def invoke(self, arg, from_tty):
stacktrace_info_list = []
if ScriptUtils.current_arch == type_defs.INFERIOR_ARCH.ARCH_64:
sp_register = "rsp"
else:
sp_register = "esp"
stack_pointer_int = int(
ScriptUtils.examine_expression("$" + sp_register).address, 16)
result = gdb.execute("bt", from_tty, to_string=True)
max_frame = common_regexes.max_frame_count.findall(result)[-1]
# +1 because frame numbers start from 0
for item in range(int(max_frame) + 1):
result = gdb.execute("info frame " + str(item),
from_tty,
to_string=True)
frame_address = common_regexes.frame_address.search(result).group(
1)
difference = hex(int(frame_address, 16) - stack_pointer_int)
frame_address_with_difference = frame_address + "(" + sp_register + "+" + difference + ")"
return_address = common_regexes.return_address.search(result)
if return_address:
return_address_with_info = ScriptUtils.examine_expression(
return_address.group(1)).all
else:
return_address_with_info = "<unavailable>"
stacktrace_info_list.append(
[return_address_with_info, frame_address_with_difference])
send_to_pince(stacktrace_info_list)
def invoke(self, arg, from_tty):
breakpoints = arg
current_pc_int = int(
SysUtils.extract_address(str(gdb.parse_and_eval("$pc"))), 16)
try:
disas_output = gdb.execute("disas $pc-30,$pc", to_string=True)
# Just before the line "End of assembler dump"
last_instruction = disas_output.splitlines()[-2]
previous_pc_address = SysUtils.extract_address(last_instruction)
except:
previous_pc_address = hex(current_pc_int)
global track_watchpoint_dict
try:
count = track_watchpoint_dict[breakpoints][current_pc_int][0] + 1
except KeyError:
if breakpoints not in track_watchpoint_dict:
track_watchpoint_dict[breakpoints] = OrderedDict()
count = 1
register_info = ScriptUtils.get_general_registers()
register_info.update(ScriptUtils.get_flag_registers())
register_info.update(ScriptUtils.get_segment_registers())
float_info = ScriptUtils.get_float_registers()
disas_info = gdb.execute("disas " + previous_pc_address + ",+40",
to_string=True).replace("=>", " ")
track_watchpoint_dict[breakpoints][current_pc_int] = [
count, previous_pc_address, register_info, float_info, disas_info
]
track_watchpoint_file = SysUtils.get_track_watchpoint_file(
pid, breakpoints)
pickle.dump(track_watchpoint_dict[breakpoints],
open(track_watchpoint_file, "wb"))
def invoke(self, arg, from_tty):
breakpoints = arg
current_pc_int = int(SysUtils.extract_address(str(gdb.parse_and_eval("$pc"))), 16)
try:
disas_output = gdb.execute("disas $pc-30,$pc", to_string=True)
# Just before the line "End of assembler dump"
last_instruction = disas_output.splitlines()[-2]
previous_pc_address = SysUtils.extract_address(last_instruction)
except:
previous_pc_address = hex(current_pc_int)
global track_watchpoint_dict
try:
count = track_watchpoint_dict[breakpoints][current_pc_int][0] + 1
except KeyError:
if breakpoints not in track_watchpoint_dict:
track_watchpoint_dict[breakpoints] = OrderedDict()
count = 1
register_info = ScriptUtils.get_general_registers()
register_info.update(ScriptUtils.get_flag_registers())
register_info.update(ScriptUtils.get_segment_registers())
float_info = ScriptUtils.get_float_registers()
disas_info = gdb.execute("disas " + previous_pc_address + ",+40", to_string=True).replace("=>", " ")
track_watchpoint_dict[breakpoints][current_pc_int] = [count, previous_pc_address, register_info, float_info,
disas_info]
track_watchpoint_file = SysUtils.get_track_watchpoint_file(pid, breakpoints)
pickle.dump(track_watchpoint_dict[breakpoints], open(track_watchpoint_file, "wb"))
def invoke(self, arg, from_tty):
breakpoint, max_trace_count, stop_condition, step_mode, stop_after_trace,collect_general_registers,\
collect_flag_registers, collect_segment_registers, collect_float_registers = eval(arg)
gdb.execute("delete " + breakpoint)
regex_ret = re.compile(r":\s+ret") # 0x7f71a4dc5ff8 <poll+72>: ret
regex_call = re.compile(
r":\s+call") # 0x7f71a4dc5fe4 <poll+52>: call 0x7f71a4de1100
contents_send = type_defs.TraceInstructionsTree()
for x in range(max_trace_count):
line_info = gdb.execute("x/i $pc",
to_string=True).split(maxsplit=1)[1]
collect_dict = OrderedDict()
if collect_general_registers:
collect_dict.update(ScriptUtils.get_general_registers())
if collect_flag_registers:
collect_dict.update(ScriptUtils.get_flag_registers())
if collect_segment_registers:
collect_dict.update(ScriptUtils.get_segment_registers())
if collect_float_registers:
collect_dict.update(ScriptUtils.get_float_registers())
contents_send.add_child(
type_defs.TraceInstructionsTree(line_info, collect_dict))
status_info = (type_defs.TRACE_STATUS.STATUS_TRACING,
line_info + " (" + str(x + 1) + "/" +
str(max_trace_count) + ")")
trace_status_file = SysUtils.get_trace_instructions_status_file(
pid, breakpoint)
pickle.dump(status_info, open(trace_status_file, "wb"))
if regex_ret.search(line_info):
if contents_send.parent is None:
new_parent = type_defs.TraceInstructionsTree()
contents_send.set_parent(new_parent)
new_parent.add_child(contents_send)
contents_send = contents_send.parent
elif step_mode == type_defs.STEP_MODE.SINGLE_STEP:
if regex_call.search(line_info):
contents_send = contents_send.children[-1]
if stop_condition:
try:
if str(gdb.parse_and_eval(stop_condition)) == "1":
break
except:
pass
if step_mode == type_defs.STEP_MODE.SINGLE_STEP:
gdb.execute("stepi", to_string=True)
elif step_mode == type_defs.STEP_MODE.STEP_OVER:
gdb.execute("nexti", to_string=True)
trace_instructions_file = SysUtils.get_trace_instructions_file(
pid, breakpoint)
pickle.dump(contents_send.get_root(),
open(trace_instructions_file, "wb"))
status_info = (type_defs.TRACE_STATUS.STATUS_FINISHED,
"Tracing has been completed")
trace_status_file = SysUtils.get_trace_instructions_status_file(
pid, breakpoint)
pickle.dump(status_info, open(trace_status_file, "wb"))
if not stop_after_trace:
gdb.execute("c")
def invoke(self, arg, from_tty):
contents_recv = receive_from_pince()
# last item of contents_recv is always value, so we pop it from the list first
value = contents_recv.pop()
# contents_recv format after popping the value: [[address1, index1],[address2, index2], ...]
for item in contents_recv:
address = item[0]
index = item[1]
ScriptUtils.write_address(address, index, value)
def invoke(self, arg, from_tty):
contents_recv = receive_from_pince()
# last item of contents_recv is always value, so we pop it from the list first
value = contents_recv.pop()
# contents_recv format after popping the value: [[address1, index1],[address2, index2], ...]
for item in contents_recv:
address = item[0]
index = item[1]
ScriptUtils.write_address(address, index, value)
def invoke(self, arg, from_tty):
stack_info_list = []
if ScriptUtils.current_arch == type_defs.INFERIOR_ARCH.ARCH_64:
chunk_size = 8
int_format = "Q"
sp_register = "rsp"
else:
chunk_size = 4
int_format = "I"
sp_register = "esp"
sp_address = int(
ScriptUtils.examine_expression("$" + sp_register).address, 16)
with open(ScriptUtils.mem_file, "rb") as FILE:
try:
old_position = FILE.seek(sp_address)
except (OSError, ValueError):
send_to_pince(stack_info_list)
return
for index in range(int(4096 / chunk_size)):
current_offset = chunk_size * index
stack_indicator = hex(sp_address + current_offset
) + "(" + sp_register + "+" + hex(
current_offset) + ")"
try:
FILE.seek(old_position)
read = FILE.read(chunk_size)
except (OSError, ValueError):
print("Can't access the stack after address " +
stack_indicator)
break
old_position = FILE.tell()
int_addr = struct.unpack_from(int_format, read)[0]
hex_repr = hex(int_addr)
try:
FILE.seek(int_addr)
read_pointer = FILE.read(20)
except (OSError, ValueError):
pointer_data = ""
else:
symbol = ScriptUtils.examine_expression(hex_repr).symbol
if not symbol:
pointer_data = "(str)" + read_pointer.decode(
"utf-8", "ignore")
else:
pointer_data = "(ptr)" + symbol
stack_info_list.append(
[stack_indicator, hex_repr, pointer_data])
send_to_pince(stack_info_list)
def invoke(self, arg, from_tty):
searched_str, case_sensitive, enable_regex = eval(arg)
if enable_regex:
try:
if case_sensitive:
regex = re.compile(searched_str)
else:
regex = re.compile(searched_str, re.IGNORECASE)
except Exception as e:
print("An exception occurred while trying to compile the given regex\n", str(e))
return
str_dict = shelve.open(SysUtils.get_referenced_calls_file(pid), "r")
returned_list = []
for index, item in enumerate(str_dict):
symbol = ScriptUtils.examine_expression(item).all
if not symbol:
continue
if enable_regex:
if not regex.search(symbol):
continue
else:
if case_sensitive:
if symbol.find(searched_str) == -1:
continue
else:
if symbol.lower().find(searched_str.lower()) == -1:
continue
returned_list.append((symbol, len(str_dict[item])))
str_dict.close()
send_to_pince(returned_list)
def invoke(self, arg, from_tty):
data_read_list = []
contents_recv = receive_from_pince()
# contents_recv format: [[address1, index1, length1, unicode1, zero_terminate1, only_bytes], ...]
for item in contents_recv:
address = item[0]
index = item[1]
try:
length = item[2]
except IndexError:
length = 0
try:
unicode = item[3]
except IndexError:
unicode = False
try:
zero_terminate = item[4]
except IndexError:
zero_terminate = True
try:
only_bytes = item[5]
except IndexError:
only_bytes = False
data_read = ScriptUtils.read_single_address(
address, index, length, unicode, zero_terminate, only_bytes)
data_read_list.append(data_read)
send_to_pince(data_read_list)
def invoke(self, arg, from_tty):
arg_list = arg.split(",")
breakpoint_number = arg_list.pop()
register_expressions = arg_list
global track_breakpoint_dict
if not breakpoint_number in track_breakpoint_dict:
track_breakpoint_dict[breakpoint_number] = OrderedDict()
for register_expression in register_expressions:
if not register_expression:
continue
if not register_expression in track_breakpoint_dict[
breakpoint_number]:
track_breakpoint_dict[breakpoint_number][
register_expression] = OrderedDict()
try:
address = ScriptUtils.examine_expression(
register_expression).address
except:
address = None
if address:
if address not in track_breakpoint_dict[breakpoint_number][
register_expression]:
track_breakpoint_dict[breakpoint_number][
register_expression][address] = 1
else:
track_breakpoint_dict[breakpoint_number][
register_expression][address] += 1
track_breakpoint_file = SysUtils.get_track_breakpoint_file(
pid, breakpoint_number)
pickle.dump(track_breakpoint_dict[breakpoint_number],
open(track_breakpoint_file, "wb"))
def invoke(self, arg, from_tty):
data_read_list = []
contents_recv = receive_from_pince()
mem_handle = open(ScriptUtils.mem_file, "rb")
# contents_recv format: [[address1, index1, length1, zero_terminate1, only_bytes], ...]
for item in contents_recv:
address = item[0]
index = item[1]
try:
length = item[2]
except IndexError:
length = 0
try:
zero_terminate = item[3]
except IndexError:
zero_terminate = True
try:
only_bytes = item[4]
except IndexError:
only_bytes = False
data_read = ScriptUtils.read_address(address, index, length,
zero_terminate, only_bytes,
mem_handle)
data_read_list.append(data_read)
mem_handle.close()
send_to_pince(data_read_list)
def invoke(self, arg, from_tty):
data_read_list = []
contents_recv = receive_from_pince()
mem_handle = open(ScriptUtils.mem_file, "rb")
# contents_recv format: [[address1, index1, length1, zero_terminate1, only_bytes], ...]
for item in contents_recv:
address = item[0]
index = item[1]
try:
length = item[2]
except IndexError:
length = 0
try:
zero_terminate = item[3]
except IndexError:
zero_terminate = True
try:
only_bytes = item[4]
except IndexError:
only_bytes = False
data_read = ScriptUtils.read_address(address, index, length, zero_terminate, only_bytes, mem_handle)
data_read_list.append(data_read)
mem_handle.close()
send_to_pince(data_read_list)
def invoke(self, arg, from_tty):
searched_str, case_sensitive, enable_regex = eval(arg)
if enable_regex:
try:
if case_sensitive:
regex = re.compile(searched_str)
else:
regex = re.compile(searched_str, re.IGNORECASE)
except Exception as e:
print(
"An exception occurred while trying to compile the given regex\n",
str(e))
return
str_dict = shelve.open(SysUtils.get_referenced_calls_file(pid), "r")
returned_list = []
for index, item in enumerate(str_dict):
symbol = ScriptUtils.examine_expression(item).all
if not symbol:
continue
if enable_regex:
if not regex.search(symbol):
continue
else:
if case_sensitive:
if symbol.find(searched_str) == -1:
continue
else:
if symbol.lower().find(searched_str.lower()) == -1:
continue
returned_list.append((symbol, len(str_dict[item])))
str_dict.close()
send_to_pince(returned_list)
def invoke(self, arg, from_tty):
data_read_list = []
contents_recv = receive_from_pince()
# contents_recv format: [expression1, expression2, ...]
for expression in contents_recv:
result_tuple = ScriptUtils.examine_expression(expression)
data_read_list.append(result_tuple)
send_to_pince(data_read_list)
def invoke(self, arg, from_tty):
data_read_list = []
contents_recv = receive_from_pince()
# contents_recv format: [expression1, expression2, ...]
for expression in contents_recv:
result_tuple = ScriptUtils.examine_expression(expression)
data_read_list.append(result_tuple)
send_to_pince(data_read_list)
def invoke(self, arg, from_tty):
contents_recv = receive_from_pince()
address = contents_recv[0]
value_index = contents_recv[1]
length = contents_recv[2]
is_unicode = contents_recv[3]
zero_terminate = contents_recv[4]
contents_send = ScriptUtils.read_single_address(address, value_index, length, is_unicode, zero_terminate)
send_to_pince(contents_send)
def invoke(self, arg, from_tty):
stack_info_list = []
if ScriptUtils.current_arch == type_defs.INFERIOR_ARCH.ARCH_64:
chunk_size = 8
int_format = "Q"
sp_register = "rsp"
else:
chunk_size = 4
int_format = "I"
sp_register = "esp"
sp_address = int(ScriptUtils.examine_expression("$" + sp_register).address, 16)
with open(ScriptUtils.mem_file, "rb") as FILE:
try:
old_position = FILE.seek(sp_address)
except (OSError, ValueError):
send_to_pince(stack_info_list)
return
for index in range(int(4096 / chunk_size)):
current_offset = chunk_size * index
stack_indicator = hex(sp_address + current_offset) + "(" + sp_register + "+" + hex(current_offset) + ")"
try:
FILE.seek(old_position)
read = FILE.read(chunk_size)
except (OSError, ValueError):
print("Can't access the stack after address " + stack_indicator)
break
old_position = FILE.tell()
int_addr = struct.unpack_from(int_format, read)[0]
hex_repr = hex(int_addr)
try:
FILE.seek(int_addr)
read_pointer = FILE.read(20)
except (OSError, ValueError):
pointer_data = ""
else:
symbol = ScriptUtils.examine_expression(hex_repr).symbol
if not symbol:
pointer_data = "(str)" + read_pointer.decode("utf-8", "ignore")
else:
pointer_data = "(ptr)" + symbol
stack_info_list.append([stack_indicator, hex_repr, pointer_data])
send_to_pince(stack_info_list)
def invoke(self, arg, from_tty):
contents_recv = receive_from_pince()
address = contents_recv[0]
value_index = contents_recv[1]
length = contents_recv[2]
zero_terminate = contents_recv[3]
only_bytes = contents_recv[4]
data_read = ScriptUtils.read_single_address(address, value_index,
length, zero_terminate,
only_bytes)
send_to_pince(data_read)
def invoke(self, arg, from_tty):
contents_recv = receive_from_pince()
# last item of contents_recv is always value, so we pop it from the list first
value = contents_recv.pop()
# contents_recv format after popping the value: [[address1, index1],[address2, index2], ...]
for item in contents_recv:
address = item[0]
index = item[1]
'''
The reason we do the check here instead of inside of the function set_single_address() is because try/except
block doesn't work in function set_single_address() when writing something to file in /proc/$pid/mem. Python
is normally capable of catching IOError exception, but I have no idea about why it doesn't work in function
set_single_address()
'''
try:
ScriptUtils.set_single_address(address, index, value)
except (IOError, ValueError):
print("Can't access the address " +
address if type(address) == str else hex(address))
def invoke(self, arg, from_tty):
contents_recv = receive_from_pince()
address = contents_recv[0]
index = contents_recv[1]
length = contents_recv[2]
zero_terminate = contents_recv[3]
only_bytes = contents_recv[4]
mem_handle = open(ScriptUtils.mem_file, "rb")
data_read = ScriptUtils.read_single_address(address, index, length,
zero_terminate, only_bytes,
mem_handle)
mem_handle.close()
send_to_pince(data_read)
def invoke(self, arg, from_tty):
stacktrace_info_list = []
if ScriptUtils.current_arch == type_defs.INFERIOR_ARCH.ARCH_64:
sp_register = "rsp"
else:
sp_register = "esp"
stack_pointer_int = int(ScriptUtils.examine_expression("$" + sp_register).address, 16)
result = gdb.execute("bt", from_tty, to_string=True)
max_frame = common_regexes.max_frame_count.findall(result)[-1]
# +1 because frame numbers start from 0
for item in range(int(max_frame) + 1):
result = gdb.execute("info frame " + str(item), from_tty, to_string=True)
frame_address = common_regexes.frame_address.search(result).group(1)
difference = hex(int(frame_address, 16) - stack_pointer_int)
frame_address_with_difference = frame_address + "(" + sp_register + "+" + difference + ")"
return_address = common_regexes.return_address.search(result)
if return_address:
return_address_with_info = ScriptUtils.examine_expression(return_address.group(1)).all
else:
return_address_with_info = "<unavailable>"
stacktrace_info_list.append([return_address_with_info, frame_address_with_difference])
send_to_pince(stacktrace_info_list)
def invoke(self, arg, from_tty):
data_read_list = []
contents_recv = receive_from_pince()
# contents_recv format: [[expression1, include_address1], ...]
for item in contents_recv:
expression = item[0]
try:
include_address = item[1]
except IndexError:
include_address = True
data_read = ScriptUtils.convert_address_to_symbol(
expression, include_address)
data_read_list.append(data_read)
send_to_pince(data_read_list)
def invoke(self, arg, from_tty):
return_address_list = []
result = gdb.execute("bt", from_tty, to_string=True)
max_frame = common_regexes.max_frame_count.findall(result)[-1]
# +1 because frame numbers start from 0
for item in range(int(max_frame) + 1):
result = gdb.execute("info frame " + str(item), from_tty, to_string=True)
return_address = common_regexes.return_address.search(result)
if return_address:
return_address_with_info = ScriptUtils.examine_expression(return_address.group(1)).all
else:
return_address_with_info = "<unavailable>"
return_address_list.append(return_address_with_info)
send_to_pince(return_address_list)
def invoke(self, arg, from_tty):
return_address_list = []
result = gdb.execute("bt", from_tty, to_string=True)
max_frame = common_regexes.max_frame_count.findall(result)[-1]
# +1 because frame numbers start from 0
for item in range(int(max_frame) + 1):
result = gdb.execute("info frame " + str(item),
from_tty,
to_string=True)
return_address = common_regexes.return_address.search(result)
if return_address:
return_address_with_info = ScriptUtils.examine_expression(
return_address.group(1)).all
else:
return_address_with_info = "<unavailable>"
return_address_list.append(return_address_with_info)
send_to_pince(return_address_list)
def invoke(self, arg, from_tty):
arg_list = arg.split(",")
breakpoint_number = arg_list.pop()
register_expressions = arg_list
global track_breakpoint_dict
if not breakpoint_number in track_breakpoint_dict:
track_breakpoint_dict[breakpoint_number] = OrderedDict()
for register_expression in register_expressions:
if not register_expression:
continue
if not register_expression in track_breakpoint_dict[breakpoint_number]:
track_breakpoint_dict[breakpoint_number][register_expression] = OrderedDict()
try:
address = ScriptUtils.examine_expression(register_expression).address
except:
address = None
if address:
if address not in track_breakpoint_dict[breakpoint_number][register_expression]:
track_breakpoint_dict[breakpoint_number][register_expression][address] = 1
else:
track_breakpoint_dict[breakpoint_number][register_expression][address] += 1
track_breakpoint_file = SysUtils.get_track_breakpoint_file(pid, breakpoint_number)
pickle.dump(track_breakpoint_dict[breakpoint_number], open(track_breakpoint_file, "wb"))
def invoke(self, arg, from_tty):
expression, ignore_case = receive_from_pince()
function_list = []
if ignore_case:
gdb.execute("set case-sensitive off")
else:
gdb.execute("set case-sensitive on")
output = gdb.execute("info functions " + expression,
to_string=True).splitlines()
gdb.execute("set case-sensitive auto")
for line in output:
non_debugging = common_regexes.info_functions_non_debugging.search(
line)
if non_debugging:
function_list.append(
(non_debugging.group(1), non_debugging.group(2)))
else:
defined = common_regexes.info_functions_defined.search(line)
if defined:
symbol = defined.group(1)
function_list.append(
(ScriptUtils.examine_expression("'" + symbol +
"'").address, symbol))
send_to_pince(function_list)
def invoke(self, arg, from_tty):
(breakpoint, max_trace_count, stop_condition, step_mode,
stop_after_trace, collect_general_registers, collect_flag_registers,
collect_segment_registers, collect_float_registers) = eval(arg)
gdb.execute("delete " + breakpoint)
trace_status_file = SysUtils.get_trace_instructions_status_file(
pid, breakpoint)
# The reason we don't use a tree class is to make the tree json-compatible
# tree format-->[node1, node2, node3, ...]
# node-->[(line_info, register_dict), parent_index, child_index_list]
tree = []
current_index = 0 # Avoid calling len()
current_root_index = 0
root_index = 0
# Root always be an empty node, it's up to you to use or delete it
tree.append([("", None), None, []])
for x in range(max_trace_count):
try:
output = pickle.load(open(trace_status_file, "rb"))
if output[0] == type_defs.TRACE_STATUS.STATUS_CANCELED:
break
except:
pass
line_info = gdb.execute("x/i $pc",
to_string=True).split(maxsplit=1)[1]
collect_dict = OrderedDict()
if collect_general_registers:
collect_dict.update(ScriptUtils.get_general_registers())
if collect_flag_registers:
collect_dict.update(ScriptUtils.get_flag_registers())
if collect_segment_registers:
collect_dict.update(ScriptUtils.get_segment_registers())
if collect_float_registers:
collect_dict.update(ScriptUtils.get_float_registers())
current_index += 1
tree.append([(line_info, collect_dict), current_root_index, []])
tree[current_root_index][2].append(current_index) # Add a child
status_info = (type_defs.TRACE_STATUS.STATUS_TRACING,
line_info + " (" + str(x + 1) + "/" +
str(max_trace_count) + ")")
pickle.dump(status_info, open(trace_status_file, "wb"))
if common_regexes.trace_instructions_ret.search(line_info):
if tree[current_root_index][1] is None: # If no parents exist
current_index += 1
tree.append([("", None), None, [current_root_index]])
tree[current_root_index][
1] = current_index # Set new parent
current_root_index = current_index # current_node=current_node.parent
root_index = current_root_index # set new root
else:
current_root_index = tree[current_root_index][
1] # current_node=current_node.parent
elif step_mode == type_defs.STEP_MODE.SINGLE_STEP:
if common_regexes.trace_instructions_call.search(line_info):
current_root_index = current_index
if stop_condition:
try:
if str(gdb.parse_and_eval(stop_condition)) == "1":
break
except:
pass
if step_mode == type_defs.STEP_MODE.SINGLE_STEP:
gdb.execute("stepi", to_string=True)
elif step_mode == type_defs.STEP_MODE.STEP_OVER:
gdb.execute("nexti", to_string=True)
status_info = (type_defs.TRACE_STATUS.STATUS_PROCESSING,
"Processing the collected data")
pickle.dump(status_info, open(trace_status_file, "wb"))
trace_instructions_file = SysUtils.get_trace_instructions_file(
pid, breakpoint)
json.dump((tree, root_index), open(trace_instructions_file, "w"))
status_info = (type_defs.TRACE_STATUS.STATUS_FINISHED,
"Tracing has been completed")
pickle.dump(status_info, open(trace_status_file, "wb"))
if not stop_after_trace:
gdb.execute("c")
def invoke(self, arg, from_tty):
registers = ScriptUtils.get_general_registers()
registers.update(ScriptUtils.get_flag_registers())
registers.update(ScriptUtils.get_segment_registers())
send_to_pince(registers)
def invoke(self, arg, from_tty):
send_to_pince(ScriptUtils.get_float_registers())
def invoke(self, arg, from_tty):
(breakpoint, max_trace_count, stop_condition, step_mode, stop_after_trace, collect_general_registers,
collect_flag_registers, collect_segment_registers, collect_float_registers) = eval(arg)
gdb.execute("delete " + breakpoint)
trace_status_file = SysUtils.get_trace_instructions_status_file(pid, breakpoint)
# The reason we don't use a tree class is to make the tree json-compatible
# tree format-->[node1, node2, node3, ...]
# node-->[(line_info, register_dict), parent_index, child_index_list]
tree = []
current_index = 0 # Avoid calling len()
current_root_index = 0
root_index = 0
# Root always be an empty node, it's up to you to use or delete it
tree.append([("", None), None, []])
for x in range(max_trace_count):
try:
output = pickle.load(open(trace_status_file, "rb"))
if output[0] == type_defs.TRACE_STATUS.STATUS_CANCELED:
break
except:
pass
line_info = gdb.execute("x/i $pc", to_string=True).split(maxsplit=1)[1]
collect_dict = OrderedDict()
if collect_general_registers:
collect_dict.update(ScriptUtils.get_general_registers())
if collect_flag_registers:
collect_dict.update(ScriptUtils.get_flag_registers())
if collect_segment_registers:
collect_dict.update(ScriptUtils.get_segment_registers())
if collect_float_registers:
collect_dict.update(ScriptUtils.get_float_registers())
current_index += 1
tree.append([(line_info, collect_dict), current_root_index, []])
tree[current_root_index][2].append(current_index) # Add a child
status_info = (type_defs.TRACE_STATUS.STATUS_TRACING,
line_info + " (" + str(x + 1) + "/" + str(max_trace_count) + ")")
pickle.dump(status_info, open(trace_status_file, "wb"))
if common_regexes.trace_instructions_ret.search(line_info):
if tree[current_root_index][1] is None: # If no parents exist
current_index += 1
tree.append([("", None), None, [current_root_index]])
tree[current_root_index][1] = current_index # Set new parent
current_root_index = current_index # current_node=current_node.parent
root_index = current_root_index # set new root
else:
current_root_index = tree[current_root_index][1] # current_node=current_node.parent
elif step_mode == type_defs.STEP_MODE.SINGLE_STEP:
if common_regexes.trace_instructions_call.search(line_info):
current_root_index = current_index
if stop_condition:
try:
if str(gdb.parse_and_eval(stop_condition)) == "1":
break
except:
pass
if step_mode == type_defs.STEP_MODE.SINGLE_STEP:
gdb.execute("stepi", to_string=True)
elif step_mode == type_defs.STEP_MODE.STEP_OVER:
gdb.execute("nexti", to_string=True)
status_info = (type_defs.TRACE_STATUS.STATUS_PROCESSING, "Processing the collected data")
pickle.dump(status_info, open(trace_status_file, "wb"))
trace_instructions_file = SysUtils.get_trace_instructions_file(pid, breakpoint)
json.dump((tree, root_index), open(trace_instructions_file, "w"))
status_info = (type_defs.TRACE_STATUS.STATUS_FINISHED, "Tracing has been completed")
pickle.dump(status_info, open(trace_status_file, "wb"))
if not stop_after_trace:
gdb.execute("c")
def invoke(self, arg, from_tty):
registers = ScriptUtils.get_general_registers()
registers.update(ScriptUtils.get_flag_registers())
registers.update(ScriptUtils.get_segment_registers())
send_to_pince(registers)
# Format of expression_info_dict: {value1:count1, value2:count2, ...}
# Format of register_expression_dict: {expression1:expression_info_dict1, expression2:expression_info_dict2, ...}
# Format: {breakpoint_number1:register_expression_dict1, breakpoint_number2:register_expression_dict2, ...}
track_breakpoint_dict = {}
def receive_from_pince():
return pickle.load(open(recv_file, "rb"))
def send_to_pince(contents_send):
pickle.dump(contents_send, open(send_file, "wb"))
ScriptUtils.gdbinit()
class ReadAddresses(gdb.Command):
def __init__(self):
super(ReadAddresses, self).__init__("pince-read-addresses",
gdb.COMMAND_USER)
def invoke(self, arg, from_tty):
data_read_list = []
contents_recv = receive_from_pince()
mem_handle = open(ScriptUtils.mem_file, "rb")
# contents_recv format: [[address1, index1, length1, zero_terminate1, only_bytes], ...]
for item in contents_recv:
address = item[0]
def invoke(self, arg, from_tty):
referenced_strings_dict = shelve.open(
SysUtils.get_referenced_strings_file(pid), writeback=True)
referenced_jumps_dict = shelve.open(
SysUtils.get_referenced_jumps_file(pid), writeback=True)
referenced_calls_dict = shelve.open(
SysUtils.get_referenced_calls_file(pid), writeback=True)
regex_valid_address = re.compile(
r"(\s+|\[|,)0x[0-9a-fA-F]+(\s+|\]|,|$)")
regex_hex = re.compile(r"0x[0-9a-fA-F]+")
regex_instruction = re.compile(r"\w+")
region_list = receive_from_pince()
dissect_code_status_file = SysUtils.get_dissect_code_status_file(pid)
region_count = len(region_list)
self.memory = open(ScriptUtils.mem_file, "rb")
buffer = 0x10000
for region_index, region in enumerate(region_list):
region_info = region.addr, "Region " + str(
region_index + 1) + " of " + str(region_count)
start_addr, end_addr = region.addr.split("-")
start_addr = int(start_addr, 16)
end_addr = int(end_addr, 16)
remaining_space = end_addr - start_addr
while remaining_space > 0:
if remaining_space < buffer:
offset = start_addr + remaining_space
else:
offset = start_addr + buffer
start_addr_str = hex(start_addr)
offset_str = hex(offset)
status_info = region_info + (start_addr_str + "-" + offset_str,
len(referenced_strings_dict),
len(referenced_jumps_dict),
len(referenced_calls_dict))
pickle.dump(status_info, open(dissect_code_status_file, "wb"))
disas_data = gdb.execute("disas " + start_addr_str + "," +
offset_str,
to_string=True)
start_addr = offset
remaining_space -= buffer
lines = disas_data.splitlines()
del lines[0], lines[
-1] # Get rid of "End of assembler dump" and "Dump of assembler code..." texts
for line in lines:
referrer_address, opcode = line.split(":", maxsplit=1)
opcode = opcode.strip()
opcode = ScriptUtils.remove_disas_comment(opcode)
if opcode.startswith("j") or opcode.startswith("loop"):
found = regex_valid_address.search(opcode)
if found:
referenced_address_str = regex_hex.search(
found.group(0)).group(0)
referenced_address_int = int(
referenced_address_str, 16)
if self.is_memory_valid(referenced_address_int):
instruction = regex_instruction.search(
opcode).group(0)
referrer_address = regex_hex.search(
referrer_address).group(0)
try:
referenced_jumps_dict[
referenced_address_str][
referrer_address] = instruction
except KeyError:
referenced_jumps_dict[
referenced_address_str] = {}
if opcode.startswith("call"):
found = regex_valid_address.search(opcode)
if found:
referenced_address_str = regex_hex.search(
found.group(0)).group(0)
referenced_address_int = int(
referenced_address_str, 16)
if self.is_memory_valid(referenced_address_int):
referrer_address = regex_hex.search(
referrer_address).group(0)
try:
referenced_calls_dict[
referenced_address_str].add(
referrer_address)
except KeyError:
referenced_calls_dict[
referenced_address_str] = set()
else:
found = regex_valid_address.search(opcode)
if found:
referenced_address_str = regex_hex.search(
found.group(0)).group(0)
referenced_address_int = int(
referenced_address_str, 16)
if self.is_memory_valid(referenced_address_int):
referrer_address = regex_hex.search(
referrer_address).group(0)
try:
referenced_strings_dict[
referenced_address_str].add(
referrer_address)
except KeyError:
referenced_strings_dict[
referenced_address_str] = set()
self.memory.close()
# Format of expression_info_dict: {value1:count1, value2:count2, ...}
# Format of register_expression_dict: {expression1:expression_info_dict1, expression2:expression_info_dict2, ...}
# Format: {breakpoint_number1:register_expression_dict1, breakpoint_number2:register_expression_dict2, ...}
track_breakpoint_dict = {}
def receive_from_pince():
return pickle.load(open(recv_file, "rb"))
def send_to_pince(contents_send):
pickle.dump(contents_send, open(send_file, "wb"))
ScriptUtils.gdbinit()
class ReadAddresses(gdb.Command):
def __init__(self):
super(ReadAddresses, self).__init__("pince-read-addresses", gdb.COMMAND_USER)
def invoke(self, arg, from_tty):
data_read_list = []
contents_recv = receive_from_pince()
mem_handle = open(ScriptUtils.mem_file, "rb")
# contents_recv format: [[address1, index1, length1, zero_terminate1, only_bytes], ...]
for item in contents_recv:
address = item[0]
index = item[1]
def invoke(self, arg, from_tty):
send_to_pince(ScriptUtils.get_float_registers())
def invoke(self, arg, from_tty):
breakpoint, max_trace_count, stop_condition, step_mode, stop_after_trace, collect_general_registers, \
collect_flag_registers, collect_segment_registers, collect_float_registers = eval(arg)
gdb.execute("delete " + breakpoint)
trace_status_file = SysUtils.get_trace_instructions_status_file(
pid, breakpoint)
regex_ret = re.compile(r":\s+ret") # 0x7f71a4dc5ff8 <poll+72>: ret
regex_call = re.compile(
r":\s+call") # 0x7f71a4dc5fe4 <poll+52>: call 0x7f71a4de1100
tree_root = last_node = current_node = [("", None), None, []]
for x in range(max_trace_count):
try:
output = pickle.load(open(trace_status_file, "rb"))
if output[0] == type_defs.TRACE_STATUS.STATUS_CANCELED:
break
except:
pass
line_info = gdb.execute("x/i $pc",
to_string=True).split(maxsplit=1)[1]
collect_dict = OrderedDict()
if collect_general_registers:
collect_dict.update(ScriptUtils.get_general_registers())
if collect_flag_registers:
collect_dict.update(ScriptUtils.get_flag_registers())
if collect_segment_registers:
collect_dict.update(ScriptUtils.get_segment_registers())
if collect_float_registers:
collect_dict.update(ScriptUtils.get_float_registers())
current_node[2].append(
((line_info, collect_dict), current_node, []))
status_info = (type_defs.TRACE_STATUS.STATUS_TRACING,
line_info + " (" + str(x + 1) + "/" +
str(max_trace_count) + ")")
pickle.dump(status_info, open(trace_status_file, "wb"))
if regex_ret.search(line_info):
if current_node == tree_root:
tree_root = (("", None), [], [tree_root])
current_node = last_node
elif step_mode == type_defs.STEP_MODE.SINGLE_STEP:
if regex_call.search(line_info):
last_node = current_node
current_node = current_node[2][-1]
if stop_condition:
try:
if str(gdb.parse_and_eval(stop_condition)) == "1":
break
except:
pass
if step_mode == type_defs.STEP_MODE.SINGLE_STEP:
gdb.execute("stepi", to_string=True)
elif step_mode == type_defs.STEP_MODE.STEP_OVER:
gdb.execute("nexti", to_string=True)
status_info = (type_defs.TRACE_STATUS.STATUS_PROCESSING,
"Processing the collected data")
pickle.dump(status_info, open(trace_status_file, "wb"))
trace_instructions_file = SysUtils.get_trace_instructions_file(
pid, breakpoint)
pickle.dump(tree_root, open(trace_instructions_file, "wb"))
status_info = (type_defs.TRACE_STATUS.STATUS_FINISHED,
"Tracing has been completed")
pickle.dump(status_info, open(trace_status_file, "wb"))
if not stop_after_trace:
gdb.execute("c")
def invoke(self, arg, from_tty):
contents_send = ScriptUtils.get_float_registers()
send_to_pince(contents_send)
def invoke(self, arg, from_tty):
contents_send = ScriptUtils.get_general_registers()
contents_send.update(ScriptUtils.get_flag_registers())
contents_send.update(ScriptUtils.get_segment_registers())
send_to_pince(contents_send)
def invoke(self, arg, from_tty):
global referenced_jumps_dict
global referenced_calls_dict
global referenced_strings_dict
regex_valid_address = re.compile(
r"(\s+|\[|,)0x[0-9a-fA-F]+(\s+|\]|,|$)")
regex_hex = re.compile(r"0x[0-9a-fA-F]+")
regex_instruction = re.compile(r"\w+")
region_list = receive_from_pince()
dissect_code_status_file = SysUtils.get_dissect_code_status_file(pid)
region_count = len(region_list)
self.memory = open(ScriptUtils.mem_file, "rb")
for region_index, region in enumerate(region_list):
status_info = region.addr, "Region " + str(region_index + 1) + " of " + str(region_count), \
len(referenced_strings_dict), len(referenced_jumps_dict), len(referenced_calls_dict)
pickle.dump(status_info, open(dissect_code_status_file, "wb"))
start_addr, end_addr = region.addr.split("-")
start_addr = "0x" + start_addr
end_addr = "0x" + end_addr
disas_data = gdb.execute("disas " + start_addr + "," + end_addr,
to_string=True)
lines = disas_data.splitlines()
del lines[0], lines[
-1] # Get rid of "End of assembler dump" and "Dump of assembler code..." texts
for line in lines:
referrer_address, opcode = line.split(":", maxsplit=1)
opcode = opcode.strip()
opcode = ScriptUtils.remove_disas_comment(opcode)
if opcode.startswith("j") or opcode.startswith("loop"):
found = regex_valid_address.search(opcode)
if found:
referenced_int_address = int(
regex_hex.search(found.group(0)).group(0), 16)
if self.is_memory_valid(referenced_int_address):
instruction = regex_instruction.search(
opcode).group(0)
referrer_int_address = int(
regex_hex.search(referrer_address).group(0),
16)
if not referenced_int_address in referenced_jumps_dict:
referenced_jumps_dict[
referenced_int_address] = {}
referenced_jumps_dict[referenced_int_address][
referrer_int_address] = instruction
if opcode.startswith("call"):
found = regex_valid_address.search(opcode)
if found:
referenced_int_address = int(
regex_hex.search(found.group(0)).group(0), 16)
if self.is_memory_valid(referenced_int_address):
referrer_int_address = int(
regex_hex.search(referrer_address).group(0),
16)
if not referenced_int_address in referenced_calls_dict:
referenced_calls_dict[
referenced_int_address] = set()
referenced_calls_dict[referenced_int_address].add(
referrer_int_address)
else:
found = regex_valid_address.search(opcode)
if found:
referenced_int_address = int(
regex_hex.search(found.group(0)).group(0), 16)
if self.is_memory_valid(referenced_int_address):
referrer_int_address = int(
regex_hex.search(referrer_address).group(0),
16)
if not referenced_int_address in referenced_strings_dict:
referenced_strings_dict[
referenced_int_address] = set()
referenced_strings_dict[
referenced_int_address].add(
referrer_int_address)
self.memory.close()
