Skip to content

Commit

Permalink
Fix code blocks.
Browse files Browse the repository at this point in the history
  • Loading branch information
StevenLwcz committed Oct 1, 2024
1 parent 7a4c715 commit 6c11e0c
Showing 1 changed file with 24 additions and 24 deletions.
48 changes: 24 additions & 24 deletions _posts/2024-10-01-GDB-Using-The-Python-API-To-Read-Memory.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,31 +12,31 @@ The first few will look at how we can read memory from a process and display it

GDB inferiors are just another name for a process. You can see the status of all inferiors in gdb:

...
```
(gdb) info inferior
Num Description Connection Executable
* 1 process 2592 1 (native) /home/stevenlz/post11/gdb-python-blog/a
...
```

Using the Python API:
...
```
(gdb) python
>print(gdb.inferiors())
>end
(<gdb.Inferior num=1, pid=2592>,)
...
```

If there is no inferior running, gdb returns a default one with pid=0.

...
```
(gdb) python
infe = gdb.selected_inferior()
print(infe.pid)
print(infe.num)
end
2592
1
...
```

The primary use we will put this to later, is to know we have a process running.

Expand All @@ -46,72 +46,72 @@ The Python API '''mv=infe.read_memory(addr, numi, )''' is used to read memory fr
Returned is a [MemoryView](https://docs.python.org/3/c-api/memoryview.html) object.

Addr in the API needs to be an integer, 0x5555550000. If you want to find the memory at the address of a variable or expression like you can with the GDB x command, then we can use '''gdb.parse_and_eval()''' function which will return a gdb.Value object which has an address property.
...
```
(gdb) python
>expr = gdb.parse_and_eval('a')
>addr = expr.address if expr.address != None else expr
>print(hex(int(addr)))
>end
0x7fffffef70
...
```

...
```
(gdb) python
mv = infe.read_memory(addr, 32)
print(mv)
end
<memory at 0x7f98201300>
...
```

### The MemView Obejct

The memview object has several methods:
...
```
(gdb) python
>print(mv.hex(' '))
>end
61 62 63 64 65 66 00 00 20 00 00 00 64 00 00 00 90 f0 ff ff 7f 00 00 00 18 78 e2 f7 7f 00 00 00
...
```

If we want a text respresentation of the memory then we can convert to bytes and convert to an ANSI code page. One problem here is text will contrain control characters which gdb will compain about

...python
```python
(gdb)python
text = mv.tobytes().decode('latin-1')
print(text)
end
ValueError: embedded null character
Error while executing Python code.
...
```

One approach is to replace all the control characters with a . using regulart expressions (link to book)

...python
```python
import re
pattern = re.compile(r'[\x00-\x1f\x7f-\x9f]')
text = pattern.sub('.', text)
print(text)
end
abcdef.. ...d....ðÿÿ.....xâ÷....
...
abcdef.. ```d```.ðÿÿ```..xâ÷```.
```

### Memory View Display

Looking foeard to our memview TUI program, we will want to display the hex and text in a series of rows:
The mv object allows slicing, so we can easily iterate our way over it

...python
```python
(gdb) python
for i in range(0, 32, 8):
m = mv[i:i + 8]
text = pattern.sub('.', m.tobytes().decode('latin-1'))
print(f"{hex(addr + i)}: {m.hex(' ')} {text}")
end
0x7fffffef70: 61 62 63 64 65 66 00 00 abcdef..
0x7fffffefa0: 20 00 00 00 64 00 00 00 ...d...
0x7fffffefd0: 90 f0 ff ff 7f 00 00 00 .ðÿÿ....
0x7ffffff000: 18 78 e2 f7 7f 00 00 00 .xâ÷....
...
0x7fffffefa0: 20 00 00 00 64 00 00 00 ```d```
0x7fffffefd0: 90 f0 ff ff 7f 00 00 00 .ðÿÿ```.
0x7ffffff000: 18 78 e2 f7 7f 00 00 00 .xâ÷```.
```

### Conclusion

Expand All @@ -122,12 +122,12 @@ We will use these basics to develop a TUI window and add more features like scro
#note a-gdb.gdb not needed
In my github you can get [the python code and C demo](https://github.com/StevenLwcz/gdb-python-blog/tree/post11).

...shell
```shell
gcc -g -o a a.c
gdb -q a
(gdb) b main
(gdb) r
(gdb) n
(gdb) n
(gdb) so mv.py
...
```

0 comments on commit 6c11e0c

Please sign in to comment.