Skip to content

Commit 5ecaadb

Browse files
clark-jaclark-ja
authored
Review (#733)
* docs: fix usage for 'functions' cmd * fix: ksymaddr cmd - refactor ksymaddr command - introduce argparse syntax to ksymaddr command - add warning if process can't resolve kernel symbol addresses - fix issue when matching symbol wasn't recognized because it was compared against the combination of symbol name plus module name - add note to docs about needed permissions * feat: add capability to pass multiple commands to gdb helpers as cmd - refactor: create new CommandType for 'before', 'cmd' and 'after' - refactor: add whitespace around "=" - refactor: extract method for adding commands to gdb subprocess command - feat: add capability to pass multiple commands to 'cmd' * fix: stub cmd - feat: add -r shortform to argparse syntax - docs: change LOCATION to address - docs: update --retval syntax - docs: fix line length - tests: upgrade tests from just checking for exceptions to also check the functionality of the stub command * docs: update reset-cache * fix: pattern command - docs: update pattern command - docs: apply markdown lints and remove typo - feat: set n for pattern cmd to default of current_arch.ptrsize - args: update pattern command - remove: pattern.period gef setting - feat: support 16bit size for struct.patch - tests: more extensive tests * docs: update screenshots * refactor: please linter * fix: correct some nitpicks * feat: use argparse syntax for deref cmd * docs: update deref syntax * docs: capitalize De Bruijn * docs: fix code block on docs/index.md
1 parent 970a6d3 commit 5ecaadb

File tree

12 files changed

+218
-195
lines changed

12 files changed

+218
-195
lines changed

‎docs/commands/aliases.md‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -90,16 +90,14 @@ g = gef run
9090
uf = disassemble
9191
```
9292

93-
Note that many of these aliases are already supported by `GEF` (e.g. `eb`).
94-
9593
Or here are some `PEDA` aliases for people used to using `PEDA` who made the
9694
smart move to `GEF`.
9795

9896
```
9997
# some peda aliases
10098
telescope = dereference
10199
start = entry-break
102-
stack = dereference $sp 10
100+
stack = dereference -l 10 $sp
103101
argv = show args
104102
kp = info stack
105103
findmem = search-pattern

‎docs/commands/functions.md‎

Lines changed: 23 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,38 @@
11
## Command functions ##
22

3-
The `functions` command will list all of the [convenience functions](https://sourceware.org/gdb/onlinedocs/gdb/Convenience-Funs.html) provided by GEF.
3+
The `functions` command will list all of
4+
the [convenience functions](https://sourceware.org/gdb/onlinedocs/gdb/Convenience-Funs.html)
5+
provided by GEF.
46

5-
* `$_base(name=current_file)` -- Return the base address of the matching section (default current file).
6-
* `$_bss(offset=0)` -- Return the current bss base address plus the given offset.
7-
* `$_got(offset=0)` -- Return the current bss base address plus the given offset.
8-
* `$_heap(offset=0)` -- Return the current heap base address plus an optional offset.
9-
* `$_stack(offset=0)` -- Return the current stack base address plus an optional offset.
7+
- `$_base([filepath])` -- Return the matching file's base address plus an
8+
optional offset. Defaults to the current file. Note that quotes need to be
9+
escaped.
10+
- `$_bss([offset])` -- Return the current bss base address plus the given
11+
offset.
12+
- `$_got([offset])` -- Return the current bss base address plus the given
13+
offset.
14+
- `$_heap([offset])` -- Return the current heap base address plus an
15+
optional offset.
16+
- `$_stack([offset])` -- Return the current stack base address plus an
17+
optional offset.
1018

11-
12-
These functions can be used as arguments to other commands to dynamically calculate values.
19+
These functions can be used as arguments to other commands to dynamically
20+
calculate values.
1321

1422
```
15-
gef➤ deref $_heap() l4
23+
gef➤ deref -l 4 $_heap()
1624
0x0000000000602000│+0x00: 0x0000000000000000 ← $r8
1725
0x0000000000602008│+0x08: 0x0000000000000021 ("!"?)
1826
0x0000000000602010│+0x10: 0x0000000000000000 ← $rax, $rdx
1927
0x0000000000602018│+0x18: 0x0000000000000000
20-
gef➤ deref $_heap(0x20) l4
28+
gef➤ deref -l 4 $_heap(0x20)
2129
0x0000000000602020│+0x00: 0x0000000000000000 ← $rsi
2230
0x0000000000602028│+0x08: 0x0000000000020fe1
2331
0x0000000000602030│+0x10: 0x0000000000000000
2432
0x0000000000602038│+0x18: 0x0000000000000000
33+
gef➤ deref -l 4 $_base(\"libc\")
34+
0x00007ffff7da9000│+0x0000: 0x03010102464c457f
35+
0x00007ffff7da9008│+0x0008: 0x0000000000000000
36+
0x00007ffff7da9010│+0x0010: 0x00000001003e0003
37+
0x00007ffff7da9018│+0x0018: 0x0000000000027c60
2538
```

‎docs/commands/ksymaddr.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,7 @@ gef➤ ksymaddr commit_creds
1818
[*] Found partial match for 'commit_creds' at 0xffffffff8fc8d008 (type=r): __kcrctab_commit_creds
1919
[*] Found partial match for 'commit_creds' at 0xffffffff8fc9bfcd (type=r): __kstrtab_commit_creds
2020
```
21+
22+
Note that the debugging process needs to have the correct permissions for this
23+
command to show kernel addresses. For more information see
24+
also [this stackoverflow post](https://stackoverflow.com/a/55592796).

‎docs/commands/pattern.md‎

Lines changed: 31 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -2,50 +2,64 @@
22

33
This command will create or search a [De
44
Bruijn](https://en.wikipedia.org/wiki/De_Bruijn_sequence) cyclic pattern to
5-
facilitate determining offsets in memory.
5+
facilitate determining offsets in memory. The sequence consists of a number of
6+
unique substrings of a chosen length.
67

78
It should be noted that for better compatibility, the algorithm implemented in
89
`GEF` is the same as the one in `pwntools`, and can therefore be used in
910
conjunction.
1011

11-
### create
12+
### create ###
1213

13-
The sub-command `create` allows to create a new pattern:
14+
```
15+
pattern create [-h] [-n N] [length]
16+
```
17+
18+
The sub-command `create` allows one create a new De Bruijn sequence. The
19+
optional argument `n` determines the length of unique subsequences. Its default
20+
value matches the currently loaded architecture. The `length` argument sets the
21+
total length of the whole sequence.
1422

1523
```
16-
gef➤ pattern create 128
17-
[+] Generating a pattern of 128 bytes
24+
gef➤ pattern create -n 4 128
25+
[+] Generating a pattern of 128 bytes (n=4)
1826
aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaab
1927
[+] Saved as '$_gef0'
2028
```
2129

22-
Ths pattern can be used as as input later on. To generate this input, `GEF`
23-
takes into account the size of architecture (16, 32 or 64 bits), to generate
24-
it.
25-
2630
The equivalent command with `pwntools` is
31+
2732
```python
2833
from pwn import *
2934
p = cyclic(128, n=8)
3035
```
31-
where `n` is the number of bytes of the architecture (8 for 64 bits, 4 for 32).
3236

37+
### search ###
38+
39+
```
40+
pattern search [-h] [-n N] [--max-length MAX_LENGTH] [pattern]
41+
```
42+
43+
The `search` sub-command seeks the `pattern` given as argument, trying to find
44+
its offset in the De Bruijn sequence. The optional argument `n` determines the
45+
length of unique subsequences, and it should usually match the length of
46+
`pattern`. Using `MAX_LENGTH` the maximum length of the sequence to search in
47+
can be adjusted.
3348

34-
### search
49+
Note that the `pattern` can be passed as a GDB symbol (such as a register name),
50+
a string or a hexadecimal value
3551

36-
The `search` sub-command seeks the value given as argument, trying to find it in
37-
the De Bruijn sequence
3852
```
3953
gef➤ pattern search 0x6161616161616167
4054
[+] Searching '0x6161616161616167'
4155
[+] Found at offset 48 (little-endian search) likely
4256
[+] Found at offset 41 (big-endian search)
43-
```
44-
45-
Note that registers can also be passed as values:
46-
```
4757
gef➤ pattern search $rbp
4858
[+] Searching '$rbp'
4959
[+] Found at offset 32 (little-endian search) likely
5060
[+] Found at offset 25 (big-endian search)
61+
gef➤ pattern search aaaaaaac
62+
[+] Searching for 'aaaaaaac'
63+
[+] Found at offset 16 (little-endian search) likely
64+
[+] Found at offset 9 (big-endian search)
5165
```

‎docs/commands/reset-cache.md‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,3 @@
11
## Command reset-cache
22

3-
This is an obsolete function to reset GEF internal memoize cache, which does not
4-
need to be called from the command line anymore.
5-
6-
This command will disappear soon...
3+
This command is only useful for debugging `GEF` itself.

‎docs/commands/stub.md‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,15 @@ The `stub` command allows you stub out functions, optionally specifying the
44
return value.
55

66
```
7-
gef➤ stub [-h] [-r RETVAL] [LOCATION]
7+
gef➤ stub [-h] [--retval RETVAL] [address]
88
```
99

10-
`LOCATION` indicates the address of the function to bypass. If not
11-
specified, gef will consider the instruction at the program counter to be the
10+
`address` indicates the address of the function to bypass. If not
11+
specified, `GEF` will consider the instruction at the program counter to be the
1212
start of the function.
1313

14-
If `-r RETVAL` is provided, gef will set the return value to the provided
15-
value. Otherwise it will set the return value to 0.
14+
If `--retval RETVAL` is provided, `GEF` will set the return value to the
15+
provided value. Otherwise, it will set the return value to 0.
1616

1717
For example, it is trivial to bypass `fork()` calls. Since the return value is
1818
set to 0, it will in fact drop us into the "child" process. It must be noted
@@ -25,7 +25,9 @@ process into thinking it has become the child.
2525
Patching `fork()` calls:
2626

2727
* Without stub:
28+
2829
![fork execution](http://i.imgur.com/TjnTDot.png)
2930

3031
* With stub:
32+
3133
![stubbed fork](http://i.imgur.com/CllTnRH.png)

‎docs/commands/vmmap.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
`vmmap` displays the target process's entire memory space mapping.
44

5-
![vmmap-example](https://i.imgur.com/iau8SwS.png)
5+
![vmmap](https://i.imgur.com/V9zMLUt.png)
66

77
Interestingly, it helps finding secret gems: as an aware reader might have
88
seen, memory mapping differs from one architecture to another (this is one of

‎docs/index.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -145,7 +145,6 @@ To benefit from it:
145145
```bash
146146
# via the install script
147147
$ bash -c "$(wget https://github.com/hugsy/gef/raw/master/scripts/gef-extras.sh -O -)"
148-
```
149148

150149
# manually
151150
# clone the repo

‎docs/screenshots.md‎

Lines changed: 5 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22

33
<!-- @import "[TOC]" {cmd="toc" depthFrom=1 depthTo=6 orderedList=false} -->
44

5-
65
This page illustrates a few of the possibilities available to you when using `GEF`.
76

87
## Multi-architecture support
@@ -18,69 +17,56 @@ Currently `GEF` supports the following architectures:
1817
- PowerPC
1918
- SPARC/SPARCv9
2019

21-
2220
## Features
2321

2422
### Embedded hexdump view
2523

2624
To this day, GDB doesn't come with a hexdump-like view. Well `GEF` fixes that for you via the `hexdump` command:
2725

28-
![hexdump](https://i.imgur.com/mJUq6T2.png)
29-
26+
![hexdump](https://i.imgur.com/qt77lFQ.png)
3027

3128
### Dereferencing data or registers
3229

3330
No more endless manual pointer dereferencing `x/x` style. Just use `dereference` for that. Or for a comprehensive view of the registers, `registers` might become your best friend:
3431

3532
![mipsel-deref-regs](https://i.imgur.com/f5ZaWDC.png)
3633

37-
3834
### Heap analysis
3935

4036
#### Detailed view of Glibc Chunks
4137

4238
![x86-heap-chunks](https://i.imgur.com/zBSTUHb.png)
4339

44-
4540
#### Automatic detection of UaF during runtime
4641

4742
![x86-heap-helper-uaf](https://i.imgur.com/NfV5Cu9.png)
4843

49-
5044
### Display ELF information
5145

5246
#### ELF structure
5347

54-
![arm-elf-info](https://i.imgur.com/qOL8CnL.png)
55-
48+
![elf-info](https://i.imgur.com/AkWhJ3t.png)
5649

5750
#### Security settings
5851

59-
![mips-elf-checksec](https://i.imgur.com/aanY2uK.png)
60-
52+
![elf-checksec](https://i.imgur.com/HXcwr2S.png)
6153

6254
### Automatic vulnerable string detection
6355

6456
![aarch64-fmtstr](https://i.imgur.com/iF4l1R5.png)
6557

66-
6758
### Code emulation with Unicorn-Engine (x86-64)
6859

69-
![x86-unicorn](https://i.imgur.com/emhEsol.png)
70-
60+
![emu](https://i.imgur.com/n4Oy5D0.png)
7161

7262
### Comprehensive address space layout display
7363

74-
![mips-vmmap](https://i.imgur.com/TbC1kNa.png)
75-
64+
![vmmap](https://i.imgur.com/V9zMLUt.png)
7665

7766
### Defining arbitrary custom structures
7867

7968
![sparc-arb-struct](https://i.imgur.com/dEMUuP7.png)
8069

81-
8270
### Highlight custom strings
8371

8472
![highlight-command](https://i.imgur.com/UwSPXrV.png)
85-
86-

0 commit comments

Comments
 (0)