Make debugging work a bit better on OpenBSD: nudge get_base_from_maps… #6455

nevun · 2017-01-07T22:28:22Z

…() so it does not return 0 on OpenBSD just because the memory mapping does not contain the file name.

Copied the fallback code from cmd_debug.c:r_debug_get_baddr().

getBaddrFromDebugger() from radare2.c also does the right thing. r_debug_get_baddr() probably should be exposed through the api so everyone can use one, maybe correct, version.

Before patch:

$ r2 -version
radare2 1.2.0-git 13429 @ openbsd-x86-64 git.1.1.0-142-g7595aad0a
commit: 7595aad0a4608abf26bd5a6032eb01b9f3007735 build: 2017-01-07
$ r2 -d ~/tmp/a.out
Process with PID 87025 started...
= attach 87025 87025
bin.baddr 0x8cd55000000
USING 8cd55000000
Assuming filepath /home/gk/tmp/a.out
asm.bits 64
 -- Documentation is for weak people.
[0x8cfb4a002b0]> aa
[Cannot find function 'entry0' at 0x000003c0 entry0 (aa)
[x] Analyze all flags starting with sym. and entry0 (aa)
[0x8cfb4a002b0]> f~main
0x0000058f 256 main
0x0000058f 44 sym.main
[0x8cfb4a002b0]> s main 
[0x0000058f]> pdf
p: Cannot find function at 0x0000058f
[0x0000058f]>

After patch:

$ r2 -d ~/tmp/a.out
Process with PID 4403 started...
= attach 4403 4403
bin.baddr 0x110b46f00000
USING 110b46f00000
Assuming filepath /home/gk/tmp/a.out
asm.bits 64
 -- -bash: r2: command not found
[0x110dc89002b0]> aa
[x] Analyze all flags starting with sym. and entry0 (aa)
[0x110dc89002b0]> f~main
0x110b46f0058f 256 main
0x110b46f0058f 44 sym.main
[0x110dc89002b0]> s main
[0x110b46f0058f]> pdf
            ;-- main:
/ (fcn) sym.main 44
|   sym.main ();
|              ; CALL XREF from 0x110b46f0041d (entry0)
|           0x110b46f0058f      55             push rbp
|           0x110b46f00590      4889e5         mov rbp, rsp
|           0x110b46f00593      4883ec10       sub rsp, 0x10
|           0x110b46f00597      b800000000     mov eax, 0
|           0x110b46f0059c      e8e3ffffff     call sym.lol
|           0x110b46f005a1      89c6           mov esi, eax
|           0x110b46f005a3      488d3d560410.  lea rdi, 0x110b47000a00 ; 0x110b47000a00 ; section..rodata ; "%d$
|           0x110b46f005aa      b800000000     mov eax, 0
|           0x110b46f005af      e8bcfdffff     call sym.imp.printf    ; sym.imp._csu_finish-0x20
|           0x110b46f005b4      b800000000     mov eax, 0
|           0x110b46f005b9      c9             leave
\           0x110b46f005ba      c3             ret
[0x110b46f0058f]>

…() so it does not return 0 on OpenBSD just because the memory mapping does not contain the file name. Copied the fallback code from cmd_debug.c:r_debug_get_baddr(). getBaddrFromDebugger() from radare2.c also does the right thing. r_debug_get_baddr() probably should be exposed through the api so everyone can use one, maybe correct, version.

radare · 2017-01-08T00:52:28Z

This is the same as uncommenting the line in the previous loop that contains the XXX comment. So this is maybe introducing a regression for other backends. Uncommenting the line is better than iterating the loop. Can we find which case may fail here?

…

On 7 Jan 2017, at 23:28, nevun ***@***.***> wrote: …() so it does not return 0 on OpenBSD just because the memory mapping does not contain the file name. Copied the fallback code from cmd_debug.c:r_debug_get_baddr(). getBaddrFromDebugger() from radare2.c also does the right thing. r_debug_get_baddr() probably should be exposed through the api so everyone can use one, maybe correct, version. Before patch: $ r2 -version radare2 1.2.0-git 13429 @ openbsd-x86-64 git.1.1.0-142-g7595aad0a commit: 7595aad build: 2017-01-07 $ r2 -d /tmp/a.out Process with PID 87025 started... = attach 87025 87025 bin.baddr 0x8cd55000000 USING 8cd55000000 Assuming filepath /home/gk/tmp/a.out asm.bits 64 -- Documentation is for weak people. [0x8cfb4a002b0]> aa [Cannot find function 'entry0' at 0x000003c0 entry0 (aa) [x] Analyze all flags starting with sym. and entry0 (aa) [0x8cfb4a002b0]> fmain 0x0000058f 256 main 0x0000058f 44 sym.main [0x8cfb4a002b0]> p: Cannot find function at 0x8cfb4a002b0 [0x8cfb4a002b0]> After patch: $ r2 -d /tmp/a.out Process with PID 4403 started... = attach 4403 4403 bin.baddr 0x110b46f00000 USING 110b46f00000 Assuming filepath /home/gk/tmp/a.out asm.bits 64 -- -bash: r2: command not found [0x110dc89002b0]> aa [x] Analyze all flags starting with sym. and entry0 (aa) [0x110dc89002b0]> fmain 0x110b46f0058f 256 main 0x110b46f0058f 44 sym.main [0x110dc89002b0]> s main [0x110b46f0058f]> pdf ;-- main: / (fcn) sym.main 44 | sym.main (); | ; CALL XREF from 0x110b46f0041d (entry0) | 0x110b46f0058f 55 push rbp | 0x110b46f00590 4889e5 mov rbp, rsp | 0x110b46f00593 4883ec10 sub rsp, 0x10 | 0x110b46f00597 b800000000 mov eax, 0 | 0x110b46f0059c e8e3ffffff call sym.lol | 0x110b46f005a1 89c6 mov esi, eax | 0x110b46f005a3 488d3d560410. lea rdi, 0x110b47000a00 ; 0x110b47000a00 ; section..rodata ; "%d$ | 0x110b46f005aa b800000000 mov eax, 0 | 0x110b46f005af e8bcfdffff call sym.imp.printf ; sym.imp._csu_finish-0x20 | 0x110b46f005b4 b800000000 mov eax, 0 | 0x110b46f005b9 c9 leave \ 0x110b46f005ba c3 ret [0x110b46f0058f]> You can view, comment on, or merge this pull request online at: #6455 Commit Summary Make debugging work a bit better on OpenBSD: nudge get_base_from_maps() so it does not return 0 on OpenBSD just because the memory mapping does not contain the file name. File Changes M libr/core/file.c (7) Patch Links: https://github.com/radare/radare2/pull/6455.patch https://github.com/radare/radare2/pull/6455.diff — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

nevun · 2017-01-08T11:03:20Z

I know it is not pretty but do not shoot the messenger :)

Both other places in the code getting the base address does it like my patch.

cmd_debug.c:r_debug_get_baddr() does it this way:

        r_list_foreach (r->dbg->maps, iter, map) {
                if (!strcmp (abspath, map->name)) {
                        free (abspath);
                        return map->addr;
                }
        }
        free (abspath);
        // fallback resolution (osx/w32?)
        // we asume maps to be loaded in order, so lower addresses come first
        r_list_foreach (r->dbg->maps, iter, map) {
                if (map->perm == 5) { // r-x
                        return map->addr;
                }
        }
        return 0LL;

and binr/radare2/radare2.c:getBaddrFromDebugger() ALSO does it this way:

        r_list_foreach (r->dbg->maps, iter, map) {
                if (!strcmp (abspath, map->name)) {
                        free (abspath);
                        return map->addr;
                }
        }
        free (abspath);
        // fallback resolution (osx/w32?)
        // we asume maps to be loaded in order, so lower addresses come first
        r_list_foreach (r->dbg->maps, iter, map) {
                if (map->perm == 5) { // r-x
                        return map->addr;
                }
        }
        return 0LL;

..also get_base_from_maps() it is only called if !windows and !linux so it will not break anything which is not already broken. Actually maybe the fix is remove the call to get_base_from_maps() completely in core/file.c ?

nevun · 2017-01-09T10:34:23Z

I tested it on macOS and FreeBSD now, it does not break macOS and it fixes FreeBSD in the same way that it fixes OpenBSD.

radare · 2017-01-09T12:46:53Z

what im saying is that your patch iterates twice the maps, when the same behaviour can be implemented by just uncommenting the line after the XXX in the loop.

i think the problem was happening when the bin is not the first one listed in maps.. iirc it was happening in some linux distros.. didnt tested yet

nevun · 2017-01-09T13:27:27Z

radare <notifications@github.com> writes:

what im saying is that your patch iterates twice the maps, when the same behaviour can be implemented by just uncommenting the line after the XXX in the loop.

Uncommenting would not work. If would just assign the map to "b" and continue spinnig the for-loop, we would always get the last memory mapping (r-x) instead of the first. See below $ r2 -d ~/tmp/a.out Process with PID 63565 started... = attach 63565 63565 bin.baddr 0x8ca10600000 <--- radare2.c:getBaddrFromDebugger() is correct. USING 8ca10600000 Assuming filepath /home/gk/tmp/a.out asm.bits 64 -- Sharing your latest session in Facebook ... [0x8cccfd002b0]> dm sys 0000 0x0000000000001000 - 0x0000000000001000 s ---- ? sys 004K 0x000008ca10600000 - 0x000008ca10601000 s -r-x ? ; section.ehdr ^^^^ this is the one we want sys 004K 0x000008ca10700000 - 0x000008ca10701000 s ---x ? sys 004K 0x000008ca10800000 - 0x000008ca10801000 s --wx ? sys 004K 0x000008ca10801000 - 0x000008ca10802000 s --wx ? ; loc.__data_start sys 0000 0x000008cc10800000 - 0x000008cc10800000 s ---- ? sys 004K 0x000008cc30b66000 - 0x000008cc30b67000 s -r-x ? sys 044K 0x000008cccfd00000 * 0x000008cccfd0b000 s -r-x ? ; map.._r_x ^^^^ not this one sys 012K 0x000008cccfe0a000 - 0x000008cccfe0d000 s ---x ? ; map..___x sys 004K 0x000008cccff0c000 - 0x000008cccff0d000 s --wx ? sys 004K 0x000008cccff0d000 - 0x000008cccff0e000 s --wx ? sys 028K 0x000008cccff0e000 - 0x000008cccff15000 s --wx ? sys 028M 0x00007f7ffdff0000 - 0x00007f7fffbf0000 s ---- ? sys 3.9M 0x00007f7fffbf0000 - 0x00007f7ffffe0000 s --wx ? sys 060K 0x00007f7ffffe0000 - 0x00007f7ffffef000 s --wx ? ; map..__wx sys 004K 0x00007f7ffffef000 - 0x00007f7fffff0000 s ---- ? ; map..____ [0x8cccfd002b0]>

i think the problem was happening when the bin is not the first one listed in maps.. iirc it was happening in some linux distros.. didnt tested yet

Yeah, itering over the maps and just picking one with the correct perms feels wrong.. /gabriel

radare · 2017-01-09T23:56:10Z

i was about to use if (!b) b = map->addr; instead of this loop. but meh

radare · 2017-01-09T23:56:19Z

thanks!

radare merged commit d26a4cf into radareorg:master Jan 9, 2017

radare mentioned this pull request Jan 31, 2017

Update the siol-branch #6627

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Make debugging work a bit better on OpenBSD: nudge get_base_from_maps… #6455

Make debugging work a bit better on OpenBSD: nudge get_base_from_maps… #6455

nevun commented Jan 7, 2017 •

edited

Loading

radare commented Jan 8, 2017 via email

nevun commented Jan 8, 2017

nevun commented Jan 9, 2017

radare commented Jan 9, 2017

nevun commented Jan 9, 2017 via email

radare commented Jan 9, 2017

radare commented Jan 9, 2017

Make debugging work a bit better on OpenBSD: nudge get_base_from_maps… #6455

Make debugging work a bit better on OpenBSD: nudge get_base_from_maps… #6455

Conversation

nevun commented Jan 7, 2017 • edited Loading

radare commented Jan 8, 2017 via email

nevun commented Jan 8, 2017

nevun commented Jan 9, 2017

radare commented Jan 9, 2017

nevun commented Jan 9, 2017 via email

radare commented Jan 9, 2017

radare commented Jan 9, 2017

nevun commented Jan 7, 2017 •

edited

Loading