Advertisement
Yunga

Mammon's GDB Init

Mar 27th, 2014
208
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
GDB 21.79 KB | None | 0 0
  1. # http://mammon.github.io/
  2. # See also: https://github.com/cyrus-and/gdb-dashboard
  3. #
  4. # INSTRUCTIONS: save as ~/.gdbinit
  5. # DESCRIPTION: A cracker-friendly gdb configuration file.
  6. # REVISION : 6.1
  7. # CONTRIBUTORS: mammon_, elaine, pusillus, mong
  8. # FEEDBACK: http://board.anticrack.de/viewforum.php?f=35
  9. # NOTES: 'help user' in gdb will list the commands/descriptions in this file
  10. #        'context on' now enables auto-display of context screen
  11. # CHANGELOG:
  12. #   Version 6.1
  13. #        fixed filename in step_to_call so it points to /dev/null
  14. #        changed location of logfiles from /tmp  to ~
  15. #   Version 6
  16. #    added print_insn_type, get_insn_type, context-on, context-off commands
  17. #    added trace_calls, trace_run, step_to_call commands
  18. #    changed hook-stop so it checks $SHOW_CONTEXT variable
  19. #   Version 5
  20. #    added bpm, dump_bin, dump_hex, bp_alloc commands
  21. #        added 'assemble' by elaine, 'gas_asm' by mong
  22. #    added Tip Topics for aspiring crackers ;)
  23. #   Version 4
  24. #    added eflags-changing insns by pusillus
  25. #    added bp, nop, null, and int3 patch commands, also hook-stop
  26. #   Version 3
  27. #    incorporated elaine's if/else goodness into the hex/ascii dump
  28. #   Version 2
  29. #    radix bugfix by elaine
  30. # TODO:
  31. #   * add global vars to allow user to control stack,data,code win sizes
  32. #   * add dump, append, set write, etc commands
  33. #   * more tips!
  34.  
  35.  
  36. # ______________breakpoint aliases_____________
  37. define bpl
  38.  info breakpoints
  39. end
  40. document bpl
  41. List breakpoints
  42. end
  43.  
  44. define bp
  45.  set $SHOW_CONTEXT = 1
  46.  break * $arg0
  47. end
  48. document bp
  49. Set a breakpoint on address
  50. Usage: bp addr
  51. end
  52.  
  53. define bpc
  54.  clear $arg0
  55. end
  56. document bpc
  57. Clear breakpoint at function/address
  58. Usage: bpc addr
  59. end
  60.  
  61. define bpe
  62.  enable $arg0
  63. end
  64. document bpe
  65. Enable breakpoint #
  66. Usage: bpe num
  67. end
  68.  
  69. define bpd
  70.  disable $arg0
  71. end
  72. document bpd
  73. Disable breakpoint #
  74. Usage: bpd num
  75. end
  76.  
  77. define bpt
  78.  set $SHOW_CONTEXT = 1
  79.  tbreak $arg0
  80. end
  81. document bpt
  82. Set a temporary breakpoint on address
  83. Usage: bpt addr
  84. end
  85.  
  86. define bpm
  87.  set $SHOW_CONTEXT = 1
  88.  awatch $arg0
  89. end
  90. document bpm
  91. Set a read/write breakpoint on address
  92. Usage: bpm addr
  93. end
  94.  
  95. # ______________process information____________
  96. define argv
  97.  show args
  98. end
  99. document argv
  100. Print program arguments
  101. end
  102.  
  103. define stack
  104.  info stack
  105. end
  106. document stack
  107. Print call stack
  108. end
  109.  
  110. define frame
  111.  info frame
  112.  info args
  113.  info locals
  114. end
  115. document frame
  116. Print stack frame
  117. end
  118.  
  119. define flags
  120.  if (($eflags >> 0xB) & 1 )
  121.   printf "O "
  122.  else
  123.   printf "o "
  124.  end
  125.  if (($eflags >> 0xA) & 1 )
  126.   printf "D "
  127.  else
  128.   printf "d "
  129.  end
  130.  if (($eflags >> 9) & 1 )
  131.   printf "I "
  132.  else
  133.   printf "i "
  134.  end
  135.  if (($eflags >> 8) & 1 )
  136.   printf "T "
  137.  else
  138.   printf "t "
  139.  end
  140.  if (($eflags >> 7) & 1 )
  141.   printf "S "
  142.  else
  143.   printf "s "
  144.  end
  145.  if (($eflags >> 6) & 1 )
  146.   printf "Z "
  147.  else
  148.   printf "z "
  149.  end
  150.  if (($eflags >> 4) & 1 )
  151.   printf "A "
  152.  else
  153.   printf "a "
  154.  end
  155.  if (($eflags >> 2) & 1 )
  156.   printf "P "
  157.  else
  158.   printf "p "
  159.  end
  160.  if ($eflags & 1)
  161.   printf "C "
  162.  else
  163.   printf "c "
  164.  end
  165.  printf "\n"
  166. end
  167. document flags
  168. Print flags register
  169. end
  170.  
  171. define eflags
  172.  printf "     OF <%d>  DF <%d>  IF <%d>  TF <%d>",\
  173.        (($eflags >> 0xB) & 1 ), (($eflags >> 0xA) & 1 ), \
  174.        (($eflags >> 9) & 1 ), (($eflags >> 8) & 1 )
  175.  printf "  SF <%d>  ZF <%d>  AF <%d>  PF <%d>  CF <%d>\n",\
  176.        (($eflags >> 7) & 1 ), (($eflags >> 6) & 1 ),\
  177.        (($eflags >> 4) & 1 ), (($eflags >> 2) & 1 ), ($eflags & 1)
  178.  printf "     ID <%d>  VIP <%d> VIF <%d> AC <%d>",\
  179.        (($eflags >> 0x15) & 1 ), (($eflags >> 0x14) & 1 ), \
  180.        (($eflags >> 0x13) & 1 ), (($eflags >> 0x12) & 1 )
  181.  printf "  VM <%d>  RF <%d>  NT <%d>  IOPL <%d>\n",\
  182.        (($eflags >> 0x11) & 1 ), (($eflags >> 0x10) & 1 ),\
  183.        (($eflags >> 0xE) & 1 ), (($eflags >> 0xC) & 3 )
  184. end
  185. document eflags
  186. Print entire eflags register
  187. end
  188.  
  189. define reg
  190.  printf "     eax:%08X ebx:%08X  ecx:%08X ",  $eax, $ebx, $ecx
  191.  printf " edx:%08X     eflags:%08X\n",  $edx, $eflags
  192.  printf "     esi:%08X edi:%08X  esp:%08X ",  $esi, $edi, $esp
  193.  printf " ebp:%08X     eip:%08X\n", $ebp, $eip
  194.  printf "     cs:%04X  ds:%04X  es:%04X", $cs, $ds, $es
  195.  printf "  fs:%04X  gs:%04X  ss:%04X    ", $fs, $gs, $ss
  196.  flags
  197. end
  198. document reg
  199. Print CPU registers
  200. end
  201.  
  202. define func
  203.  info functions
  204. end
  205. document func
  206. Print functions in target
  207. end
  208.  
  209. define var
  210.  info variables
  211. end
  212. document var
  213. Print variables (symbols) in target
  214. end
  215.  
  216. define lib
  217.  info sharedlibrary
  218. end
  219. document lib
  220. Print shared libraries linked to target
  221. end
  222.  
  223. define sig
  224.  info signals
  225. end
  226. document sig
  227. Print signal actions for target
  228. end
  229.  
  230. define thread
  231.  info threads
  232. end
  233. document thread
  234. Print threads in target
  235. end
  236.  
  237. define u
  238.  info udot
  239. end
  240. document u
  241. Print kernel 'user' struct for target
  242. end
  243.  
  244. define dis
  245.  disassemble $arg0
  246. end
  247. document dis
  248. Disassemble address
  249. Usage: dis addr
  250. end
  251.  
  252. # ________________hex/ascii dump an address______________
  253. define ascii_char
  254.  # thanks elaine :)
  255.  set $_c=*(unsigned char *)($arg0)
  256.  if ( $_c < 0x20 || $_c > 0x7E )
  257.   printf "."
  258.  else
  259.   printf "%c", $_c
  260.  end
  261. end
  262. document ascii_char
  263. Print the ASCII value of arg0 or '.' if value is unprintable
  264. end
  265.  
  266. define hex_quad
  267.  printf "%02X %02X %02X %02X  %02X %02X %02X %02X",                          \
  268.         *(unsigned char*)($arg0), *(unsigned char*)($arg0 + 1),      \
  269.         *(unsigned char*)($arg0 + 2), *(unsigned char*)($arg0 + 3),  \
  270.         *(unsigned char*)($arg0 + 4), *(unsigned char*)($arg0 + 5),  \
  271.         *(unsigned char*)($arg0 + 6), *(unsigned char*)($arg0 + 7)
  272. end
  273. document hex_quad
  274. Print eight hexadecimal bytes starting at arg0
  275. end
  276.  
  277. define hexdump
  278.  printf "%08X : ", $arg0
  279.  hex_quad $arg0
  280.  printf " - "
  281.  hex_quad ($arg0+8)
  282.  printf " "
  283.  
  284.  ascii_char ($arg0)
  285.  ascii_char ($arg0+1)
  286.  ascii_char ($arg0+2)
  287.  ascii_char ($arg0+3)
  288.  ascii_char ($arg0+4)
  289.  ascii_char ($arg0+5)
  290.  ascii_char ($arg0+6)
  291.  ascii_char ($arg0+7)
  292.  ascii_char ($arg0+8)
  293.  ascii_char ($arg0+9)
  294.  ascii_char ($arg0+0xA)
  295.  ascii_char ($arg0+0xB)
  296.  ascii_char ($arg0+0xC)
  297.  ascii_char ($arg0+0xD)
  298.  ascii_char ($arg0+0xE)
  299.  ascii_char ($arg0+0xF)
  300.  
  301.  printf "\n"
  302. end
  303. document hexdump
  304. Display a 16-byte hex/ASCII dump of arg0
  305. end
  306.  
  307. # ________________data window__________________
  308. define ddump
  309.  printf "[%04X:%08X]------------------------", $ds, $data_addr
  310.  printf "---------------------------------[ data]\n"
  311.  set $_count=0
  312.  while ( $_count < $arg0 )
  313.   set $_i=($_count*0x10)
  314.   hexdump ($data_addr+$_i)
  315.   set $_count++
  316.  end
  317. end
  318. document ddump
  319. Display $arg0 lines of hexdump for address $data_addr
  320. end
  321.  
  322. define dd
  323.  if ( ($arg0 & 0x40000000) || ($arg0 & 0x08000000) || ($arg0 & 0xBF000000) )
  324.   set $data_addr=$arg0
  325.   ddump 0x10
  326.  else
  327.   printf "Invalid address: %08X\n", $arg0
  328.  end
  329. end
  330. document dd
  331. Display 16 lines of a hex dump for $arg0
  332. end
  333.  
  334. define datawin
  335.  if ( ($esi & 0x40000000) || ($esi & 0x08000000) || ($esi & 0xBF000000) )
  336.   set $data_addr=$esi
  337.  else
  338.   if ( ($edi & 0x40000000) || ($edi & 0x08000000) || ($edi & 0xBF000000) )
  339.    set $data_addr=$edi
  340.   else
  341.    if ( ($eax & 0x40000000) || ($eax & 0x08000000) || \
  342.        ($eax & 0xBF000000) )
  343.  
  344.     set $data_addr=$eax
  345.    else
  346.     set $data_addr=$esp
  347.    end
  348.   end
  349.  end
  350.  ddump 2
  351. end
  352. document datawin
  353. Display esi, edi, eax, or esp in data window
  354. end
  355.  
  356. # ________________process context______________
  357. define context
  358.  printf "_______________________________________"
  359.  printf "________________________________________\n"
  360.  reg
  361.  printf "[%04X:%08X]------------------------", $ss, $esp
  362.  printf "---------------------------------[stack]\n"
  363.  hexdump $sp+0x30
  364.  hexdump $sp+0x20
  365.  hexdump $sp+0x10
  366.  hexdump $sp
  367.  datawin
  368.  printf "[%04X:%08X]------------------------", $cs, $eip
  369.  printf "---------------------------------[ code]\n"
  370.  x /6i $pc
  371.  printf "---------------------------------------"
  372.  printf "---------------------------------------\n"
  373. end
  374. document context
  375. Print regs, stack, ds:esi, and disassemble cs:eip
  376. end
  377.  
  378. define context-on
  379.  set $SHOW_CONTEXT = 1
  380. end
  381. document context-on
  382. Enable display of context on every program stop
  383. end
  384.  
  385. define context-off
  386.  set $SHOW_CONTEXT = 1
  387. end
  388. document context-on
  389. Disable display of context on every program stop
  390. end
  391.  
  392. # ________________process control______________
  393. define n
  394.  ni
  395. end
  396. document n
  397. Step one instruction
  398. end
  399.  
  400. define go
  401.  stepi $arg0
  402. end
  403. document go
  404. Step # instructions
  405. end
  406.  
  407. define pret
  408.  finish
  409. end
  410. document pret
  411. Step out of current call
  412. end
  413.  
  414. define init
  415.  set $SHOW_CONTEXT = 1
  416.  set $SHOW_NEST_INSN=0
  417.  tbreak _init
  418.  r
  419. end
  420. document init
  421. Run program; break on _init()
  422. end
  423.  
  424. define start
  425.  set $SHOW_CONTEXT = 1
  426.  set $SHOW_NEST_INSN=0
  427.  tbreak _start
  428.  r
  429. end
  430. document start
  431. Run program; break on _start()
  432. end
  433.  
  434. define sstart
  435.  set $SHOW_CONTEXT = 1
  436.  set $SHOW_NEST_INSN=0
  437.  tbreak __libc_start_main
  438.  r
  439. end
  440. document sstart
  441. Run program; break on __libc_start_main(). Useful for stripped executables.
  442. end
  443.  
  444. define main
  445.  set $SHOW_CONTEXT = 1
  446.  set $SHOW_NEST_INSN=0
  447.  tbreak main
  448.  r
  449. end
  450. document main
  451. Run program; break on main()
  452. end
  453.  
  454. # ________________eflags commands_______________
  455. define cfc
  456.  if ($eflags & 1)
  457.   set $eflags = $eflags&~1
  458.  else
  459.   set $eflags = $eflags|1
  460.  end
  461. end
  462. document cfc
  463. change Carry Flag
  464. end
  465.  
  466. define cfp
  467.  if (($eflags >> 2) & 1 )
  468.   set $eflags = $eflags&~0x4
  469.  else
  470.   set $eflags = $eflags|0x4
  471.  end
  472. end
  473. document cfp
  474. change Carry Flag
  475. end
  476.  
  477. define cfa
  478.  if (($eflags >> 4) & 1 )
  479.   set $eflags = $eflags&~0x10
  480.  else
  481.   set $eflags = $eflags|0x10
  482.  end
  483. end
  484. document cfa
  485. change Auxiliary Carry Flag
  486. end
  487.  
  488. define cfz
  489.  if (($eflags >> 6) & 1 )
  490.   set $eflags = $eflags&~0x40
  491.  else
  492.   set $eflags = $eflags|0x40
  493.  end
  494. end
  495. document cfz
  496. change Zero Flag
  497. end
  498.  
  499. define cfs
  500.  if (($eflags >> 7) & 1 )
  501.   set $eflags = $eflags&~0x80
  502.  else
  503.   set $eflags = $eflags|0x80
  504.  end
  505. end
  506. document cfs
  507. change Sign Flag
  508. end
  509.  
  510. define cft
  511.  if (($eflags >>8) & 1 )
  512.   set $eflags = $eflags&100
  513.  else
  514.   set $eflags = $eflags|100
  515.  end
  516. end
  517. document cft
  518. change Trap Flag
  519. end
  520.  
  521. define cfi
  522.  if (($eflags >> 9) & 1 )
  523.   set $eflags = $eflags&~0x200
  524.  else
  525.   set $eflags = $eflags|0x200
  526.  end
  527. end
  528. document cfi
  529. change Interrupt Flag
  530. end
  531.  
  532. define cfd
  533.  if (($eflags >>0xA ) & 1 )
  534.   set $eflags = $eflags&~0x400
  535.  else
  536.   set $eflags = $eflags|0x400
  537.  end
  538. end
  539. document cfd
  540. change Direction Flag
  541. end
  542.  
  543. define cfo
  544.  if (($eflags >> 0xB) & 1 )
  545.   set $eflags = $eflags&~0x800
  546.  else
  547.   set $eflags = $eflags|0x800
  548.  end
  549. end
  550. document cfo
  551. change Overflow Flag
  552. end
  553.  
  554. # --------------------patch---------------------
  555. define nop
  556.  set * (unsigned char *) $arg0 = 0x90
  557. end
  558. document nop
  559. Patch byte at address arg0 to a NOP insn
  560. Usage: nop addr
  561. end
  562.  
  563. define null
  564.  set * (unsigned char *) $arg0 = 0
  565. end
  566. document null
  567. Patch byte at address arg0 to  NULL
  568. Usage: null addr
  569. end
  570.  
  571. define int3
  572.  set * (unsigned char *) $arg0 = 0xCC
  573. end
  574. document int3
  575. Patch byte at address arg0 to an INT3 insn
  576. Usage: int3 addr
  577. end
  578.  
  579. # --------------------cflow---------------------
  580. define print_insn_type
  581.  if ($arg0 == 0)
  582.   printf "UNKNOWN";
  583.  end
  584.  if ($arg0 == 1)
  585.   printf "JMP";
  586.  end
  587.  if ($arg0 == 2)
  588.   printf "JCC";
  589.  end
  590.  if ($arg0 == 3)
  591.   printf "CALL";
  592.  end
  593.  if ($arg0 == 4)
  594.   printf "RET";
  595.  end
  596.  if ($arg0 == 5)
  597.   printf "INT";
  598.  end
  599. end
  600. document print_insn_type
  601. This prints the human-readable mnemonic for the instruction typed passed as
  602. a parameter (usually $INSN_TYPE).
  603. end
  604.  
  605. define get_insn_type
  606.  set $INSN_TYPE = 0
  607.  set $_byte1=*(unsigned char *)$arg0
  608.  if ($_byte1 == 0x9A || $_byte1 == 0xE8 )
  609.   # "call"
  610.   set $INSN_TYPE=3
  611.  end
  612.  if ($_byte1 >= 0xE9 && $_byte1 <= 0xEB)
  613.   # "jmp"
  614.   set $INSN_TYPE=1
  615.  end
  616.  if ($_byte1 >= 0x70 && $_byte1 <= 0x7F)
  617.   # "jcc"
  618.   set $INSN_TYPE=2
  619.  end
  620.  if ($_byte1 >= 0xE0 && $_byte1 <= 0xE3 )
  621.   # "jcc"
  622.   set $INSN_TYPE=2
  623.  end
  624.  if ($_byte1 == 0xC2 || $_byte1 == 0xC3 || $_byte1 == 0xCA || $_byte1 == 0xCB || $_byte1 == 0xCF)
  625.   # "ret"
  626.   set $INSN_TYPE=4     
  627.  end
  628.  if ($_byte1 >= 0xCC && $_byte1 <= 0xCE)
  629.   # "int"
  630.   set $INSN_TYPE=5
  631.  end
  632.  if ($_byte1 == 0x0F )
  633.   # two-byte opcode
  634.   set $_byte2=*(unsigned char *)($arg0 +1)
  635.   if ($_byte2 >= 0x80 && $_byte2 <= 0x8F)
  636.    # "jcc"
  637.    set $INSN_TYPE=2
  638.   end
  639.  end
  640.  if ($_byte1 == 0xFF ) 
  641.   # opcode extension
  642.   set $_byte2=*(unsigned char *)($arg0 +1)
  643.   set $_opext=($_byte2 & 0x38)
  644.   if ($_opext == 0x10 || $_opext == 0x18)
  645.    # "call"
  646.    set $INSN_TYPE=3
  647.   end
  648.   if ($_opext == 0x20 || $_opext == 0x28)
  649.    # "jmp"
  650.    set $INSN_TYPE=1
  651.   end
  652.  end
  653. end
  654. document get_insn_type
  655. This takes an address as a parameter and sets the global $INSN_TYPE variable
  656. to 0, 1, 2, 3, 4, 5 if the instruction at the address is unknown, a jump,
  657. a conditional jump, a call, a return, or an interrupt.
  658. end
  659.  
  660. define step_to_call
  661.  set $_saved_ctx = $SHOW_CONTEXT
  662.  set $SHOW_CONTEXT = 0
  663.  set $SHOW_NEST_INSN=0
  664.  set logging file /dev/null
  665.  set logging on
  666.  set logging redirect on
  667.  set $_cont = 1
  668.  
  669.  while ( $_cont > 0 )
  670.   stepi
  671.   get_insn_type $pc
  672.   if ($INSN_TYPE == 3)
  673.    set $_cont = 0
  674.   end
  675.  end
  676.  
  677.  if ( $_saved_ctx > 0 )
  678.   context
  679.  else
  680.   x /i $pc
  681.  end
  682.  
  683.  set $SHOW_CONTEXT = 1
  684.  set $SHOW_NEST_INSN=0
  685.  set logging redirect off
  686.  set logging off
  687.  set logging file gdb.txt
  688. end
  689. document step_to_call
  690. This single steps until it encounters a call instruction; it stops before
  691. the call is taken.
  692. end
  693.  
  694. define trace_calls
  695.  set $SHOW_CONTEXT = 0
  696.  set $SHOW_NEST_INSN=0
  697.  set $_nest = 1
  698.  set listsize 0
  699.  set logging overwrite on
  700.  set logging file ~/gdb_trace_calls.txt
  701.  set logging on
  702.  set logging redirect on
  703.  
  704.  while ( $_nest > 0 )
  705.   get_insn_type $pc
  706.  
  707.   # handle nesting
  708.   if ($INSN_TYPE == 3)
  709.    set $_nest = $_nest + 1
  710.   else
  711.    if ($INSN_TYPE == 4)
  712.     set $_nest = $_nest - 1
  713.    end
  714.   end
  715.  
  716.   # if a call, print it
  717.   if ($INSN_TYPE == 3)
  718.    set $x = $_nest
  719.    while ( $x > 0 )
  720.     printf "\t"
  721.     set $x = $x - 1
  722.    end
  723.    x /i $pc
  724.   end
  725.  
  726.   #set logging file /dev/null
  727.   stepi
  728.   #set logging file ~/gdb_trace_calls.txt
  729.  end
  730.  
  731.  set $SHOW_CONTEXT = 1
  732.  set $SHOW_NEST_INSN=0
  733.  set logging redirect off
  734.  set logging off
  735.  set logging file gdb.txt
  736.  
  737.  # clean up trace file
  738.  shell  grep -v ' at ' ~/gdb_trace_calls.txt > ~/gdb_trace_calls.1
  739.  shell  grep -v ' in ' ~/gdb_trace_calls.1 > ~/gdb_trace_calls.txt
  740. end
  741. document trace_calls
  742. Creates a runtime trace of the calls made target in ~/gdb_trace_calls.txt.
  743. Note that this is very slow because gdb "set redirect on" does not work!
  744. end
  745.  
  746. define trace_run
  747.  set $SHOW_CONTEXT = 0
  748.  set $SHOW_NEST_INSN=1
  749.  set logging overwrite on
  750.  set logging file ~/gdb_trace_run.txt
  751.  set logging on
  752.  set logging redirect on
  753.  set $_nest = 1
  754.  
  755.  while ( $_nest > 0 )
  756.  
  757.   get_insn_type $pc
  758.   # jmp, jcc, or cll
  759.   if ($INSN_TYPE == 3)
  760.    set $_nest = $_nest + 1
  761.   else
  762.    # ret
  763.    if ($INSN_TYPE == 4)
  764.     set $_nest = $_nest - 1
  765.    end
  766.   end
  767.  
  768.   stepi
  769.  end
  770.  
  771.  set $SHOW_CONTEXT = 1
  772.  set $SHOW_NEST_INSN=0
  773.  set logging file gdb.txt
  774.  set logging redirect off
  775.  set logging off
  776.  
  777.  # clean up trace file
  778.  shell  grep -v ' at ' ~/gdb_trace_run.txt > ~/gdb_trace_run.1
  779.  shell  grep -v ' in ' ~/gdb_trace_run.1 > ~/gdb_trace_run.txt
  780.  
  781. end
  782. document trace_run
  783. Creates a runtime trace of the target in ~/gdb_trace_run.txt. Note
  784. that this is very slow because gdb "set redirect on" does not work!
  785. end
  786.  
  787.  
  788. # _____________________misc_____________________
  789. # this makes 'context' be called at every BP/step
  790. define hook-stop
  791.  if ( $SHOW_CONTEXT > 0 )
  792.   context
  793.  end
  794.  if ( $SHOW_NEST_INSN > 0 )
  795.   set $x = $_nest
  796.   while ($x > 0 )
  797.    printf "\t"
  798.    set $x = $x - 1
  799.   end
  800.  end
  801. end
  802.  
  803. define assemble
  804. printf "Hit Ctrl-D to start, type code to assemble, hit Ctrl-D when done.\n"
  805. printf "It is recommended to start with\n"
  806. printf "\tBITS 32\n"
  807. printf "Note that this command uses NASM (Intel syntax) to assemble.\n"
  808. shell nasm -f bin -o /dev/stdout /dev/stdin | od -v -t x1 -w16 -A n
  809. end
  810. document assemble
  811. Assemble Intel x86 instructions to binary opcodes. Uses nasm.
  812. Usage: assemble
  813. end
  814.  
  815. define gas_asm
  816. printf "Type code to assemble, hit Ctrl-D until results appear :)\n"
  817. printf "Note that this command uses GAS (AT&T syntax) to assemble.\n"
  818. shell as -o ~/__gdb_tmp.bin
  819. shell objdump -d -j .text --adjust-vma=$arg0 ~/__gdb_tmp.bin
  820. shell rm ~/__gdb_tmp.bin
  821. end
  822. document gas_asm
  823. Assemble Intel x86 instructions to binary opcodes using gas and objdump
  824. Usage: gas_asm address
  825. end
  826.  
  827. # !scary bp_alloc macro!
  828. # The idea behind this macro is to break on the following code:
  829. #   0x4008e0aa <malloc+6>:  sub    $0xc,%esp
  830. #   0x4008e0ad <malloc+9>:  call   0x4008e0b2 <malloc+14>
  831. #   0x4008e0b2 <malloc+14>: pop    %ebx
  832. #   0x4008e0b3 <malloc+15>: add    $0xa3f6e,%ebx
  833. # At 0x4008e0b3, %ebx contains the address that has just been allocated
  834. # The bp_alloc macro generates this breakpoint and *should* work for
  835. # the forseeable future ... but if it breaks, set a breakpoint on
  836. # __libc_malloc and look for where where the return value gets popped.
  837.  
  838. define bp_alloc
  839.  tbreak *(*__libc_malloc + F) if $ebx == $arg0
  840. end
  841. document bp_alloc
  842. This sets a temporary breakpoint on the allocation of $arg0.
  843. It works by setting a breakpoint on a specific address in __libc_malloc().
  844. USE WITH CAUTION -- it is extremely platform dependent.
  845. Usage: bp_alloc addr
  846. end
  847.  
  848. define dump_hexfile
  849.  dump ihex memory $arg0 $arg1 $arg2
  850. end
  851. document dump_hexfile
  852. Write a range of memory to a file in Intel ihex (hexdump) format.
  853. Usage:  dump_hexfile filename start_addr end_addr
  854. end
  855.  
  856. define dump_binfile
  857.  dump memory $arg0 $arg1 $arg2
  858. end
  859. document dump_binfile
  860. Write a range of memory to a binary file.
  861. Usage:  dump_binfile filename start_addr end_addr
  862. end
  863.    
  864. # _________________cracker tips_________________
  865. # The 'tips' command is used to provide tutorial-like info to the user
  866. define tips
  867.     printf "Tip Topic Commands:\n"
  868.     printf "\ttip_display : Automatically display values on each break\n"
  869.     printf "\ttip_patch   : Patching binaries\n"
  870.     printf "\ttip_strip   : Dealing with stripped binaries\n"
  871.     printf "\ttip_syntax  : ATT vs Intel syntax\n"
  872. end
  873. document tips
  874. Provide a list of tips from crackers on various topics.
  875. end
  876.  
  877. define tip_patch
  878.     printf "\n"
  879.     printf "                   PATCHING MEMORY\n"
  880.     printf "Any address can be patched using the 'set' command:\n"
  881.     printf "\t`set ADDR = VALUE` \te.g. `set *0x8049D6E = 0x90`\n"
  882.     printf "\n"
  883.     printf "                 PATCHING BINARY FILES\n"
  884.     printf "Use `set write` in order to patch the target executable\n"
  885.     printf "directly, instead of just patching memory.\n"
  886.     printf "\t`set write on` \t`set write off`\n"
  887.     printf "Note that this means any patches to the code or data segments\n"
  888.     printf "will be written to the executable file. When either of these\n"
  889.     printf "commands has been issued, the file must be reloaded.\n"
  890.     printf "\n"
  891. end
  892. document tip_patch
  893. Tips on patching memory and binary files
  894. end
  895.  
  896. define tip_strip
  897.     printf "\n"
  898.     printf "             STOPPING BINARIES AT ENTRY POINT\n"
  899.     printf "Stripped binaries have no symbols, and are therefore tough to\n"
  900.     printf "start automatically. To debug a stripped binary, use\n"
  901.     printf "\tinfo file\n"
  902.     printf "to get the entry point of the file. The first few lines of\n"
  903.     printf "output will look like this:\n"
  904.     printf "\tSymbols from '/tmp/a.out'\n"
  905.     printf "\tLocal exec file:\n"
  906.     printf "\t        `/tmp/a.out', file type elf32-i386.\n"
  907.     printf "\t        Entry point: 0x80482e0\n"
  908.     printf "Use this entry point to set an entry point:\n"
  909.     printf "\t`tbreak *0x80482e0`\n"
  910.     printf "The breakpoint will delete itself after the program stops as\n"
  911.     printf "the entry point.\n"
  912.     printf "\n"
  913. end
  914. document tip_strip
  915. Tips on dealing with stripped binaries
  916. end
  917.  
  918. define tip_syntax
  919.     printf "\n"
  920.     printf "\t    INTEL SYNTAX                        AT&T SYNTAX\n"
  921.     printf "\tmnemonic dest, src, imm            mnemonic src, dest, imm\n"
  922.     printf "\t[base+index*scale+disp]            disp(base, index, scale)\n"
  923.     printf "\tregister:      eax                 register:      %%eax\n"
  924.     printf "\timmediate:     0xFF                immediate:     $0xFF\n"
  925.     printf "\tdereference:   [addr]              dereference:   addr(,1)\n"
  926.     printf "\tabsolute addr: addr                absolute addr: *addr\n"
  927.     printf "\tbyte insn:     mov byte ptr        byte insn:     movb\n"
  928.     printf "\tword insn:     mov word ptr        word insn:     movw\n"
  929.     printf "\tdword insn:    mov dword ptr       dword insn:    movd\n"
  930.     printf "\tfar call:      call far            far call:      lcall\n"
  931.     printf "\tfar jump:      jmp far             far jump:      ljmp\n"
  932.     printf "\n"
  933.     printf "Note that order of operands in reversed, and that AT&T syntax\n"
  934.     printf "requires that all instructions referencing memory operands \n"
  935.     printf "use an operand size suffix (b, w, d, q).\n"
  936.     printf "\n"
  937. end
  938. document tip_syntax
  939. Summary of Intel and AT&T syntax differences
  940. end
  941.  
  942. define tip_display
  943. printf "\n"
  944. printf "Any expression can be set to automatically be displayed every time\n"
  945. printf "the target stops. The commands for this are:\n"
  946. printf "\t`display expr'     : automatically display expression 'expr'\n"
  947. printf "\t`display'          : show all displayed expressions\n"
  948. printf "\t`undisplay num'    : turn off autodisplay for expression # 'num'\n"
  949. printf "Examples:\n"
  950. printf "\t`display/x *(int *)$esp`      : print top of stack\n"
  951. printf "\t`display/x *(int *)($ebp+8)`  : print first parameter\n"
  952. printf "\t`display (char *)$esi`        : print source string\n"
  953. printf "\t`display (char *)$edi`        : print destination string\n"
  954. printf "\n"
  955. end
  956. document tip_display
  957. Tips on automatically displaying values when a program stops.
  958. end
  959. # __________________gdb options_________________
  960. set confirm off
  961. set verbose off
  962. set prompt gdb>
  963. set output-radix 0x10
  964. set input-radix 0x10
  965. # These make gdb never pause in its output
  966. set height 0
  967. set width 0
  968. # why do these not work???
  969. set $SHOW_CONTEXT = 1
  970. set $SHOW_NEST_INSN=0
  971.  
  972. #EOF
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement