Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

Error while debugging a MIPS binary remotely #16680

Open
officialcjunior opened this issue Apr 22, 2020 · 2 comments
Open

Error while debugging a MIPS binary remotely #16680

officialcjunior opened this issue Apr 22, 2020 · 2 comments
Labels
gdb Remote GDB protocol support MIPS MIPS architecture support issues

Comments

@officialcjunior
Copy link
Contributor

Work environment

Questions Answers
OS/arch/bits (mandatory) Ubuntu 18.04.4 LTS, 64 bit
File format of the file you reverse (mandatory) ELF
Architecture/bits of the file (mandatory) MIPS
r2 -v full output, not truncated (mandatory) radare2 4.5.0-git 24411 @ linux-x86-64 git.4.4.0-23-gf549eb2a2 commit: f549eb2 build: 2020-04-17__07:55:34

I've opened up a MIPS binary on QEMU :
sudo chroot . ./qemu-mipsel-static -g 1337 ./pwnable/Intro/stack_bof_01 testinput123

I'm trying to debug it:

r2 -a mips -d -B 0x400630 gdb://127.0.0.1:1337 pwnable/Intro/stack_bof_01

Expected behavior

  • To be able to debug the binary remotely.

Actual behavior

  • It results in:
    free(): invalid next size (fast)
    Aborted (core dumped)

Steps to reproduce the behavior

  • By enabling debug mode

Additional Logs, screenshots, source-code, configuration dump, ...

Backtrace:

#1  0x00007ffff72c0801 in __GI_abort () at abort.c:79
#2  0x00007ffff7309897 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7ffff7436b9a "%s\n") at ../sysdeps/posix/libc_fatal.c:181
#3  0x00007ffff731090a in malloc_printerr (str=str@entry=0x7ffff7438800 "free(): invalid next size (fast)") at malloc.c:5350
#4  0x00007ffff7317f60 in _int_free (have_lock=0, p=0x55555585e900, av=0x7ffff766bc40 <main_arena>) at malloc.c:4213
#5  __GI___libc_free (mem=0x55555585e910) at malloc.c:3124
#6  0x00007ffff78f8528 in r_list_delete (list=0x55555585df00, iter=0x555555861c30) at list.c:106
#7  0x00007ffff78f8392 in r_list_purge (list=0x55555585df00) at list.c:72
#8  0x00007ffff78f83e8 in r_list_free (list=0x55555585df00) at list.c:82
#9  0x00007ffff66705c2 in arch_parse_reg_profile (
    reg_profile=0x555555845b40 "=PC\trip\n=SP\trsp\n=BP\trbp\n=A0\trax\n=A1\trbx\n=A2\trcx\n=A3\trdx\n=SN\torax\ngpr\tfake\t.64\t795\t0\ngpr\trax\t.64\t0\t0\ngpr\trbx\t.64\t8\t0\ngpr\trcx\t.64\t16\t0\ngpr\trdx\t.64\t24\t0\ngpr\trsi\t.64\t32\t0\ngpr\trdi\t.64\t40\t0\ngpr\trbp\t.64\t48\t0"...)
    at src/arch.c:132
#10 0x00007ffff666f194 in gdbr_set_reg_profile (g=0x555555861920, 
    str=0x555555845b40 "=PC\trip\n=SP\trsp\n=BP\trbp\n=A0\trax\n=A1\trbx\n=A2\trcx\n=A3\trdx\n=SN\torax\ngpr\tfake\t.64\t795\t0\ngpr\trax\t.64\t0\t0\ngpr\trbx\t.64\t8\t0\ngpr\trcx\t.64\t16\t0\ngpr\trdx\t.64\t24\t0\ngpr\trsi\t.64\t32\t0\ngpr\trdi\t.64\t40\t0\ngpr\trbp\t.64\t48\t0"...)
    at src/libgdbr.c:119
#11 0x00007ffff666efc2 in gdbr_set_architecture (g=0x555555861920, arch=1, bits=64) at src/libgdbr.c:64
#12 0x00007ffff4fc8909 in r_debug_gdb_attach (dbg=0x5555557eeda0, pid=-1) at p/debug_gdb.c:383
#13 0x00007ffff4fc7801 in check_connection (dbg=0x5555557eeda0) at p/debug_gdb.c:27
#14 0x00007ffff4fc89c3 in r_debug_gdb_reg_profile (dbg=0x5555557eeda0) at p/debug_gdb.c:406
#15 0x00007ffff4fbf6ee in r_debug_use (dbg=0x5555557eeda0, str=0x555555815320 "gdb") at plugin.c:34
#16 0x00007ffff5316a28 in r_core_file_open (r=0x7ffff7f5a010, file=0x5555558e46e0 "gdb://127.0.0.1:1337", flags=5, loadaddr=0) at cfile.c:945
#17 0x00007ffff768d876 in r_main_radare2 (argc=6, argv=0x7fffffffded8) at radare2.c:898
#18 0x0000555555554c77 in main (argc=6, argv=0x7fffffffded8) at radare2.c:96```
@radare
Copy link
Collaborator

radare commented Apr 22, 2020 via email

@officialcjunior
Copy link
Contributor Author

Sorry, I've updated now, to:

radare2 4.5.0-git 24501 @ linux-x86-64 git.4.4.0-64-gd3ecd271c
commit: d3ecd271cf81cc21a8a43ff9b59474023def5ead build: 2020-04-22__20:06:08

Still, I'm facing:

#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#1  0x00007ffff72bf801 in __GI_abort () at abort.c:79
#2  0x00007ffff7308897 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7ffff7435b9a "%s\n")
    at ../sysdeps/posix/libc_fatal.c:181
#3  0x00007ffff730f90a in malloc_printerr (str=str@entry=0x7ffff7433d88 "free(): invalid pointer") at malloc.c:5350
#4  0x00007ffff7316e1c in _int_free (have_lock=0, p=0x55555585f4f0, av=0x7ffff766ac40 <main_arena>) at malloc.c:4157
#5  __GI___libc_free (mem=0x55555585f500) at malloc.c:3124
#6  0x00007ffff78f75ef in r_list_delete (list=0x555555836a40, iter=0x55555585f500) at list.c:109
#7  0x00007ffff78f7442 in r_list_purge (list=0x555555836a40) at list.c:72
#8  0x00007ffff78f7498 in r_list_free (list=0x555555836a40) at list.c:82
#9  0x00007ffff666f617 in arch_parse_reg_profile (
    reg_profile=0x555555846020 "=PC\trip\n=SP\trsp\n=BP\trbp\n=A0\trax\n=A1\trbx\n=A2\trcx\n=A3\trdx\n=SN\torax\ngpr\tfake\t.64\t795\t0\ngpr\trax\t.64\t0\t0\ngpr\trbx\t.64\t8\t0\ngpr\trcx\t.64\t16\t0\ngpr\trdx\t.64\t24\t0\ngpr\trsi\t.64\t32\t0\ngpr\trdi\t.64\t40\t0\ngpr\trbp\t.64\t48\t0"...) at src/arch.c:135
#10 0x00007ffff666e1ac in gdbr_set_reg_profile (g=0x5555558487e0, 
    str=0x555555846020 "=PC\trip\n=SP\trsp\n=BP\trbp\n=A0\trax\n=A1\trbx\n=A2\trcx\n=A3\trdx\n=SN\torax\ngpr\tfake\t.64\t795\t0\ngpr\trax\t.64\t0\t0\ngpr\trbx\t.64\t8\t0\ngpr\trcx\t.64\t16\t0\ngpr\trdx\t.64\t24\t0\ngpr\trsi\t.64\t32\t0\ngpr\trdi\t.64\t40\t0\ngpr\trbp\t.64\t48\t0"...)
    at src/libgdbr.c:119
---Type <return> to continue, or q <return> to quit---
#11 0x00007ffff666dfda in gdbr_set_architecture (g=0x5555558487e0, arch=1, bits=64) at src/libgdbr.c:64
#12 0x00007ffff4f60909 in r_debug_gdb_attach (dbg=0x5555557eedb0, pid=-1) at p/debug_gdb.c:383
#13 0x00007ffff4f5f801 in check_connection (dbg=0x5555557eedb0) at p/debug_gdb.c:27
#14 0x00007ffff4f609c3 in r_debug_gdb_reg_profile (dbg=0x5555557eedb0) at p/debug_gdb.c:406
#15 0x00007ffff4f576ee in r_debug_use (dbg=0x5555557eedb0, str=0x555555815bc0 "gdb") at plugin.c:34
#16 0x00007ffff52c1173 in r_core_file_open (r=0x7ffff7f5a010, file=0x5555558e54f0 "gdb://127.0.0.1:1337", flags=5, loadaddr=0) at cfile.c:945
#17 0x00007ffff768c81c in r_main_radare2 (argc=8, argv=0x7fffffffdeb8) at radare2.c:898
#18 0x0000555555554c77 in main (argc=8, argv=0x7fffffffdeb8) at radare2.c:96

# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees
No one assigned
Labels
gdb Remote GDB protocol support MIPS MIPS architecture support issues
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@XVilka @radare @officialcjunior