Bari Wiki

• spusteni gdb

 $gdb -q ./a.out

• nastaveni breakpointu na fci main

 (gdb) break main

• spusteni programu :)

 (gdb) run

• vypsani info o registrech (kdyz program stoji na breakpoint)

 (gdb) info registers

• nastaveni assembleru na intel

 (gdb) set dis intel

 $objdump -D -M intel ./a.out

• parametry
  • -D - dissassemble all
  • -M - typ asembleru (default AT&T)

• syntax assembleru INTEL

  4004e4:       55                      push   rbp
  4004e5:       48 89 e5                mov    rbp,rsp
  4004e8:       48 83 ec 10             sub    rsp,0x10

• syntax assembleru AT&T

  4004e4:       55                      push   %rbp
  4004e5:       48 89 e5                mov    %rsp,%rbp
  4004e8:       48 83 ec 10             sub    $0x10,%rsp

• EIP - instruction pointer
• EAX, ECX, EDX, EBX - univerzalni registry - Accumulator, Counter, Data, base
• ESP, EBP, ESI, EDI - dalsi univerzalni registry
• EFLAGS - bitove identifikatory

• stejne registry jako x86, ale misto prefixu e pouziva prefix r
• navic registry r8-r15

(gdb) info registers
rax            0x7ffff7dd9ee8   140737351884520
rbx            0x0      0
rcx            0x0      0
rdx            0x7fffffffe7a8   140737488349096
rsi            0x7fffffffe798   140737488349080
rdi            0x1      1
rbp            0x7fffffffe6b0   0x7fffffffe6b0
rsp            0x7fffffffe6b0   0x7fffffffe6b0
r8             0x7ffff7dd8320   140737351877408
r9             0x7ffff7deb040   140737351954496
r10            0x0      0
r11            0x7ffff7a78db0   140737348341168
r12            0x400400 4195328
r13            0x7fffffffe790   140737488349072
r14            0x0      0
r15            0x0      0
rip            0x4004e8 0x4004e8 <main+4>
eflags         0x246    [ PF ZF IF ]
cs             0x33     51
ss             0x2b     43
ds             0x0      0
es             0x0      0
fs             0x0      0
gs             0x0      0

• tohle jsem nevedel :) je to velice zajimave :)

[1000950.117170] nfprofile[19184]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fffed2781c0 error 4 in nfprofile[400000+25000]
[1000950.120928] nfprofile[19185]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fff2d003080 error 4 in nfprofile[400000+25000]
[1000950.124587] nfprofile[19186]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fffedda2e90 error 4 in nfprofile[400000+25000]
[1005919.114319] nfprofile[32626]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fff8871a070 error 4 in nfprofile[400000+25000]
[1022741.303483] nfprofile[11309]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fff5baf7ec0 error 4 in nfprofile[400000+25000]
[1185433.766166] nfprofile[22225]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fff96a5eae0 error 4 in nfprofile[400000+25000]
[1185433.770096] nfprofile[22226]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fff3c799510 error 4 in nfprofile[400000+25000]
[1185433.773886] nfprofile[22227]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fffb9240610 error 4 in nfprofile[400000+25000]
[1186145.925757] nfprofile[24369]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fff0fa10cf0 error 4 in nfprofile[400000+25000]
[1191930.527903] nfprofile[9294]: segfault at ffffffffffffffff ip 0000000000402c67 sp 00007fff59045820 error 4 in nfprofile[400000+25000]

objdump -NCl on the nfprofile binary tells me 402c67 in the compiled application is in process_data() at line 130

121: nffile = GetNextFile(NULL, 0, 0);
122: if ( !nffile ) {
123: LogError("GetNextFile() error in %s line %d: %s\n", __FILE__, __LINE__, strerror(errno) );
124: return;
125: }
126:
127: // store infos away for later use
128: // although multiple files may be processed, it is assumed that all
129: // have the same settings
130: is_anonymized = IP_ANONYMIZED(nffile);
131: strncpy(Ident, nffile->file_header->ident, IDENTLEN);
132: Ident[IDENTLEN-1] = '\0';

• a prakticky to bude takove…

nfprofile[3448]: segfault at ffffffffffffffff ip 000000000040272d sp 00007fff025f6830 error 4
nfprofile[3454]: segfault at ffffffffffffffff ip 000000000040272d sp 00007fff4a5dac60 error 4 in nfprofile[400000+22000] in nfprofile[400000+22000]
nfprofile[3446]: segfault at ffffffffffffffff ip 000000000040272d sp 00007fff4b56d150 error 4 in nfprofile[400000+22000]
nfprofile[3458]: segfault at ffffffffffffffff ip 000000000040272d sp 00007fff7a1d4dd0 error 4 in nfprofile[400000+22000]
nfprofile[3456]: segfault at ffffffffffffffff ip 000000000040272d sp 00007fff20e5a570 error 4 in nfprofile[400000+22000]
nfprofile[3450]: segfault at ffffffffffffffff ip 000000000040272d sp 00007fff58e734f0 error 4 in nfprofile[400000+22000]
nfprofile[3452]: segfault at ffffffffffffffff ip 000000000040272d sp 00007fff3c90aa20 error 4 in nfprofile[400000+22000]

$ objdump -DCl /usr/local/bin/nfprofile  | less
..
/home/flowmon/nfdump-1.6.6-lic2.0/bin/nfprofile.c:626
  402727:       48 89 44 24 68          mov    %rax,0x68(%rsp)
process_data():
/home/flowmon/nfdump-1.6.6-lic2.0/bin/nfprofile.c:121
  40272c:       e8 cf bd 00 00          callq  40e500 <GetNextFile>
/home/flowmon/nfdump-1.6.6-lic2.0/bin/nfprofile.c:122
  402731:       48 85 c0                test   %rax,%rax
/home/flowmon/nfdump-1.6.6-lic2.0/bin/nfprofile.c:121
  402734:       49 89 c7                mov    %rax,%r15
/home/flowmon/nfdump-1.6.6-lic2.0/bin/nfprofile.c:122
  402737:       0f 84 89 0f 00 00       je     4036c6 <main+0x1566>
..

• zdroje: http://mytechrants.wordpress.com/2009/05/22/debugging-a-segmentation-fault-using-gdb/
• priiklad z praxe

• klasicky vystup pri spusteni programu

/home/bari/Plocha/flowmon-vyvoj/nfdump-1.6.9-nbar-lic3.0-geo-http/bin/sfcapd -E -w -p 3030  -l /tmp/
..
Neoprávněný přístup do paměti (SIGSEGV)

• v dmesg se dozvime vice, ale je to k nicemu. Program umrel pri volani funkce knihovny libc. Nevim ale jakeho, chybi mi backtrace.

sfcapd[1407] general protection ip:7f25fab7e119 sp:de0a6b281b401a28 error:0 in libc-2.13.so[7f25faa7d000+18d000]

• zapnuti coredump

ulimit -c unlimited

• vytvoril se mi soubor core

Neoprávněný přístup do paměti (SIGSEGV) (core dumped [obraz paměti uložen])

gdb /home/bari/Plocha/flowmon-vyvoj/nfdump-1.6.9-nbar-lic3.0-geo-http/bin/sfcapd core

• ale moc moudra z toho nevypadlo

[195964.091582] sfcapd[1438] general protection ip:7fbe6b62b119 sp:44ca3412556af324 error:0 in libc-2.13.so[7fbe6b52a000+18d000]

(gdb) bt
#0  ____longjmp_chk () at ../sysdeps/unix/sysv/linux/x86_64/____longjmp_chk.S:112
#1  0x44ca3412556af324 in ?? ()
Cannot access memory at address 0x44ca3412556af324

• systemd se stará i o core dumpy

cat /proc/sys/kernel/core_pattern
|/usr/lib/systemd/systemd-coredump %p %u %g %s %t %e

• podle dokumentace se coredump vytváří ve složce /var/lib/systemd/coredump/*
• je uložen komprimovaně v xz archívu

• lze taky použít

systemd-coredumpctl list
systemd-coredumpctl dump --output /tmp/aaa

• Moc pekne exploitace pres signal handler