Advertisement
osori

디버거

Sep 15th, 2024
27
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 2.50 KB | None | 0 0
  1. #define _GNU_SOURCE
  2. #include <stdio.h>
  3. #include <stdio.h>
  4. #include <dlfcn.h>
  5. #include <capstone/capstone.h>
  6. #include <signal.h>
  7. #include <sys/types.h>
  8. #include <sys/stat.h>
  9. #include <fcntl.h>
  10. #include <string.h>
  11.  
  12. char* bp_addr;
  13. char saved_bp;
  14. csh handle;
  15. cs_insn* insn;
  16.  
  17. void disass(void* addr){
  18.     cs_disasm(handle, addr, 15, addr, 0, &insn);
  19.     printf("Disassembly : %s %s\n", insn[0].mnemonic, insn[0].op_str);
  20. }
  21.  
  22. void handler(int sig, siginfo_t *info, void *ucontext)  
  23. {
  24.     ucontext_t *uc = (ucontext_t *)ucontext;  
  25.     char command[0x100];
  26.     if (info->si_addr == NULL){
  27.         //int3  
  28.         puts("BP Hit");      
  29.         printf("RIP : %p\n", uc->uc_mcontext.gregs[16] - 1);        
  30.         *bp_addr = saved_bp;    
  31.         disass(uc->uc_mcontext.gregs[16] - 1);
  32.         uc->uc_mcontext.gregs[16] = bp_addr;          
  33.         scanf("%s", command);
  34.         //continue
  35.         if (!strcmp(command, "c")){
  36.             size_t eflags = uc->uc_mcontext.gregs[17];
  37.             eflags &= ~0x100; //single step disable
  38.             uc->uc_mcontext.gregs[17] = eflags;
  39.         }
  40.         else if(!strcmp(command, "si")){
  41.             size_t eflags = uc->uc_mcontext.gregs[17];
  42.             eflags |= 0x100; //single step enable
  43.             uc->uc_mcontext.gregs[17] = eflags;
  44.         }
  45.     }
  46.     else{
  47.         //single step
  48.         printf("RIP : %p\n", info->si_addr);
  49.         disass(info->si_addr);
  50.         scanf("%s", command);
  51.         //continue
  52.         if (!strcmp(command, "c")){
  53.             size_t eflags = uc->uc_mcontext.gregs[17];
  54.             eflags &= ~0x100; //single step disable
  55.             uc->uc_mcontext.gregs[17] = eflags;
  56.         }
  57.         else if(!strcmp(command, "si")){
  58.             size_t eflags = uc->uc_mcontext.gregs[17];
  59.             eflags |= 0x100; //single step enable
  60.             uc->uc_mcontext.gregs[17] = eflags;
  61.         }
  62.     }      
  63. }
  64.  
  65.  
  66.  
  67. void __attribute__((constructor)) my_init() {
  68.     cs_open(CS_ARCH_X86, CS_MODE_64, &handle);
  69.     printf("debugger start!\n");
  70.     struct sigaction sa;
  71.     sa.sa_sigaction = handler;
  72.     sa.sa_flags = SA_SIGINFO;
  73.     if (sigaction(SIGTRAP, &sa, NULL) == -1) {
  74.         perror("sigaction");
  75.         return 1;
  76.     }
  77.     printf("bp > ");
  78.     scanf("%llx", &bp_addr);  //bp_addr = bp 걸 주소
  79.     printf("%llx\n", ((size_t)bp_addr >> 12) << 12);
  80.     mprotect(((size_t)bp_addr >> 12) << 12, 0x1000, 7);    
  81.     saved_bp = *bp_addr;
  82.     *bp_addr = 0xCC;
  83.     getchar(); //개행제거    
  84. }
  85.  
  86.  
  87.  
  88.  
  89.  
  90.  
  91.  
  92.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement