metasploit-framework/lib/metasm/samples/gdbclient.rb

583 lines
13 KiB
Ruby
Raw Normal View History

# This file is part of Metasm, the Ruby assembly manipulation suite
# Copyright (C) 2009 Yoann GUILLOT
#
# Licence is LGPL, see LICENCE in the top-level directory
#
# this is a rubstop-api compatible Gdb stub
# it can connect to a gdb server and interface with the lindebug frontend
# linux/x86 only
#
require 'socket'
require 'metasm'
class GdbRemoteString < Metasm::VirtualString
attr_accessor :gdbg
def initialize(gdbg, addr_start=0, length=0xffff_ffff)
@gdbg = gdbg
@pagelength = 512
super(addr_start, length)
end
def dup(addr=@addr_start, len=@length)
self.class.new(@gdbg, addr, len)
end
def rewrite_at(addr, data)
len = data.length
off = 0
while len > @pagelength
@gdbg.setmem(addr+off, data[off, @pagelength])
off += @pagelength
len -= @pagelength
end
@gdbg.setmem(addr+off, data[off, len])
end
def get_page(addr)
@gdbg.getmem(addr, @pagelength)
end
end
class Rubstop
EFLAGS = {0 => 'c', 2 => 'p', 4 => 'a', 6 => 'z', 7 => 's', 9 => 'i', 10 => 'd', 11 => 'o'}
GDBREGS = %w[eax ecx edx ebx esp ebp esi edi eip eflags cs ss ds es fs gs] # XXX [77] = 'orig_eax'
# define accessors for registers
GDBREGS.compact.each { |reg|
define_method(reg) { regs_cache[reg] }
define_method(reg + '=') { |v| regs_cache[reg] = v ; regs_dirty }
}
# compute the hex checksum used in gdb protocol
def gdb_csum(buf)
'%02x' % (buf.unpack('C*').inject(0) { |cs, c| cs + c } & 0xff)
end
# send the buffer, waits ack
# return true on success
def gdb_send(cmd, buf='')
buf = cmd + buf
buf = '$' << buf << '#' << gdb_csum(buf)
log "gdb_send(#{buf[0, 32].inspect}#{'...' if buf.length > 32})" if $DEBUG
5.times {
@io.write buf
loop do
if not IO.select([@io], nil, nil, 1)
break
end
raise Errno::EPIPE if not ack = @io.read(1)
case ack
when '+'
return true
when '-'
log "gdb_send: ack neg" if $DEBUG
break
when nil; return
end
end
}
log "send error #{cmd.inspect} (no ack)"
false
end
# return buf, or nil on error / csum error
def gdb_readresp
state = :nosync
buf = ''
cs = ''
while state != :done
# XXX timeout etc
raise Errno::EPIPE if not c = @io.read(1)
case state
when :nosync
if c == '$'
state = :data
end
when :data
if c == '#'
state = :csum1
else
buf << c
end
when :csum1
cs << c
state = :csum2
when :csum2
cs << c
state = :done
if cs.downcase != gdb_csum(buf).downcase
log "transmit error"
@io.write '-'
return
end
end
end
@io.write '+'
if buf =~ /^E(..)$/
e = $1.to_i(16)
log "error #{e} (#{Metasm::PTrace32::ERRNO.index(e)})"
return
end
log "gdb_readresp: got #{buf[0, 64].inspect}#{'...' if buf.length > 64}" if $DEBUG
buf
end
def gdb_msg(*a)
if gdb_send(*a)
gdb_readresp
end
end
# rle: build the regexp that will match repetitions of a character, skipping counts leading to invalid char
rng = [3..(125-29)]
[?+, ?-, ?#, ?$].sort.each { |invalid|
invalid -= 29
rng.each_with_index { |r, i|
if r.include? invalid
replace = [r.begin..invalid-1, invalid+1..r.end]
replace.delete_if { |r_| r_.begin > r_.end }
rng[i, 1] = replace
end
}
}
repet = rng.reverse.map { |r| "\\1{#{r.begin},#{r.end}}" }.join('|')
RLE_RE = /(.)(#{repet})/
# rle-compress a buffer
# a character followed by '*' followed by 'x' is asc(x)-28 repetitions of the char
# eg '0* ' => '0' * (asc(' ') - 28) = '0000'
# for the count character, it must be 32 <= char < 126 and not be '+' '-' '#' or '$'
def rle(buf)
buf.gsub(RLE_RE) {
chr, len = $1, $2.length+1
chr + '*' + (len+28).chr
}
end
# decompress rle-encoded data
def unrle(buf) buf.gsub(/(.)\*(.)/) { $1 * ($2[0]-28) } end
# send an integer as a long hex packed with leading 0 stripped
def hexl(int) [int].pack('N').unpack('H*').first.gsub(/^0+(.)/, '\1') end
# send a binary buffer as a rle hex-encoded
def hex(buf) buf.unpack('H*').first end
# decode an rle hex-encoded buffer
def unhex(buf)
buf = buf[/^[a-fA-F0-9]*/]
buf = '0' + buf if buf.length % 1 == 1
[buf].pack('H*')
end
# on-demand local cache of registers
def regs_cache
readregs if @regs_cache.empty?
@regs_cache
end
# retrieve remote regs
def readregs
sync_regs
if buf = gdb_msg('g')
regs = unhex(unrle(buf))
if regs.length < GDBREGS.length*4
# retry once, was probably a response to something else
puts "bad regs size!" if $DEBUG
buf = gdb_msg('g')
regs = unhex(unrle(buf)) if buf
if not buf or regs.length < GDBREGS.length*4
raise "regs buffer recv is too short !"
end
end
@regs_dirty = false
@regs_cache = Hash[GDBREGS.zip(regs.unpack('L*'))]
end
@curinstr = nil if @regs_cache['eip'] != @oldregs['eip']
end
# mark local cache of regs as modified, need to send it before continuing execution
def regs_dirty
@regs_dirty = true
end
# send the local copy of regs if dirty
def sync_regs
if not @regs_cache.empty? and @regs_dirty
send_regs
end
end
# send the local copy of regs
def send_regs
return if @regs_cache.empty?
regs = @regs_cache.values_at(*GDBREGS)
@regs_dirty = false
gdb_msg('G', hex(regs.pack('L*')))
end
# read memory (small blocks prefered)
def getmem(addr, len)
return '' if len == 0
if mem = gdb_msg('m', hexl(addr) << ',' << hexl(len))
unhex(unrle(mem))
end
end
# write memory (small blocks prefered)
def setmem(addr, data)
len = data.length
return if len == 0
raise 'writemem error' if not gdb_msg('M', hexl(addr) << ',' << hexl(len) << ':' << rle(hex(data)))
end
# read arbitrary blocks of memory (chunks to getmem)
def [](addr, len)
@pgm.encoded[addr, len].data
end
# write arbitrary blocks of memory (chunks to getmem)
def []=(addr, len, str)
@pgm.encoded[addr, len] = str
end
def curinstr
@curinstr ||= mnemonic_di
end
def mnemonic_di(addr = eip)
@pgm.encoded.ptr = addr
di = @pgm.cpu.decode_instruction(@pgm.encoded, addr)
@curinstr = di if addr == @regs_cache['eip']
di
end
def mnemonic(addr = eip)
mnemonic_di(addr).instruction
end
def pre_run
@oldregs = regs_cache.dup
sync_regs
end
def post_run
@regs_cache.clear
@curinstr = nil
@mem.invalidate
end
def quiet
@quiet = true
begin
yield
ensure
@quiet = false
end
end
def log_stopped(msg)
return if @quiet ||= false
case msg[0]
when ?T
sig = [msg[1, 2]].pack('H*')[0]
misc = msg[3..-1].split(';').inject({}) { |h, s| k, v = s.split(':', 2) ; h.update k => (v || true) }
str = "stopped by signal #{sig}"
str = "thread #{[misc['thread']].pack('H*').unpack('N').first} #{str}" if misc['thread']
log str
when ?S
sig = [msg[1, 2]].pack('H*')[0]
log "stopped by signal #{sig}"
end
end
def cont
pre_run
do_singlestep if @wantbp
rmsg = gdb_msg('c')
post_run
ccaddr = eip-1
if @breakpoints[ccaddr] and self[ccaddr, 1] == "\xcc"
self[ccaddr, 1] = @breakpoints.delete ccaddr
mem.invalidate
self.eip = ccaddr
@wantbp = ccaddr if not @singleshot.delete ccaddr
sync_regs
end
log_stopped rmsg
end
def singlestep
pre_run
do_singlestep
post_run
end
def do_singlestep
gdb_msg('s')
if @wantbp
self[@wantbp, 1] = "\xcc"
@wantbp = nil
end
end
def stepover
i = curinstr.instruction if curinstr
if i and (i.opname == 'call' or (i.prefix and i.prefix[:rep]))
eaddr = eip + curinstr.bin_length
bpx eaddr, true
quiet { cont }
else
singlestep
end
end
def stepout
stepover until curinstr and curinstr.opcode.name == 'ret'
singlestep
rescue Interrupt
log 'interrupted'
end
def bpx(addr, singleshot=false)
return if @breakpoints[addr]
@singleshot[addr] = true if singleshot
@breakpoints[addr] = self[addr, 1]
self[addr, 1] = "\xcc"
end
def kill
gdb_send('k')
end
def detach
# TODO
end
attr_accessor :pgm, :breakpoints, :singleshot, :wantbp,
:symbols, :symbols_len, :filemap, :oldregs, :io, :mem
def initialize(io)
case io
when IO; @io = io
when /^udp:([^:]*):(\d+)$/; @io = UDPSocket.new ; @io.connect($1, $2)
when /^(?:tcp:)?([^:]*):(\d+)$/; @io = TCPSocket.open($1, $2)
else raise "unknown target #{io.inspect}"
end
@pgm = Metasm::ExeFormat.new Metasm::Ia32.new
@mem = GdbRemoteString.new self
@pgm.encoded = Metasm::EncodedData.new @mem
@regs_cache = {}
@regs_dirty = nil
@oldregs = {}
@breakpoints = {}
@singleshot = {}
@wantbp = nil
@symbols = {}
@symbols_len = {}
@filemap = {}
gdb_setup
end
def gdb_setup
#gdb_msg('q', 'Supported')
#gdb_msg('Hc', '-1')
#gdb_msg('qC')
if not gdb_msg('?')
log "nobody on the line, waiting for someone to wake up"
IO.select([@io], nil, nil, nil)
log "who's there ?"
end
end
def set_hwbp(type, addr, len=1, set=true)
set = (set ? 'Z' : 'z')
type = { 'r' => '3', 'w' => '2', 'x' => '1', 's' => '0' }[type] || raise("invalid hwbp type #{type}")
gdb_msg(set, type << ',' << hexl(addr) << ',' << hexl(len))
true
end
def unset_hwbp(type, addr, len=1)
set_hwbp(type, addr, len, false)
end
def findfilemap(s)
@filemap.keys.find { |k| @filemap[k][0] <= s and @filemap[k][1] > s } || '???'
end
def findsymbol(k)
file = findfilemap(k) + '!'
if s = @symbols[k] ? k : @symbols.keys.find { |s_| s_ < k and s_ + @symbols_len[s_].to_i > k }
file + @symbols[s] + (s == k ? '' : "+#{(k-s).to_s(16)}")
else
file + ('%08x' % k)
end
end
def loadsyms(baseaddr, name)
@loadedsyms ||= {}
return if @loadedsyms[name] or self[baseaddr, 4] != "\x7fELF"
@loadedsyms[name] = true
set_status " loading symbols from #{name}..."
e = Metasm::LoadedELF.load self[baseaddr, 0x100_0000]
e.load_address = baseaddr
begin
e.decode
#e = Metasm::ELF.decode_file name rescue return # read from disk
rescue
log "failed to load symbols from #{name}: #$!"
($!.backtrace - caller).each { |l| log l.chomp }
@filemap[baseaddr.to_s(16)] = [baseaddr, baseaddr+0x1000]
return
rescue Interrupt
log "interrupted"
end
if e.tag['SONAME']
name = e.tag['SONAME']
return if name and @loadedsyms[name]
@loadedsyms[name] = true
end
last_s = e.segments.reverse.find { |s| s.type == 'LOAD' }
vlen = last_s.vaddr + last_s.memsz
vlen -= baseaddr if e.header.type == 'EXEC'
@filemap[name] = [baseaddr, baseaddr + vlen]
oldsyms = @symbols.length
e.symbols.each { |s|
next if not s.name or s.shndx == 'UNDEF'
sname = s.name
sname = 'weak_'+sname if s.bind == 'WEAK'
sname = 'local_'+sname if s.bind == 'LOCAL'
v = s.value
v = baseaddr + v if v < baseaddr
@symbols[v] = sname
@symbols_len[v] = s.size
}
if e.header.type == 'EXEC' and e.header.entry >= baseaddr and e.header.entry < baseaddr + vlen
@symbols[e.header.entry] = 'entrypoint'
end
set_status nil
log "loaded #{@symbols.length-oldsyms} symbols from #{name} at #{'%08x' % baseaddr}"
end
# scan val at the beginning of each page (custom gdb msg)
def pageheadsearch(val)
resp = gdb_msg('qy', hexl(val))
unhex(resp).unpack('L*')
end
def scansyms
# TODO use qSymbol or something
pageheadsearch("\x7fELF".unpack('L').first).each { |addr| loadsyms(addr, '%08x'%addr) }
end
# use qSymbol to retrieve a symbol value (uint)
def request_symbol(name)
resp = gdb_msg('qSymbol:', hex(name))
if resp and a = resp.split(':')[1]
unhex(a).unpack('N').first
end
end
def loadallsyms
# kgdb: read kernel symbols from 'module_list'
# too bad module_list is not in ksyms
if mod = request_symbol('module_list')
int_at = lambda { |addr, off| @mem[addr+off, 4].unpack('L').first }
mod_size = lambda { int_at[mod, 0] }
mod_next = lambda { int_at[mod, 4] }
mod_nsym = lambda { int_at[mod, 0x18] } # most portable. yes.
mod_syms = lambda { int_at[mod, 0x20] }
read_strz = lambda { |addr|
if i = @mem.index(0, addr)
@mem[addr...i]
end
}
while mod != 0
symtab = [[]]
@mem[mod_syms[], mod_nsym[]*8].to_str.unpack('L*').each { |i|
# make a list of couples
if symtab.last.length < 2
symtab.last << i
else
symtab << [i]
end
}
symtab.each { |v, n|
n = read_strz[n]
# ||= to keep symbol precedence order (1st match wins)
@symbols[v] ||= n
}
mod = mod_next[]
end
end
end
def loadmap(mapfile)
# file fmt: addr type name eg 'c01001ba t setup_idt'
minaddr = maxaddr = nil
File.read(mapfile).each { |l|
addr, type, name = l.chomp.split
addr = addr.to_i(16)
minaddr = addr if not minaddr or minaddr > addr
maxaddr = addr if not maxaddr or maxaddr < addr
@symbols[addr] = name
}
if minaddr
@filemap[minaddr.to_s(16)] = [minaddr, maxaddr+1]
end
end
def backtrace
s = findsymbol(eip)
if block_given?
yield s
else
bt = []
bt << s
end
fp = ebp
while fp >= esp and fp <= esp+0x100000
s = findsymbol(self[fp+4, 4].unpack('L').first)
if block_given?
yield s
else
bt << s
end
fp = self[fp, 4].unpack('L').first
end
bt
end
attr_accessor :logger
def log(s)
@logger ||= $stdout
@logger.puts s
end
# set a temporary status info (nil for default value)
def set_status(s)
@logger ||= $stdout
if @logger != $stdout
@logger.statusline = s
else
s ||= ' '*72
@logger.print s + "\r"
@logger.flush
end
end
def checkbp ; end
end