Re: Debuggers and such...

[Sinan Eren <sinan.eren () immunitysec com>]

On Fri, 30 Jan 2004, Dave Aitel wrote:

> In my opinion ddd is to ollydb what a honda civic is to an audi s4. Part 
> of gdb's problem is ptrace() itself. I believe the bastard's team is 
> hooking the linux kernel to get around this, but it has been a long time 
> since I've looked at the project.

agreed. ptrace() is a poor bastard compared to what softice is.

> Just for starters - what memory pages are owned by what shared 
> libraries, and I want to search through all of those pages for ffe4. 
> This is an easy thing with olly, and impossible with ddd.

not agreed. i think gdb's scripting capabilities are great for any sort 
of exploit development, bug hunting task.

here is how to do what you are asking for; display shared library maps
and search for ffe4 in libc.so 

noir@juneof44:~> gdb -q /usr/bin/python
(no debugging symbols found)...(gdb) break *main
Breakpoint 1 at 0x80486d0
(gdb) r
Starting program: /usr/bin/python
(no debugging symbols found)...(no debugging symbols found)...[New Thread 
16384 (LWP 2132)]
(no debugging symbols found)...
(no debugging symbols found)...(no debugging symbols found)...(no 
debugging symbols found)...
(no debugging symbols found)...(no debugging symbols found)...(no 
debugging symbols found)...
[Switching to Thread 16384 (LWP 2132)]

Breakpoint 1, 0x080486d0 in main ()
(gdb) info sharedlibrary
> From        To          Syms Read   Shared Object Library
0x400454d0  0x400de304  Yes         /usr/lib/libpython2.3.so.1.0
0x4011e260  0x40126f24  Yes         /lib/i686/libpthread.so.0
0x4016beb0  0x4016cde4  Yes         /lib/libdl.so.2
0x4016ee50  0x4016f7b4  Yes         /lib/libutil.so.1
0x401ad440  0x4020df14  Yes         /usr/lib/libstdc++.so.5
0x40235520  0x4024e044  Yes         /lib/i686/libm.so.6
0x40256520  0x4025b3e4  Yes         /lib/libgcc_s.so.1
0x40272b40  0x4036d7b4  Yes         /lib/i686/libc.so.6
0x40000c00  0x400139ef  Yes         /lib/ld-linux.so.2
(gdb) set $libc = 0x40272b40
(gdb) while ( (*$libc & 0xffff) != 0xffe4 && $libc < 0x4036d7b4)
> set $libc = $libc + 1
> end
(gdb) x/2bx $libc
0x402742fa <add_derivation+122>:        0xe4    0xff
(gdb)

> Every unix hacker, including myself, who's used olly has wished they had 
> it on linux.

i wish i had softice on linux since kernel land is as much interesting ... 
and i cant recall ollydbg doing any kernel level stuff.

-sinan


_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
http://www.immunitysec.com/mailman/listinfo/dailydave