Add: dbg.libs/unlibs for linux #6567

leberus · 2017-01-24T11:43:20Z

This commits adds internal breakpoints for dlopen, dlmopen and dlclose.
A proper return reason has been added in linux_dbg_wait , so when typing di we can see the reason.

Some things still have to be fixed:

it prints twice the command stored in bp->data.
First it prints the first part of the string (before ";"), and when it does a rcons_flush it prints everything (this issue was already here but i'll take a look).
To know which library was unloaded more work should be done. We should keep a list of libraries like:

struct library {
ut64 handler;
char *name;
};

The handler field would be the value returned from dlopen/dlmopen (value in rax). Once r2 detects a dbg.unlibs, it should compare all handlers we got so far with the one we're gonna close with dlclose (value passed in rdi).

And then we could keep this list in a lib field within RDebug structure.
So every time we unload a library, we can also print its name.

oscar@oscar:~/lab/r2/3462$ r2 -d loadlib
[0x7f4662fe3190]> db
0x00400590 - 0x00400591 1 --x sw break enabled cmd="?e dbg.libs: sym.imp.dlopen;ps@r:rdi" cond="" name="" module=""
0x004005c0 - 0x004005c1 1 --x sw break enabled cmd="?e dbg.libs: sym.imp.dlmopen;ps@r:rsi" cond="" name="" module=""
0x004005a0 - 0x004005a1 1 --x sw break enabled cmd="?e dbg.unlibs: sym.imp.dlclose" cond="" name="" module=""
[0x7f4662fe3190]> dc
Selecting and continuing: 9125
hit breakpoint at: 400590
dbg.libs: sym.imp.dlopen

dbg.libs: sym.imp.dlopen
libgvc.so.6.0.0
[0x00400590]> dc
Selecting and continuing: 9125
hit breakpoint at: 4005a0
dbg.unlibs: sym.imp.dlclose
dbg.unlibs: sym.imp.dlclose
[0x00400590]> di
type=exit-lib
signal=SIGTRAP
signum=5
sigpid=9125
addr=0x0
bp_addr=0x4005a0
......
[0x00400590]> dc
Selecting and continuing: 9125
hit breakpoint at: 4005c0
dbg.libs: sym.imp.dlmopen

dbg.libs: sym.imp.dlmopen
libgvc.so.6.0.0
[0x00400590]> di
type=new-lib
signal=SIGTRAP
signum=5
sigpid=9125
addr=0x0
bp_addr=0x4005c0
....
[0x00400590]>

radare · 2017-01-24T13:28:01Z

libr/core/file.c

@@ -312,7 +312,13 @@ static bool setbpint(RCore *r, const char *mode, const char *sym) {
 	if (bp) {
 		bp->internal = true;
 #if __linux__
-		bp->data = r_str_newf ("?e %s: %s;dd", mode, sym);
+		if (strncmp (sym, "sym.imp.dlclose", strlen ("sym.imp.dlclose"))) {


use r_str_startswith

radare · 2017-01-24T13:28:51Z

libr/core/file.c

+		if (strncmp (sym, "sym.imp.dlclose", strlen ("sym.imp.dlclose"))) {
+			bp->data = r_str_newf ("?e %s: %s;ps@r:%s", mode, sym, 
+				!strncmp (sym, "sym.imp.dlmopen", strlen ("sym.imp.dlmopen"))
+				? "rsi" : "rdi");


this is not portable. r2 have a way to determine the value of the register depending on the purpose, rsi/rdi is only for x86-64, and core/file.c is not the place to put arch-specific things

could you tell me more about this way? is a function?

radare · 2017-01-24T13:29:08Z

libr/debug/p/native/linux/linux_debug.c

-				dbg->reason.type = R_DEBUG_REASON_BREAKPOINT;
-				dbg->reason.bp_addr = (ut64)siginfo.si_addr;
+			{
+#if 1


remove the if 1

radare · 2017-01-24T13:29:27Z

libr/debug/p/native/linux/linux_debug.c

+							char no_str[128];
+							char mode[128] = {0};
+
+							sscanf (b->data, "%s %s %s", no_str, mode, no_str);


this can overflow

radare · 2017-01-24T13:29:38Z

libr/debug/p/native/linux/linux_debug.c

+							char mode[128] = {0};
+
+							sscanf (b->data, "%s %s %s", no_str, mode, no_str);
+							if (!strncmp (mode, "dbg.libs", strlen ("dbg.libs"))) {


use r_str_startswith

radare · 2017-01-24T13:29:46Z

libr/debug/p/native/linux/linux_debug.c

+							sscanf (b->data, "%s %s %s", no_str, mode, no_str);
+							if (!strncmp (mode, "dbg.libs", strlen ("dbg.libs"))) {
+								dbg->reason.type = R_DEBUG_REASON_NEW_LIB;
+							} else if (!strncmp (mode, "dbg.unlibs", strlen ("dbg.unlibs"))) {


radare · 2017-01-24T13:30:04Z

libr/debug/p/native/linux/linux_debug.c

+					}
+				}
+#endif
+


radare · 2017-01-24T13:52:39Z

rdi is the first argument, you can grab this name if you use the r_reg R_API const char *r_reg_get_name(RReg *reg, int role) { where role is R_REG_NAME_A0 this will return rdi for x86-64, but do the correct thing for x86-32, arm, ppc, ...

…

On 24 Jan 2017, at 14:48, leberus ***@***.***> wrote: @leberus commented on this pull request. In libr/core/file.c <#6567>: > @@ -312,7 +312,13 @@ static bool setbpint(RCore *r, const char *mode, const char *sym) { if (bp) { bp->internal = true; #if __linux__ - bp->data = r_str_newf ("?e %s: %s;dd", mode, sym); + if (strncmp (sym, "sym.imp.dlclose", strlen ("sym.imp.dlclose"))) { + bp->data = r_str_newf ("?e %s: ***@***.***:%s", mode, sym, + !strncmp (sym, "sym.imp.dlmopen", strlen ("sym.imp.dlmopen")) + ? "rsi" : "rdi"); could you tell me more about this way? is a function? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#6567>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AA3-lptdUBWhBAB-1FhuMWdE2-E2J0Wvks5rVgFAgaJpZM4LsKac>.

leberus · 2017-01-24T14:04:26Z

well i guess i'll just put bp->data = r_str_newf ("?e %s: %s", mode, sym); on core/file.c , and i'll do all library investigation "stuff" on linux_debug.c

leberus · 2017-01-24T14:16:08Z

I've fixed all other issues. I'll do the reg's stuff now.

radare · 2017-01-24T15:22:15Z

if you rebase, travis should be green again :3

leberus · 2017-01-24T15:47:29Z

I've rebased, but I'm still testing this on i386/arm/arm64

radare · 2017-01-24T15:48:34Z

travis doesnt tests the debugger, so that may not affect at all

radare · 2017-01-24T17:53:58Z

libr/debug/p/native/linux/linux_debug.c

+										//dlmopen passes library's name in esi
+										name = r_reg_get_name (dbg->reg, R_REG_NAME_A1);
+									}
+									snprintf (str, sizeof (str), ";ps@r:%s", name);


why not use r_str_concatf ?

radare · 2017-01-24T17:54:39Z

libr/debug/p/native/linux/linux_debug.c

+				if (dbg->glob_libs || dbg->glob_unlibs) {
+					ut64 pc_addr = r_debug_reg_get (dbg, "PC");
+					RBreakpointItem *b = r_bp_get_at (dbg->bp, pc_addr - dbg->bpsize);
+					if (b) {


use if (b && b->internal) and reduce 1 level of indentation

leberus · 2017-01-24T19:05:50Z

I've fixed the comments.
Library detection is a bit tricky in i386 if the arguments are pushed into the stack and not passed to registers instead.
I'll try to figure out how can I get those arguments.

radare · 2017-01-24T19:23:08Z

Awesome! :D didnt expected to have all this stuff ready before the release! now let's focus on testing and finish the pending issues before release. to be sure we are not breaking anything

Thanks!

leberus · 2017-01-24T22:09:15Z

Yap! Actually I'm planning to start writing some tests for the debugger, so we realize faster if something gets fucked up by our changes :)

leberus force-pushed the 3462 branch from 8f37db2 to e8c86bc Compare January 24, 2017 12:29

radare reviewed Jan 24, 2017

View reviewed changes

libr/debug/p/native/linux/linux_debug.c

}

}

#endif

Copy link

Collaborator

radare Jan 24, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

empty line

leberus force-pushed the 3462 branch 2 times, most recently from a064ab6 to a7680fa Compare January 24, 2017 14:11

leberus force-pushed the 3462 branch from a7680fa to 0fed854 Compare January 24, 2017 15:43

radare reviewed Jan 24, 2017

View reviewed changes

Add: dbg.libs/unlibs for linux

f869c73

leberus force-pushed the 3462 branch from 0fed854 to f869c73 Compare January 24, 2017 19:04

radare merged commit 82f282c into radareorg:master Jan 24, 2017

radare mentioned this pull request Jan 31, 2017

Update the siol-branch #6627

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add: dbg.libs/unlibs for linux #6567

Add: dbg.libs/unlibs for linux #6567

leberus commented Jan 24, 2017 •

edited

Loading

radare Jan 24, 2017

radare Jan 24, 2017

leberus Jan 24, 2017

radare Jan 24, 2017

radare Jan 24, 2017

radare Jan 24, 2017

radare Jan 24, 2017

radare Jan 24, 2017

radare commented Jan 24, 2017 via email

leberus commented Jan 24, 2017 •

edited

Loading

leberus commented Jan 24, 2017

radare commented Jan 24, 2017

leberus commented Jan 24, 2017

radare commented Jan 24, 2017

radare Jan 24, 2017

radare Jan 24, 2017

leberus commented Jan 24, 2017

radare commented Jan 24, 2017

leberus commented Jan 24, 2017

Add: dbg.libs/unlibs for linux #6567

Add: dbg.libs/unlibs for linux #6567

Conversation

leberus commented Jan 24, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

radare commented Jan 24, 2017 via email

leberus commented Jan 24, 2017 • edited Loading

leberus commented Jan 24, 2017

radare commented Jan 24, 2017

leberus commented Jan 24, 2017

radare commented Jan 24, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

leberus commented Jan 24, 2017

radare commented Jan 24, 2017

leberus commented Jan 24, 2017

leberus commented Jan 24, 2017 •

edited

Loading

leberus commented Jan 24, 2017 •

edited

Loading