GDB for pwn.
cd ~/
git clone https://github.com/0x9k/Pwngdb.git
cp ~/Pwngdb/.gdbinit ~/
If you dont want to use gdb-peda , you can modify the gdbinit to remove it.
If you want to use the feature of heapinfo and tracemalloc , you need to modify some val of pwngdb.py
- heapinfo
main_arena_off: The offset ofmain_arenain glibcmain_arena_off_32: The offset ofmain_arenain glibc32
- tracemalloc
main_arena_off: The offset ofmain_arenain glibcmain_arena_off_32: The offset ofmain_arenain glibc32_int_malloc_off: The offset of_int_malloc_offin glibc_int_malloc_off_32; The offset of_int_malloc_offin glibc32_int_free_off: The offset of_int_free_offin glibc_int_free_off_32:The offset of_int_free_offin glibc32malloc_off: The offset ofmallocin glibcfree_off: The offset offreein glibc
libc: Print the base address of libcld: Print the base address of ldcodebase: Print the base of code segmentheap: Print the base of heapgot: Print the Global Offset Table infomationdyn: Print the Dynamic section infomationfindcall: Find some function callbcall: Set the breakpoint at some function calltls: Print the thread local storage addressat: Attach by process namefindsyscall: Find the syscallfmtarg: Calculate the index of format string- You need to stop on printf which has vulnerability.
force: Calculate the nb in the house of force.heapinfo: Print some infomation of heapchunkinfo: Print the infomation of chunk- chunkinfo (Address of victim)
chunkptr: Print the infomation of chunk- chunkptr (Address of user ptr)
mergeinfo: Print the infomation of merge- mergeinfo (Address of victim)
printfastbin: Print some infomation of fastbintracemalloc on: Trace the malloc and free and detect some error .- You need to run the process first than
tracemalloc on, it will record all of the malloc and free. - You can set the
DEBUGin pwngdb.py , than it will print all of the malloc and free infomation such as the screeshot.
- You need to run the process first than
parseheap: Parse heap layout
set_breakpoint_pie: set breakpoint with pie program
#python exp debug template
from pwn import *
r = process("./xxxx")
def attach():
gdb.attach(r, execute='''
set_breakpoint_pie 0xda5
c
''')
raw_input("joker")
#echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope
#0xda5 offset address in program
....
attach()#automatic to set breakpoint
...
r.interactive()- Chunkinfo
- Mergeinfo
- Heapinfo
- tracemalloc
