mirror of https://github.com/pwndbg/pwndbg.git
Enhance canary command
Canary command: * Displays telescope result of places where canaries are located * Moved to its own file (`pwndbg/commands/canary.py`) * Moved to `ArgparsedCommand` (as discussed in https://github.com/pwndbg/pwndbg/issues/244)pull/319/head
parent
8775073df0
commit
f69b285ad4
@ -0,0 +1,48 @@
|
|||||||
|
#!/usr/bin/env python
|
||||||
|
# -*- coding: utf-8 -*-
|
||||||
|
from __future__ import absolute_import
|
||||||
|
from __future__ import division
|
||||||
|
from __future__ import print_function
|
||||||
|
from __future__ import unicode_literals
|
||||||
|
|
||||||
|
import argparse
|
||||||
|
|
||||||
|
import pwndbg.auxv
|
||||||
|
import pwndbg.color
|
||||||
|
import pwndbg.commands
|
||||||
|
import pwndbg.commands.telescope
|
||||||
|
import pwndbg.memory
|
||||||
|
import pwndbg.regs
|
||||||
|
import pwndbg.search
|
||||||
|
|
||||||
|
parser = argparse.ArgumentParser(description='Print out the current stack canary')
|
||||||
|
|
||||||
|
|
||||||
|
@pwndbg.commands.ArgparsedCommand(parser)
|
||||||
|
@pwndbg.commands.OnlyWhenRunning
|
||||||
|
def canary():
|
||||||
|
auxv = pwndbg.auxv.get()
|
||||||
|
at_random = auxv.get('AT_RANDOM', None)
|
||||||
|
if at_random is None:
|
||||||
|
print("Couldn't find AT_RANDOM - can't display canary.")
|
||||||
|
return
|
||||||
|
|
||||||
|
global_canary = pwndbg.memory.pvoid(at_random)
|
||||||
|
|
||||||
|
# masking canary value as canaries on the stack has last byte = 0
|
||||||
|
global_canary &= (pwndbg.arch.ptrmask ^ 0xFF)
|
||||||
|
|
||||||
|
print("AT_RANDOM = %#x # points to (not masked) global canary value" % at_random)
|
||||||
|
print("Canary = 0x%x" % global_canary)
|
||||||
|
|
||||||
|
stack_canaries = list(
|
||||||
|
pwndbg.search.search(pwndbg.arch.pack(global_canary), mappings=pwndbg.stack.stacks.values())
|
||||||
|
)
|
||||||
|
|
||||||
|
if not stack_canaries:
|
||||||
|
print(pwndbg.color.yellow('No valid canaries found on the stacks.'))
|
||||||
|
return
|
||||||
|
|
||||||
|
print(pwndbg.color.green('Found valid canaries on the stacks:'))
|
||||||
|
for stack_canary in stack_canaries:
|
||||||
|
pwndbg.commands.telescope.telescope(address=stack_canary, count=1)
|
||||||
Loading…
Reference in new issue