-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathgdb_offset.py
83 lines (70 loc) · 2.67 KB
/
gdb_offset.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
# offsets.py
import gdb
def search(strList, search_patt):
for i in strList:
if search_patt in i:
return i
class Offset(gdb.Command):
def __init__(self):
super(self.__class__, self).__init__("Offset", gdb.COMMAND_USER)
def invoke(self, args, from_tty):
argv = gdb.string_to_argv(args)
#if len(argv) != 2:
# raise gdb.GdbError('invalid argcount.')
vmmap_res = gdb.execute("vmmap", to_string=True).split('\n')[1:]
elf_base_list = vmmap_res[0].split(" ")
for i in elf_base_list:
if "0x" in i:
elf_base = i
break
gdb.execute("set $elf_base=" + elf_base)
for i in vmmap_res:
if "libc" in i:
libc_base_list = i.split(" ")
break
for i in libc_base_list:
if "0x" in i:
libc_base = i
break
gdb.execute("set $libc_base=" + libc_base)
class elf_base(gdb.Command):
def __init__(self):
super(self.__class__, self).__init__("elf_base", gdb.COMMAND_USER)
def invoke(self, args, from_tty):
argv = gdb.string_to_argv(args)
gdb.execute("Offset")
res = search(gdb.execute("p /x $elf_base", to_string=True).split(" "), "0x")
print("$elf_base = " + res)
class libc_base(gdb.Command):
def __init__(self):
super(self.__class__, self).__init__("libc_base", gdb.COMMAND_USER)
def invoke(self, args, from_tty):
argv = gdb.string_to_argv(args)
gdb.execute("Offset")
res = search(gdb.execute("p /x $libc_base", to_string=True).split(" "), "0x")
print("$libc_base = " + res)
class createList(gdb.Command):
def __init__(self):
super(self.__class__, self).__init__("createList", gdb.COMMAND_USER)
def invoke(self, args, from_tty):
argv = gdb.string_to_argv(args)
if len(argv) != 1:
fileName = "./.sym"
else:
fileName = argv[0]
with open(fileName, "r+") as fd:
while True:
text = fd.readline().split(" ")
if (not text) or len(text) != 3:
break
off = int(text[0], 16)
name = text[1]
if "elf" in text[2]:
base_chosen = int(search(gdb.execute("elf_base", to_string=True).split(" "), "0x"), 16)
elif "libc" in text[2]:
base_chosen = int(search(gdb.execute("libc_base", to_string=True).split(" "), "0x"), 16)
gdb.execute("set $" + name + "=" + str(off + base_chosen))
Offset()
elf_base()
libc_base()
createList()