characters for headings
|
||||
heading_line_length: 100
|
||||
# Number of characters for code blocks
|
||||
code_block_line_length: 100
|
||||
# Include code blocks
|
||||
code_blocks: false
|
||||
# Include tables
|
||||
tables: false
|
||||
# Include headings
|
||||
headings: true
|
||||
# Include headings
|
||||
headers: true
|
||||
# Strict length checking
|
||||
strict: false
|
||||
# Stern length checking
|
||||
stern: false
|
||||
|
||||
# MD014/commands-show-output - Dollar signs used before commands without showing output
|
||||
MD014: true
|
||||
|
||||
# MD018/no-missing-space-atx - No space after hash on atx style heading
|
||||
MD018: true
|
||||
|
||||
# MD019/no-multiple-space-atx - Multiple spaces after hash on atx style heading
|
||||
MD019: true
|
||||
|
||||
# MD020/no-missing-space-closed-atx - No space inside hashes on closed atx style heading
|
||||
MD020: true
|
||||
|
||||
# MD021/no-multiple-space-closed-atx - Multiple spaces inside hashes on closed atx style heading
|
||||
MD021: true
|
||||
|
||||
# MD022/blanks-around-headings/blanks-around-headers - Headings should be surrounded by blank lines
|
||||
MD022:
|
||||
# Blank lines above heading
|
||||
lines_above: 1
|
||||
# Blank lines below heading
|
||||
lines_below: 1
|
||||
|
||||
# MD023/heading-start-left/header-start-left - Headings must start at the beginning of the line
|
||||
MD023: true
|
||||
|
||||
# MD024/no-duplicate-heading/no-duplicate-header - Multiple headings with the same content
|
||||
MD024:
|
||||
# Only check sibling headings
|
||||
allow_different_nesting: false
|
||||
# Only check sibling headings
|
||||
siblings_only: false
|
||||
|
||||
# MD025/single-title/single-h1 - Multiple top-level headings in the same document
|
||||
MD025:
|
||||
# Heading level
|
||||
level: 1
|
||||
# RegExp for matching title in front matter
|
||||
front_matter_title: "^\\s*title\\s*[:=]"
|
||||
|
||||
# MD026/no-trailing-punctuation - Trailing punctuation in heading
|
||||
MD026:
|
||||
# Punctuation characters not allowed at end of headings
|
||||
punctuation: ".,;:!。，；：！"
|
||||
|
||||
# MD027/no-multiple-space-blockquote - Multiple spaces after blockquote symbol
|
||||
MD027: true
|
||||
|
||||
# MD028/no-blanks-blockquote - Blank line inside blockquote
|
||||
MD028: true
|
||||
|
||||
# MD029/ol-prefix - Ordered list item prefix
|
||||
MD029:
|
||||
# List style
|
||||
style: "one_or_ordered"
|
||||
|
||||
# MD030/list-marker-space - Spaces after list markers
|
||||
MD030:
|
||||
# Spaces for single-line unordered list items
|
||||
ul_single: 2
|
||||
# Spaces for single-line ordered list items
|
||||
ol_single: 2
|
||||
# Spaces for multi-line unordered list items
|
||||
ul_multi: 2
|
||||
# Spaces for multi-line ordered list items
|
||||
ol_multi: 2
|
||||
|
||||
# MD031/blanks-around-fences - Fenced code blocks should be surrounded by blank lines
|
||||
MD031:
|
||||
# Include list items
|
||||
list_items: true
|
||||
|
||||
# MD032/blanks-around-lists - Lists should be surrounded by blank lines
|
||||
MD032: true
|
||||
|
||||
# MD033/no-inline-html - Inline HTML
|
||||
MD033:
|
||||
# Allowed elements
|
||||
allowed_elements: []
|
||||
|
||||
# MD034/no-bare-urls - Bare URL used
|
||||
MD034: true
|
||||
|
||||
# MD035/hr-style - Horizontal rule style
|
||||
MD035:
|
||||
# Horizontal rule style
|
||||
style: "consistent"
|
||||
|
||||
# MD036/no-emphasis-as-heading/no-emphasis-as-header - Emphasis used instead of a heading
|
||||
MD036:
|
||||
# Punctuation characters
|
||||
punctuation: ".,;:!?。，；：！？"
|
||||
|
||||
# MD037/no-space-in-emphasis - Spaces inside emphasis markers
|
||||
MD037: true
|
||||
|
||||
# MD038/no-space-in-code - Spaces inside code span elements
|
||||
MD038: true
|
||||
|
||||
# MD039/no-space-in-links - Spaces inside link text
|
||||
MD039: true
|
||||
|
||||
# MD040/fenced-code-language - Fenced code blocks should have a language specified
|
||||
MD040:
|
||||
# List of languages
|
||||
allowed_languages: []
|
||||
# Require language only
|
||||
language_only: false
|
||||
|
||||
# MD041/first-line-heading/first-line-h1 - First line in a file should be a top-level heading
|
||||
MD041:
|
||||
# Heading level
|
||||
level: 1
|
||||
# RegExp for matching title in front matter
|
||||
front_matter_title: "^\\s*title\\s*[:=]"
|
||||
|
||||
# MD042/no-empty-links - No empty links
|
||||
MD042: true
|
||||
|
||||
# MD043/required-headings/required-headers - Required heading structure
|
||||
MD043:
|
||||
# List of headings
|
||||
headings: []
|
||||
# List of headings
|
||||
headers: []
|
||||
# Match case of headings
|
||||
match_case: false
|
||||
|
||||
# MD044/proper-names - Proper names should have the correct capitalization
|
||||
MD044:
|
||||
# List of proper names
|
||||
names: []
|
||||
# Include code blocks
|
||||
code_blocks: false
|
||||
# Include HTML elements
|
||||
html_elements: false
|
||||
|
||||
# MD045/no-alt-text - Images should have alternate text (alt text)
|
||||
MD045: true
|
||||
|
||||
# MD046/code-block-style - Code block style
|
||||
MD046:
|
||||
# Block style
|
||||
style: "consistent"
|
||||
|
||||
# MD047/single-trailing-newline - Files should end with a single newline character
|
||||
MD047: true
|
||||
|
||||
# MD048/code-fence-style - Code fence style
|
||||
MD048:
|
||||
# Code fence style
|
||||
style: "consistent"
|
||||
|
||||
# MD049/emphasis-style - Emphasis style should be consistent
|
||||
MD049:
|
||||
# Emphasis style should be consistent
|
||||
style: "consistent"
|
||||
|
||||
# MD050/strong-style - Strong style should be consistent
|
||||
MD050:
|
||||
# Strong style should be consistent
|
||||
style: "consistent"
|
||||
|
||||
# MD051/link-fragments - Link fragments should be valid
|
||||
MD051: true
|
||||
|
||||
# MD052/reference-links-images - Reference links and images should use a label that is defined
|
||||
MD052: true
|
||||
|
||||
# MD053/link-image-reference-definitions - Link and image reference definitions should be needed
|
||||
MD053:
|
||||
# Ignored definitions
|
||||
ignored_definitions:
|
||||
- "//"
|
||||
+19
-19
@@ -33,6 +33,7 @@ register_external_command(NewCommand())
|
||||
```
|
||||
|
||||
Loading it in `GEF` is as easy as
|
||||
|
||||
```
|
||||
gef➤ source /path/to/newcmd.py
|
||||
[+] Loading 'NewCommand'
|
||||
@@ -61,14 +62,16 @@ We make GEF aware of this new command by registering it in the `__main__` sectio
|
||||
invoking the global function `register_external_command()`.
|
||||
|
||||
Now you have a new GEF command which you can load, either from cli:
|
||||
|
||||
```bash
|
||||
gef➤ source /path/to/newcmd.py
|
||||
```
|
||||
or add to your `~/.gdbinit`:
|
||||
```bash
|
||||
$ echo source /path/to/newcmd.py >> ~/.gdbinit
|
||||
```
|
||||
|
||||
or add to your `~/.gdbinit`:
|
||||
|
||||
```bash
|
||||
echo source /path/to/newcmd.py >> ~/.gdbinit
|
||||
```
|
||||
|
||||
## Customizing context panes
|
||||
|
||||
@@ -119,20 +122,22 @@ gef➤ pi help(Architecture)
|
||||
or even from outside GDB:
|
||||
|
||||
```bash
|
||||
$ gdb -q -ex 'pi help(hexdump)' -ex quit
|
||||
gdb -q -ex 'pi help(hexdump)' -ex quit
|
||||
```
|
||||
|
||||
The GEF API aims to provide a simpler and more Pythonic approach to GDB's.
|
||||
|
||||
Some basic examples:
|
||||
- read the memory
|
||||
```python
|
||||
* read the memory
|
||||
|
||||
```text
|
||||
gef ➤ pi print(hexdump( gef.memory.read(parse_address("$pc"), length=0x20 )))
|
||||
0x0000000000000000 f3 0f 1e fa 31 ed 49 89 d1 5e 48 89 e2 48 83 e4 ....1.I..^H..H..
|
||||
0x0000000000000010 f0 50 54 4c 8d 05 66 0d 01 00 48 8d 0d ef 0c 01 .PTL..f...H.....
|
||||
```
|
||||
|
||||
- get access to the memory layout
|
||||
* get access to the memory layout
|
||||
|
||||
```
|
||||
gef ➤ pi print('\n'.join([ f"{x.page_start:#x} -> {x.page_end:#x}" for x in gef.memory.maps]))
|
||||
0x555555554000 -> 0x555555558000
|
||||
@@ -148,18 +153,15 @@ gef ➤ pi print('\n'.join([ f"{x.page_start:#x} -> {x.page_end:#x}" for x in ge
|
||||
[...]
|
||||
```
|
||||
|
||||
|
||||
The API also offers a number of decorators to simplify the creation of new/existing commands, such as:
|
||||
- `@only_if_gdb_running` to execute only if a GDB session is running.
|
||||
- `@only_if_gdb_target_local` to check if the target is local i.e. not debugging using GDB `remote`.
|
||||
- and many more...
|
||||
|
||||
* `@only_if_gdb_running` to execute only if a GDB session is running.
|
||||
* `@only_if_gdb_target_local` to check if the target is local i.e. not debugging using GDB `remote`.
|
||||
* and many more...
|
||||
|
||||
### Reference
|
||||
|
||||
For a complete reference of the API offered by GEF, visit [`docs/api/gef.md`](api/gef.md).
|
||||
|
||||
|
||||
### Parsing command arguments
|
||||
|
||||
```python
|
||||
@@ -179,12 +181,10 @@ using a type of `tuple` or `list` for the default value. `parse_arguments` will
|
||||
of what to expect based on the first default value of the iterable, so make sure it's not empty. For
|
||||
instance:
|
||||
|
||||
|
||||
```python
|
||||
@parse_arguments( {"instructions": ["nop", "int3", "hlt"], }, {"--arch": "x64", } )
|
||||
```
|
||||
|
||||
|
||||
Argument flags are also supported, allowing to write simpler version of the flag such as
|
||||
|
||||
```python
|
||||
@@ -227,11 +227,11 @@ Sometimes architectures can more precisely determine whether they apply to the c
|
||||
looking at the architecture determined by gdb. For these cases the custom architecture may implement
|
||||
the `supports_gdb_arch()` static function to signal that they should be used instead of the default.
|
||||
The function receives only one argument:
|
||||
- `gdb_str` (of type `str`) which is the architecture name as reported by GDB.
|
||||
* `gdb_str` (of type `str`) which is the architecture name as reported by GDB.
|
||||
|
||||
The function **must** return:
|
||||
- `True` if the current `Architecture` class supports the target binary; `False` otherwise.
|
||||
- `None` to simply ignore this check and let GEF try to determine the architecture.
|
||||
* `True` if the current `Architecture` class supports the target binary; `False` otherwise.
|
||||
* `None` to simply ignore this check and let GEF try to determine the architecture.
|
||||
|
||||
One example is the ARM Cortex-M architecture which in some cases should be used over the generic ARM
|
||||
one:
|
||||
|
||||
@@ -3,12 +3,14 @@
|
||||
Easily check, enable or disable ASLR on the debugged binary.
|
||||
|
||||
Check the status:
|
||||
|
||||
```
|
||||
gef➤ aslr
|
||||
ASLR is currently disabled
|
||||
```
|
||||
|
||||
Activate ASLR:
|
||||
|
||||
```
|
||||
gef➤ aslr on
|
||||
[+] Enabling ASLR
|
||||
@@ -17,6 +19,7 @@ ASLR is currently enabled
|
||||
```
|
||||
|
||||
De-activate ASLR:
|
||||
|
||||
```
|
||||
gef➤ aslr off
|
||||
[+] Disabling ASLR
|
||||
|
||||
@@ -5,6 +5,7 @@ If the currently debugged process was compiled with the Smash Stack Protector (S
|
||||
canary. This makes it convenient to avoid manually searching for this value in memory.
|
||||
|
||||
The command `canary` does not take any arguments.
|
||||
|
||||
```
|
||||
gef➤ canary
|
||||
```
|
||||
|
||||
@@ -4,6 +4,7 @@ The `checksec` command is inspired from [`checksec.sh`](https://www.trapkit.de/t
|
||||
It provides a convenient way to determine which security protections are enabled in a binary.
|
||||
|
||||
You can use the command on the currently debugged process:
|
||||
|
||||
```
|
||||
gef➤ checksec
|
||||
[+] checksec for '/vagrant/test-bin'
|
||||
@@ -19,5 +20,5 @@ Full RelRO: No
|
||||
Or specify directly the binary to check, for example:
|
||||
|
||||
```bash
|
||||
$ gdb -ex "checksec ./tests/test-x86"
|
||||
gdb -ex "checksec ./tests/test-x86"
|
||||
```
|
||||
|
||||
@@ -5,24 +5,29 @@ specified via the `GEF_RC` environment variable. In addition, `gef` can also be
|
||||
runtime with the `gef config` command.
|
||||
|
||||
To view all settings for all commands loaded:
|
||||
|
||||
```
|
||||
gef➤ gef config
|
||||
```
|
||||
|
||||
|
||||
|
||||
Or to get one setting value:
|
||||
|
||||
```
|
||||
gef➤ gef config pcustom.struct_path
|
||||
```
|
||||
|
||||
Of course you can edit the values. For example, if you want the screen to be cleared before
|
||||
displaying the current context when reaching a breakpoing:
|
||||
|
||||
```
|
||||
gef➤ gef config context.clear_screen 1
|
||||
```
|
||||
|
||||
To save the current settings for `GEF` to the file system to have those options persist across all
|
||||
your future `GEF` sessions, simply run:
|
||||
|
||||
```
|
||||
gef➤ gef save
|
||||
[+] Configuration saved to '/home/vagrant/.gef.rc'
|
||||
@@ -32,6 +37,7 @@ Upon startup, if `$GEF_RC` points to an existing file, or otherwise if `${HOME}/
|
||||
`gef` will automatically load its values.
|
||||
|
||||
To reload the settings during the session, just run:
|
||||
|
||||
```
|
||||
gef➤ gef restore
|
||||
[+] Configuration from '/home/hugsy/.gef.rc' restored
|
||||
|
||||
@@ -2,7 +2,6 @@
|
||||
|
||||
|
||||
|
||||
|
||||
`gef` (not unlike `PEDA` or `fG! famous gdbinit`) provides comprehensive context menu when hitting a
|
||||
breakpoint.
|
||||
|
||||
@@ -54,6 +53,7 @@ just omit it.
|
||||
```
|
||||
gef➤ gef config context.layout "-legend regs stack code args -source -threads -trace extra memory"
|
||||
```
|
||||
|
||||
This configuration will not display the `legend`, `source`, `threads`, and `trace` sections.
|
||||
|
||||
The `memory` pane will display the content of all locations specified by the
|
||||
@@ -80,12 +80,14 @@ The size of most sections are also customizable:
|
||||
|
||||
To have the stack displayed with the largest stack addresses on top (i.e., grow the stack downward),
|
||||
enable the following setting:
|
||||
|
||||
```
|
||||
gef➤ gef config context.grow_stack_down True
|
||||
```
|
||||
|
||||
If the saved instruction pointer is not within the portion of the stack being displayed, then a
|
||||
section is created that includes the saved ip and depending on the architecture the frame pointer.
|
||||
|
||||
```
|
||||
0x00007fffffffc9e8│+0x00: 0x00007ffff7a2d830 → <__main+240> mov edi, eax ($current_frame_savedip)
|
||||
0x00007fffffffc9e0│+0x00: 0x00000000004008c0 → <__init+0> push r15 ← $rbp
|
||||
@@ -108,12 +110,14 @@ setting `context.redirect` variable to have the context sent to another section.
|
||||
To do so, select the TTY/file/socket/etc. you want the context redirected to with `gef config`.
|
||||
|
||||
Enter the command `tty` in the prompt:
|
||||
|
||||
```
|
||||
$ tty
|
||||
/dev/pts/0
|
||||
```
|
||||
|
||||
Then tell `gef` about it!
|
||||
|
||||
```
|
||||
gef➤ gef config context.redirect /dev/pts/0
|
||||
```
|
||||
@@ -121,8 +125,8 @@ gef➤ gef config context.redirect /dev/pts/0
|
||||
Enjoy:
|
||||
|
||||
|
||||
|
||||
To go back to normal, remove the value:
|
||||
|
||||
```
|
||||
gef➤ gef config context.redirect ""
|
||||
```
|
||||
@@ -130,11 +134,13 @@ gef➤ gef config context.redirect ""
|
||||
### Display individual sections ###
|
||||
|
||||
You can display a single section by specifying it as an argument:
|
||||
|
||||
```
|
||||
gef➤ context regs
|
||||
```
|
||||
|
||||
Multiple sections can be provided, even if they are not part of the current layout:
|
||||
|
||||
```
|
||||
gef➤ context regs stack
|
||||
```
|
||||
@@ -142,46 +148,55 @@ gef➤ context regs stack
|
||||
### Examples ###
|
||||
|
||||
* Display the code section first, then register, and stack, hiding everything else:
|
||||
|
||||
```
|
||||
gef➤ gef config context.layout "code regs stack"
|
||||
```
|
||||
|
||||
* Stop showing the context sections when breaking:
|
||||
|
||||
```
|
||||
gef➤ gef config context.enable 0
|
||||
```
|
||||
|
||||
* Clear the screen before showing the context sections when breaking:
|
||||
|
||||
```
|
||||
gef➤ gef config context.clear_screen 1
|
||||
```
|
||||
|
||||
* Don't dereference the registers in the `regs` section (more compact):
|
||||
|
||||
```
|
||||
gef➤ gef config context.show_registers_raw 1
|
||||
```
|
||||
|
||||
* Number of bytes of opcodes to display next to the disassembly.
|
||||
|
||||
```
|
||||
gef➤ gef config context.show_opcodes_size 4
|
||||
```
|
||||
|
||||
* Don't 'peek' into the start of functions that are called.
|
||||
|
||||
```
|
||||
gef➤ gef config context.peek_calls False
|
||||
```
|
||||
|
||||
* Hide specific registers from the registers view.
|
||||
|
||||
```
|
||||
gef➤ gef config context.ignore_registers "$cs $ds $gs"
|
||||
```
|
||||
|
||||
* Hide the extra pc context info from the source code view.
|
||||
|
||||
```
|
||||
gef➤ gef config context.show_source_code_variable_values 0
|
||||
```
|
||||
|
||||
* Show better definitions for call to libc functions.
|
||||
|
||||
```
|
||||
gef➤ gef config context.libc_args True
|
||||
gef➤ gef config context.libc_args_path /path/to/gef-extras/libc_args
|
||||
|
||||
@@ -12,7 +12,7 @@ dereference (by default, `$sp`), the number of consecutive addresses to derefere
|
||||
|
||||
```
|
||||
gef➤ dereference
|
||||
0x00007fffffffdec0│+0x0000: 0x00007ffff7ffe190 → 0x0000555555554000 → jg 0x555555554047 ← $rsp, $r13
|
||||
0x00007fffffffdec0│+0x0000: 0x00007ffff7ffe190 → 0x0000555555554000 → jg 0x555555554047 ← $rsp, $r13
|
||||
0x00007fffffffdec8│+0x0008: 0x00007ffff7ffe730 → 0x00007ffff7fd3000 → 0x00010102464c457f
|
||||
0x00007fffffffded0│+0x0010: 0x00007ffff7faa000 → 0x00007ffff7de9000 → 0x03010102464c457f
|
||||
0x00007fffffffded8│+0x0018: 0x00007ffff7ffd9f0 → 0x00007ffff7fd5000 → 0x00010102464c457f
|
||||
@@ -70,6 +70,7 @@ gef➤ dereference $sp -l 7 -r $rbp
|
||||
|
||||
Just like with `x`, you can pass a negative number of addresses to dereference, to examine memory
|
||||
backwards from the start address:
|
||||
|
||||
```
|
||||
gef➤ dereference $sp -l 3
|
||||
0x00007fffffffcf90│+0x0010: 0x00007ffff7f5aaa0 → 0x0000000000000000
|
||||
|
||||
@@ -5,9 +5,11 @@ the flag register for the architectures that support it. Without argument, the c
|
||||
return a human-friendly display of the register flags.
|
||||
|
||||
One or many arguments can be provided, following the syntax below:
|
||||
|
||||
```
|
||||
gef➤ flags [(+|-|~)FLAGNAME ...]
|
||||
```
|
||||
|
||||
Where `FLAGNAME` is the name of the flag (case insensitive), and `+|-|~` indicates the action on
|
||||
whether to set, unset, or toggle the flag.
|
||||
|
||||
@@ -17,4 +19,5 @@ instruction), but we want to have the Carry flag set, simply go with:
|
||||
```
|
||||
gef➤ flags -ZERO +CARRY
|
||||
```
|
||||
|
||||
|
||||
|
||||
@@ -20,6 +20,7 @@ gef➤ fmtstr-helper
|
||||
```
|
||||
|
||||
Then start the binary execution.
|
||||
|
||||
```
|
||||
gef➤ r
|
||||
```
|
||||
@@ -28,4 +29,3 @@ If a potentially insecure entry is found, the breakpoint will trigger, stop the
|
||||
display the reason for trigger and the associated context.
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -14,12 +14,12 @@ These functions can be used as arguments to other commands to dynamically calcul
|
||||
|
||||
```
|
||||
gef➤ deref -l 4 $_heap()
|
||||
0x0000000000602000│+0x00: 0x0000000000000000 ← $r8
|
||||
0x0000000000602000│+0x00: 0x0000000000000000 ← $r8
|
||||
0x0000000000602008│+0x08: 0x0000000000000021 ("!"?)
|
||||
0x0000000000602010│+0x10: 0x0000000000000000 ← $rax, $rdx
|
||||
0x0000000000602010│+0x10: 0x0000000000000000 ← $rax, $rdx
|
||||
0x0000000000602018│+0x18: 0x0000000000000000
|
||||
gef➤ deref -l 4 $_heap(0x20)
|
||||
0x0000000000602020│+0x00: 0x0000000000000000 ← $rsi
|
||||
0x0000000000602020│+0x00: 0x0000000000000000 ← $rsi
|
||||
0x0000000000602028│+0x08: 0x0000000000020fe1
|
||||
0x0000000000602030│+0x10: 0x0000000000000000
|
||||
0x0000000000602038│+0x18: 0x0000000000000000
|
||||
|
||||
@@ -10,6 +10,7 @@ process of debugging more cumbersome. GEF greatly improves that state with the `
|
||||
`target remote` command. For many reasons, you **cannot** use `target remote` alone with GEF.
|
||||
|
||||
`gef-remote` can function in 2 ways:
|
||||
|
||||
- `remote` which is meant to enrich use of GDB `target remote` command, when connecting to a "real"
|
||||
gdbserver instance
|
||||
- `qemu-mode` when connecting to GDB stab of either `qemu-user` or `qemu-system`.
|
||||
@@ -79,14 +80,12 @@ that, all of GEF features are available:
|
||||
|
||||
|
||||
|
||||
|
||||
#### `remote-extended`
|
||||
|
||||
Extended mode works the same as `remote`. Being an extended session, gdbserver has not spawned or
|
||||
attached to any process. Therefore, all that's required is to add the `--pid` flag when calling
|
||||
`gef-remote`, along with the process ID of the process to debug.
|
||||
|
||||
|
||||
### Qemu mode
|
||||
|
||||
Qemu mode of `gef-remote` allows to connect to the [Qemu GDB
|
||||
@@ -101,13 +100,12 @@ makes now even more sense 😉 And using it is very straight forward.
|
||||
|
||||
|
||||
|
||||
|
||||
#### `qemu-system`
|
||||
|
||||
To test locally, you can use the mini image linux x64 vm
|
||||
[here](https://mega.nz/file/ldQCDQiR#yJWJ8RXAHTxREKVmR7Hnfr70tIAQDFeWSYj96SvPO1k).
|
||||
|
||||
1. Run `./run.sh`
|
||||
2. Use `--qemu-user` and `--qemu-binary vmlinuz` when starting `gef-remote`
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -29,7 +29,6 @@ gef➤ gef missing
|
||||
[*] Command `XXXX` is missing, reason → YYYYY.
|
||||
```
|
||||
|
||||
|
||||
### GEF Config Command
|
||||
|
||||
Allows the user to set/view settings for the current debugging session. For making the changes
|
||||
@@ -111,7 +110,6 @@ within the command.
|
||||
gef➤ gef run ./binary
|
||||
```
|
||||
|
||||
|
||||
### GEF Install Command
|
||||
|
||||
`gef install` allows to install one (or more) specific script(s) from `gef-extras`. The new scripts
|
||||
@@ -124,7 +122,6 @@ gef➤ gef install SCRIPTNAME1 [SCRIPTNAME2...]
|
||||
Where `SCRIPTNAME1` ... are the names of script from the [`gef-extras`
|
||||
repository](https://github.com/hugsy/gef-extras/tree/main/scripts/).
|
||||
|
||||
|
||||
```
|
||||
gef➤ gef install remote windbg stack
|
||||
[+] Searching for 'remote.py' in `gef-extras@main`...
|
||||
@@ -139,6 +136,7 @@ gef➤
|
||||
This makes it easier to deploy new functionalities in limited environment. By default, the command
|
||||
looks up for script names in the `main` branch of `gef-extras`. However you can change specify a
|
||||
different branch through the `gef.default_branch` configuration setting:
|
||||
|
||||
```
|
||||
gef➤ gef config gef.default_branch dev
|
||||
```
|
||||
|
||||
@@ -4,6 +4,7 @@ Display the current state of GOT table of the running process.
|
||||
|
||||
The `got` command optionally takes function names and filters the output displaying only the
|
||||
matching functions.
|
||||
|
||||
```
|
||||
gef➤ got
|
||||
```
|
||||
@@ -11,6 +12,7 @@ gef➤ got
|
||||
|
||||
|
||||
The applied filter partially matches the name of the functions, so you can do something like this.
|
||||
|
||||
```
|
||||
gef➤ got str
|
||||
gef➤ got print
|
||||
@@ -20,6 +22,7 @@ gef➤ got read
|
||||
|
||||
|
||||
Example of multiple partial filters:
|
||||
|
||||
```
|
||||
gef➤ got str get
|
||||
```
|
||||
|
||||
@@ -30,13 +30,13 @@ enable/disable manually punctual checks via the `gef config` command.
|
||||
|
||||
The following settings are accepted:
|
||||
|
||||
* `check_null_free`: to break execution when a free(NULL) is encountered (disabled by default);
|
||||
* `check_double_free`: to break execution when a double free is encountered;
|
||||
- `check_null_free`: to break execution when a free(NULL) is encountered (disabled by default);
|
||||
- `check_double_free`: to break execution when a double free is encountered;
|
||||
|
||||
|
||||
|
||||
* `check_weird_free`: to execution when `free()` is called against a non-tracked pointer;
|
||||
* `check_uaf`: to break execution when a possible Use-after-Free condition is found.
|
||||
- `check_weird_free`: to execution when `free()` is called against a non-tracked pointer;
|
||||
- `check_uaf`: to break execution when a possible Use-after-Free condition is found.
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -30,7 +30,6 @@ gef➤ gef config gef.bruteforce_main_arena True
|
||||
Note that this might take a few seconds to complete. If GEF does find the symbol you can then
|
||||
calculate the offset to the libc base address and save it in the config.
|
||||
|
||||
|
||||
### `heap chunks` command ###
|
||||
|
||||
Displays all the chunks from the `heap` section of the current arena.
|
||||
|
||||
@@ -77,4 +77,3 @@ support._
|
||||
## Colors
|
||||
|
||||
To find a list of supported colors, check the [theme](./theme.md#changing-colors) documentation.
|
||||
|
||||
|
||||
@@ -4,27 +4,29 @@
|
||||
file descriptor can point to a file, a pipe, a socket, a device etc.
|
||||
|
||||
To use it, simply run
|
||||
|
||||
```
|
||||
gef➤ hijack-fd FDNUM NEWFILE
|
||||
```
|
||||
|
||||
For instance,
|
||||
|
||||
```
|
||||
gef➤ hijack-fd 1 /dev/null
|
||||
```
|
||||
|
||||
Will modify the current process file descriptors to redirect STDOUT to
|
||||
`/dev/null`.
|
||||
|
||||
|
||||
This command also supports connecting to an ip:port if it is provided as an
|
||||
argument. For example
|
||||
|
||||
```
|
||||
gef➤ hijack-fd 0 localhost:8888
|
||||
```
|
||||
Will redirect STDIN to localhost:8888
|
||||
|
||||
Will redirect STDIN to localhost:8888
|
||||
|
||||
Check out the tutorial on GEF's YouTube channel:
|
||||
|
||||
[](https://www.youtube.com/watch?v=Ss_QFeYkEvk)
|
||||
|
||||
|
||||
@@ -9,12 +9,12 @@ _Note_: this command **shoud NOT** be mistaken with the [GDB `watch`
|
||||
command](https://sourceware.org/gdb/current/onlinedocs/gdb/Set-Watchpoints.html) meant to set
|
||||
breakpoints on memory access (read,write,exec).
|
||||
|
||||
|
||||
### Adding a watch
|
||||
|
||||
Specify a location to watch and display with the context, along with their optional size and format:
|
||||
|
||||
Syntax:
|
||||
|
||||
```
|
||||
memory watch <ADDRESS> [SIZE] [(qword|dword|word|byte|pointers)]
|
||||
```
|
||||
@@ -39,34 +39,34 @@ Which, when the `context` is displayed, will show something like:
|
||||
|
||||
|
||||
|
||||
|
||||
### Removing a watch
|
||||
|
||||
Remove a watched address. To list all the addresses being watched, use `memory list`.
|
||||
|
||||
Syntax:
|
||||
|
||||
```
|
||||
memory unwatch <ADDRESS>
|
||||
```
|
||||
|
||||
|
||||
### Listing watches
|
||||
|
||||
Enumerate all the addresses currently watched by the `memory` command.
|
||||
|
||||
Syntax:
|
||||
|
||||
```
|
||||
memory list
|
||||
```
|
||||
|
||||
The command will output a list of all the addresses watched, along with the size and format to display them as.
|
||||
|
||||
|
||||
### Resetting watches
|
||||
|
||||
Empties the list of addresses to watch.
|
||||
|
||||
Syntax:
|
||||
|
||||
```
|
||||
memory reset
|
||||
```
|
||||
|
||||
@@ -32,7 +32,7 @@ Example output:
|
||||
0x400e18 mov QWORD PTR [rbp-0x50], rsi
|
||||
0x400e1c mov rax, QWORD PTR fs:0x28
|
||||
───────────────────────────────────────────────────────────────────────────────── stack ────
|
||||
0x00007fffffffe288│+0x0000: 0x0000000000401117 → movzx ecx, al ← $rsp
|
||||
0x00007fffffffe288│+0x0000: 0x0000000000401117 → movzx ecx, al ← $rsp
|
||||
0x00007fffffffe290│+0x0008: 0x00007fffffffe4b8 → 0x00007fffffffe71d → "/ctf/t19/srv_copy"
|
||||
0x00007fffffffe298│+0x0010: 0x0000000100000000
|
||||
0x00007fffffffe2a0│+0x0018: 0x0000000000000000
|
||||
|
||||
+14
-7
@@ -18,36 +18,43 @@ instructions it overwrites
|
||||
`--b` Instead of replacing whole instructions, fill ITEMS bytes with nops
|
||||
|
||||
nop the current instruction ($pc):
|
||||
|
||||
```bash
|
||||
gef➤ nop
|
||||
gef➤ nop
|
||||
```
|
||||
|
||||
nop an instruction at $pc+3 address:
|
||||
|
||||
```bash
|
||||
gef➤ nop $pc+3
|
||||
gef➤ nop $pc+3
|
||||
```
|
||||
|
||||
nop two instructions at address $pc+3:
|
||||
|
||||
```bash
|
||||
gef➤ nop --i 2 $pc+3
|
||||
gef➤ nop --i 2 $pc+3
|
||||
```
|
||||
|
||||
Replace 1 byte with nop at current instruction ($pc):
|
||||
|
||||
```bash
|
||||
gef➤ nop --b
|
||||
gef➤ nop --b
|
||||
```
|
||||
|
||||
Replace 1 byte with nop at address $pc+3:
|
||||
|
||||
```bash
|
||||
gef➤ nop --b $pc+3
|
||||
gef➤ nop --b $pc+3
|
||||
```
|
||||
|
||||
Replace 2 bytes with nop(s) (breaking the last instruction) at address $pc+3:
|
||||
|
||||
```bash
|
||||
gef➤ nop --f --b --i 2 $pc+3
|
||||
gef➤ nop --f --b --i 2 $pc+3
|
||||
```
|
||||
|
||||
Patch 2 nops at address $pc+3:
|
||||
|
||||
```bash
|
||||
gef➤ nop --n --i 2 $pc+3
|
||||
gef➤ nop --n --i 2 $pc+3
|
||||
```
|
||||
|
||||
+18
-13
@@ -9,30 +9,34 @@ This is achieved via the command `pcustom` (for `print custom`), or you can use
|
||||
reference to the WinDBG command) as provided by the [`WinDbg compatibility
|
||||
extension`](https://github.com/hugsy/gef-extras/blob/main/scripts/windbg.py)
|
||||
|
||||
|
||||
### Configuration
|
||||
|
||||
New structures can be stored in the location given by the configuration setting:
|
||||
|
||||
```
|
||||
gef➤ gef config pcustom.struct_path
|
||||
```
|
||||
|
||||
By default, this location is in `$TEMP/gef/structs` (e.g. `/tmp/user/1000/gef/structs`). The
|
||||
structure can be created as a simple `ctypes` structure, in a file called `<struct_name>.py`.
|
||||
|
||||
You can naturally set this path to a new location
|
||||
|
||||
```
|
||||
gef➤ gef config pcustom.struct_path /my/new/location
|
||||
```
|
||||
|
||||
And save this change so you can re-use it directly next time you use `gdb`
|
||||
|
||||
```
|
||||
gef➤ gef save
|
||||
[+] Configuration saved to '~/.gef.rc'
|
||||
```
|
||||
|
||||
|
||||
### Using user-defined structures
|
||||
|
||||
You can list existing custom structures via
|
||||
|
||||
```
|
||||
gef➤ pcustom list
|
||||
[+] Listing custom structures from '/tmp/structs'
|
||||
@@ -82,14 +86,14 @@ class person_t(Structure):
|
||||
]
|
||||
|
||||
_values_ = [
|
||||
# You can define a function to substitute the value
|
||||
("age", lambda age: "Old" if age > 40 else "Young"),
|
||||
# Or alternatively a list of 2-tuples
|
||||
("id", [
|
||||
(0, "root"),
|
||||
(1, "normal user"),
|
||||
(None, "Invalid person")
|
||||
])
|
||||
# You can define a function to substitute the value
|
||||
("age", lambda age: "Old" if age > 40 else "Young"),
|
||||
# Or alternatively a list of 2-tuples
|
||||
("id", [
|
||||
(0, "root"),
|
||||
(1, "normal user"),
|
||||
(None, "Invalid person")
|
||||
])
|
||||
]
|
||||
```
|
||||
|
||||
@@ -118,7 +122,6 @@ Additionally, if you have successfully configured your IDA settings, you can als
|
||||
the structure(s) that was(were) reverse-engineered in IDA directly in your GDB session:
|
||||
 - (see `gef-extras/ida-rpyc`, which is the new improved version of `ida-interact`)
|
||||
|
||||
|
||||
#### Dynamic `ctypes.Structure`-like classes
|
||||
|
||||
`pcustom` also supports the use of class factories to create a `ctypes.Structure` class whose
|
||||
@@ -127,6 +130,7 @@ currently debugged binary, the architecture, the size of a pointer and more).
|
||||
|
||||
The syntax is relatively close to the way we use to create static classes (see above), but instead
|
||||
we define a function that will generate the class. The requirements for this class factory are:
|
||||
|
||||
- take a single [`Gef`](https://github.com/hugsy/gef/blob/dev/docs/api/gef.md#class-gef) positional
|
||||
argument
|
||||
- End the function name with `_t`
|
||||
@@ -179,18 +183,19 @@ def person_t(gef: Optional["Gef"]==None):
|
||||
return person_cls
|
||||
```
|
||||
|
||||
|
||||
### Public repository of structures
|
||||
|
||||
A community contributed repository of structures can be found in
|
||||
[`gef-extras`](https://github.com/hugsy/gef-extras). To deploy it:
|
||||
|
||||
In bash:
|
||||
|
||||
```
|
||||
$ git clone https://github.com/hugsy/gef-extras
|
||||
git clone https://github.com/hugsy/gef-extras
|
||||
```
|
||||
|
||||
In GEF:
|
||||
|
||||
```
|
||||
gef➤ gef config pcustom.struct_path /path/to/gef-extras/structs
|
||||
gef➤ gef save
|
||||
|
||||
@@ -10,7 +10,6 @@ following the format specified. Currently, the output formats supported are
|
||||
- Hex string (`hex`)
|
||||
- For patch byte command or GDB $_gef[N] byte access (`bytearray`)
|
||||
|
||||
|
||||
```
|
||||
gef➤ print-format -h
|
||||
[+] print-format [--lang LANG] [--bitlen SIZE] [(--length,-l) LENGTH] [--clip] LOCATION
|
||||
|
||||
@@ -41,7 +41,7 @@ So, for example, if your targeted process is called `/home/foobar/plop`, but the
|
||||
is used through `socat`, like
|
||||
|
||||
```
|
||||
$ socat tcp-l:1234,fork,reuseaddr exec:/home/foobar/plop
|
||||
socat tcp-l:1234,fork,reuseaddr exec:/home/foobar/plop
|
||||
```
|
||||
|
||||
Then every time a new connection is opened to tcp/1234, `plop` will be forked, and GEF can easily
|
||||
|
||||
@@ -1,3 +1,3 @@
|
||||
## Command `reset-cache`
|
||||
|
||||
This command is only useful for debugging `GEF` itself.
|
||||
This command is only useful for debugging `GEF` itself.
|
||||
|
||||
@@ -2,6 +2,7 @@
|
||||
|
||||
`gef` allows you to search for a specific pattern at runtime in all the segments of your process
|
||||
memory layout. The command `search-pattern`, alias `grep`, aims to be straight-forward to use:
|
||||
|
||||
```
|
||||
gef➤ search-pattern MyPattern
|
||||
```
|
||||
@@ -25,6 +26,7 @@ For this reason, the alias `xref` also points to the command `search-pattern`.
|
||||
command above is equivalent to `xref 0x4005f6` which makes it more intuitive to use.
|
||||
|
||||
### Searching in a specific range ###
|
||||
|
||||
Sometimes, you may need to search for a very common pattern. To limit the search space, you can also
|
||||
specify an address range or the section to be checked.
|
||||
|
||||
@@ -34,6 +36,7 @@ gef➤ search-pattern 0x4005f6 little 0x603100-0x603200
|
||||
```
|
||||
|
||||
### Searching in a specific range using regex ###
|
||||
|
||||
Sometimes, you may need an advanced search using regex. Just use --regex arg.
|
||||
|
||||
Example: how to find null-end-printable(from x20-x7e) C strings (min size >=2 bytes) with a regex:
|
||||
|
||||
@@ -29,4 +29,3 @@ shell-storm.org
|
||||
Shellcode ARM without 0x20, 0x0a and 0x00
|
||||
[...]
|
||||
```
|
||||
|
||||
|
||||
@@ -11,8 +11,8 @@ skipi [LOCATION] [--n NUM_INSTRUCTIONS]
|
||||
`--n NUM_INSTRUCTIONS` Skip the specified number of instructions instead of the default 1.
|
||||
|
||||
```bash
|
||||
gef➤ skipi
|
||||
gef➤ skipi --n 3
|
||||
gef➤ skipi 0x69696969
|
||||
gef➤ skipi 0x69696969 --n 6
|
||||
```
|
||||
gef➤ skipi
|
||||
gef➤ skipi --n 3
|
||||
gef➤ skipi 0x69696969
|
||||
gef➤ skipi 0x69696969 --n 6
|
||||
```
|
||||
|
||||
@@ -17,4 +17,3 @@ By using the script `ida_color_gdb_trace.py` on the text file generated, it will
|
||||
taken:
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -3,6 +3,7 @@
|
||||
This command is used to XOR a block of memory.
|
||||
|
||||
Its syntax is:
|
||||
|
||||
```
|
||||
xor-memory <display|patch> <address> <size_to_read> <xor_key>
|
||||
```
|
||||
|
||||
@@ -9,6 +9,4 @@ This matrix indicates the version of Python and/or GDB
|
||||
| [2022.01](https://github.com/hugsy/gef/releases/tag/2021.01) | 7.7 | Python 3.4+ |
|
||||
| [Current](https://github.com/hugsy/gef/tree/main) | 8.0+ | Python 3.6+ |
|
||||
|
||||
|
||||
|
||||
* Up to - included
|
||||
|
||||
+7
-12
@@ -1,6 +1,5 @@
|
||||
# Frequently Asked Questions #
|
||||
|
||||
|
||||
## Why use GEF over PEDA? ##
|
||||
|
||||
[PEDA](https://github.com/longld/peda) is a fantastic tool that provides similar commands to make
|
||||
@@ -35,8 +34,7 @@ If you are running an obsolete version, GEF will show a error and message and ex
|
||||
Some pre-compiled static binaries for both recent GDB and GDBServer can be downloaded from the
|
||||
[`gdb-static`](https://github.com/hugsy/gdb-static) repository.
|
||||
|
||||
|
||||
## I cannot get GEF setup!! ##
|
||||
## I cannot get GEF setup ##
|
||||
|
||||
GEF will work on any GDB 8+ compiled with Python 3.6+ support. You can view that commands that
|
||||
failed to load using `gef missing`, but this will not affect GEF generally.
|
||||
@@ -79,7 +77,6 @@ readline_compat = True
|
||||
You can now use all features of `gef` even on versions of GDB compiled against old `readline`
|
||||
library.
|
||||
|
||||
|
||||
## Does GEF prevent the use of other GDB plugins? ##
|
||||
|
||||
Definitely not! You can use any other GDB plugin on top of it for an even better debugging
|
||||
@@ -93,8 +90,6 @@ Some interesting plugins highly recommended too:
|
||||
|
||||
Src: [@rick2600: terminator + gdb + gef + voltron cc: @snare @_hugsy_](https://twitter.com/rick2600/status/775926070566490113)
|
||||
|
||||
|
||||
|
||||
## I want to contribute, where should I head first? ##
|
||||
|
||||
I would suggest thoroughly reading this documentation, just having a look to the
|
||||
@@ -104,7 +99,6 @@ give you pointers.
|
||||
Also a good thing would be to join our [Discord channel](https://discord.gg/HCS8Hg7) to get in touch
|
||||
with the people involved/using it.
|
||||
|
||||
|
||||
## I think I've found a bug, how can I help fixing it? ##
|
||||
|
||||
`gef` is only getting better through people (like you!) using it, but most importantly reporting
|
||||
@@ -116,9 +110,11 @@ happens, you'll only get to see a message like this:
|
||||
|
||||
|
||||
By switching to debug mode, `gef` will give much more information:
|
||||
|
||||
```
|
||||
gef➤ gef config gef.debug 1
|
||||
```
|
||||
|
||||
|
||||
|
||||
If you think fixing it is in your skills, then send a [Pull
|
||||
@@ -128,7 +124,6 @@ what was your solution for it.
|
||||
Otherwise, you can open an [issue](https://github.com/hugsy/gef/issues), give a thorough description
|
||||
of your bug and copy/paste the content from above. This will greatly help for solving the issue.
|
||||
|
||||
|
||||
## I get weird issues/characters using GDB + Python3, what's up? ##
|
||||
|
||||
Chances are you are not using UTF-8. Python3 is [highly relying on
|
||||
@@ -141,7 +136,7 @@ In addition, some unexpected results were observed when your local is not set to
|
||||
aren't sure, simply run `gdb` like this:
|
||||
|
||||
```
|
||||
$ LC_ALL=en_US.UTF-8 gdb /path/to/your/binary
|
||||
LC_ALL=en_US.UTF-8 gdb /path/to/your/binary
|
||||
```
|
||||
|
||||
## GDB crashes on ARM memory corruption with `gdb_exception_RETURN_MASK_ERROR` ##
|
||||
@@ -160,7 +155,7 @@ Debian/Kali for ARM
|
||||
> simple ARM assembly program (noted above) when instead of exiting cleanly,
|
||||
> gdb's disassembly failed with a SIGABRT and threw an exception:
|
||||
>
|
||||
> `gdb_exception_RETURN_MASK_ERROR`
|
||||
> `gdb_exception_RETURN_MASK_ERROR`
|
||||
>
|
||||
> This turns out to be a known problem (regression) with gdb, and affects
|
||||
> gef users running the ARM platform (Raspberry Pi).
|
||||
@@ -174,7 +169,7 @@ Therefore, there is nothing GEF's developers can do about that. The correct solu
|
||||
above is to recompile your GDB with a newer (better) version.
|
||||
|
||||
The whole topic was already internally discussed, so please refer to the [issue
|
||||
#206](https://github.com/hugsy/gef/issues/206) for the whole story.
|
||||
# 206](https://github.com/hugsy/gef/issues/206) for the whole story.
|
||||
|
||||
## I still don't have my answer... Where can I go?
|
||||
|
||||
@@ -189,7 +184,7 @@ can!
|
||||
## How can I use GEF to debug a process in a container?
|
||||
|
||||
GEF can attach to a process running in a container using `gdb --pid=$PID`, where `$PID` is the ID of
|
||||
the running process *on the host*. To find this, you can use `docker top <container ID> -o pid | awk
|
||||
the running process _on the host_. To find this, you can use `docker top <container ID> -o pid | awk
|
||||
'!/PID/' | xargs -I'{}' pstree -psa {}` to view the process tree for the container.
|
||||
|
||||
`sudo` may be required to attach to the process, which will depend on your system's security
|
||||
|
||||
@@ -10,6 +10,7 @@ $_base([filepath])
|
||||
```
|
||||
|
||||
Example:
|
||||
|
||||
```
|
||||
gef➤ p $_base(\"/usr/lib/ld-2.33.so\")
|
||||
```
|
||||
|
||||
@@ -9,6 +9,7 @@ $_bss([offset])
|
||||
```
|
||||
|
||||
Example:
|
||||
|
||||
```
|
||||
gef➤ p $_bss(0x20)
|
||||
```
|
||||
|
||||
@@ -9,6 +9,7 @@ $_got([offset])
|
||||
```
|
||||
|
||||
Example:
|
||||
|
||||
```
|
||||
gef➤ p $_got(0x20)
|
||||
```
|
||||
|
||||
@@ -9,6 +9,7 @@ $_heap([offset])
|
||||
```
|
||||
|
||||
Example:
|
||||
|
||||
```
|
||||
gef➤ p $_heap(0x20)
|
||||
```
|
||||
|
||||
@@ -9,6 +9,7 @@ $_stack([offset])
|
||||
```
|
||||
|
||||
Example:
|
||||
|
||||
```
|
||||
gef➤ p $_stack(0x20)
|
||||
```
|
||||
|
||||
+4
-9
@@ -34,7 +34,6 @@ It requires Python 3, but [`gef-legacy`](https://github.com/hugsy/gef-legacy) ca
|
||||
Check out the [showroom page](https://hugsy.github.io/gef/screenshots/) for more | or [try it online
|
||||
yourself!](https://demo.gef.blah.cat) (user:`gef`/password:`gef-demo`)
|
||||
|
||||
|
||||
## Quick start
|
||||
|
||||
### Automated installation
|
||||
@@ -49,7 +48,6 @@ bash -c "$(curl -fsSL https://gef.blah.cat/sh)"
|
||||
For more details and other ways to install GEF please see [installation
|
||||
page](https://hugsy.github.io/gef/install/).
|
||||
|
||||
|
||||
### Run
|
||||
|
||||
Then just start playing (for local files):
|
||||
@@ -73,7 +71,6 @@ local:~ $ gdb -q
|
||||
gef➤ gef-remote -t your.ip.address:1234 -p 666
|
||||
```
|
||||
|
||||
|
||||
## Bugs & Feedbacks ##
|
||||
|
||||
To discuss `gef`, `gdb`, exploitation or other topics, feel free to join our [Discord
|
||||
@@ -91,9 +88,9 @@ systems such as GrSec.
|
||||
`gef` was created and maintained by myself, [`@_hugsy_`](https://twitter.com/_hugsy_), but kept
|
||||
fresh thanks to [all the contributors](https://github.com/hugsy/gef/graphs/contributors).
|
||||
|
||||
[  ](https://github.com/hugsy/gef/graphs/contributors)
|
||||
[](https://github.com/hugsy/gef/graphs/contributors)
|
||||
|
||||
Or if you just like the tool, feel free to drop a simple *"thanks"* on Discord, Twitter or other, it
|
||||
Or if you just like the tool, feel free to drop a simple _"thanks"_ on Discord, Twitter or other, it
|
||||
is **always** very appreciated.
|
||||
|
||||
## Sponsors ##
|
||||
@@ -110,10 +107,8 @@ dedicate more time and resources to the project:
|
||||
[<img src="https://github.com/therealdreg.png" height="50px" width="50px" style="border-radius: 50%">](https://github.com/therealdreg)
|
||||
[<img src="https://github.com/mikesart.png" height="50px" width="50px" style="border-radius: 50%">](https://github.com/mikesart)
|
||||
|
||||
|
||||
## Extra Credits
|
||||
|
||||
- The GEF logo was designed by [TheZakMan](https://twitter.com/thezakman)
|
||||
* The GEF logo was designed by [TheZakMan](https://twitter.com/thezakman)
|
||||
|
||||
|
||||
## 🍺 Happy hacking !
|
||||
## 🍺 Happy hacking
|
||||
|
||||
+16
-14
@@ -2,11 +2,13 @@
|
||||
|
||||
## Prerequisites
|
||||
|
||||
Specific GEF commands rely on commonly used Unix commands to extract additional information. Therefore it requires the following binaries to be present:
|
||||
* `file`
|
||||
* `readelf`
|
||||
* `ps`
|
||||
* `python3`
|
||||
Specific GEF commands rely on commonly used Unix commands to extract additional information.
|
||||
Therefore it requires the following binaries to be present:
|
||||
|
||||
* `file`
|
||||
* `readelf`
|
||||
* `ps`
|
||||
* `python3`
|
||||
|
||||
Those tools are included by default in many modern distributions. If they're missing, you can use your OS package manager to install them.
|
||||
|
||||
@@ -25,7 +27,7 @@ features, and only functional bugs will be handled.
|
||||
You can verify it with the following command:
|
||||
|
||||
```bash
|
||||
$ gdb -nx -ex 'pi print(sys.version)' -ex quit
|
||||
gdb -nx -ex 'pi print(sys.version)' -ex quit
|
||||
```
|
||||
|
||||
This should display your version of Python compiled with `gdb`.
|
||||
@@ -42,10 +44,9 @@ There are **none**: `GEF` works out of the box!
|
||||
|
||||
GEF itself provides most (if not all 🤯) features required for typical sessions. However, GEF can be
|
||||
easily extended via
|
||||
- community-built scripts, functions and architectures in the repo
|
||||
* community-built scripts, functions and architectures in the repo
|
||||
`gef-extras` (see below)
|
||||
- your own script which can leverage the GEF API for the heavy lifting
|
||||
|
||||
* your own script which can leverage the GEF API for the heavy lifting
|
||||
|
||||
## Standalone
|
||||
|
||||
@@ -60,6 +61,7 @@ bash -c "$(curl -fsSL https://gef.blah.cat/sh)"
|
||||
```
|
||||
|
||||
Or if you prefer `wget`
|
||||
|
||||
```bash
|
||||
bash -c "$(wget https://gef.blah.cat/sh -O -)"
|
||||
```
|
||||
@@ -79,7 +81,6 @@ $ cat ~/.gdbinit
|
||||
source ~/.gdbinit-gef.py
|
||||
```
|
||||
|
||||
|
||||
### Update
|
||||
|
||||
If your host/VM is connected to the Internet, you can update `gef` easily to the latest version
|
||||
@@ -98,8 +99,8 @@ updates are available, `gef` will respond `No update` instead.
|
||||
To contribute to GEF, you might prefer using git directly.
|
||||
|
||||
```bash
|
||||
$ git clone --branch dev https://github.com/hugsy/gef.git
|
||||
$ echo source `pwd`/gef/gef.py >> ~/.gdbinit
|
||||
git clone --branch dev https://github.com/hugsy/gef.git
|
||||
echo source `pwd`/gef/gef.py >> ~/.gdbinit
|
||||
```
|
||||
|
||||
GEF is in very active development, so the default branch is `dev`. This is the
|
||||
@@ -109,7 +110,7 @@ However if you prefer a more stable life, you can then switch to the `main`
|
||||
branch:
|
||||
|
||||
```bash
|
||||
$ git checkout main
|
||||
git checkout main
|
||||
```
|
||||
|
||||
The `main` branch gets only updated for new releases, or also when critical
|
||||
@@ -122,6 +123,7 @@ GEF was built to also provide a solid base for external scripts. The repository
|
||||
anyone can freely submit their own commands to extend GDB via GEF's API.
|
||||
|
||||
To benefit from it:
|
||||
|
||||
```bash
|
||||
# using the automated way
|
||||
## via the install script
|
||||
@@ -145,7 +147,6 @@ $ gdb -ex 'gef config pcustom.struct_path "/path/to/gef-extras/structs"' -ex 'ge
|
||||
|
||||
There, you're now fully equipped epic pwnage with **all** GEF's goodness!!
|
||||
|
||||
|
||||
# Uninstalling GEF
|
||||
|
||||
## Prevent script loading
|
||||
@@ -170,6 +171,7 @@ source /my/path/to/gef.py
|
||||
```
|
||||
|
||||
Will become:
|
||||
|
||||
```text
|
||||
$ cat ~/.gdbinit
|
||||
# source /my/path/to/gef.py
|
||||
|
||||
@@ -6,4 +6,3 @@
|
||||
---
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -44,7 +44,6 @@ FAILED tests/commands/heap.py::HeapCommand::test_cmd_heap_bins_unsorted - Assert
|
||||
|
||||
You can then use `pytest` directly to help you fix each error specifically.
|
||||
|
||||
|
||||
#### Using `pytest`
|
||||
|
||||
GEF entirely relies on [`pytest`](https://pytest.org) for its testing. Refer to the project
|
||||
@@ -85,7 +84,6 @@ environment to help you get more information about the reason of failure.
|
||||
One of the most convenient ways to test `gef` properly is using the `pytest` integration of modern
|
||||
editors such as VisualStudio Code or PyCharm. Without proper tests, new code will not be integrated.
|
||||
|
||||
|
||||
### Linting GEF
|
||||
|
||||
You can use the Makefile at the root of the project to get the proper linting settings. For most
|
||||
|
||||
Reference in New Issue
Block a user