* add short intro to configuration
* spruce up attachp message
* move notes and examples to appropriate sections, and assert that
* leakfind upd and add probeleak
* track-heap: report chunk size as hex
* add more commands to docs
* add comment to the profiler
* add docstrings for each top-level module
* highlight in profiler description
* fix attachp test
* Change usage of pwndbg.aglib.memory.pvoid to optimized pwndbg.aglib.memory.read_pointer_width
* lint
* Use google style docstring, remove old pvoid function
---------
Co-authored-by: Disconnect3d <dominik.b.czarnota@gmail.com>
* Add cache to avoid calling is_linux dozens of times
* Move variable out of loop
* Replace another usage of 'not .is_linux()' to .is_baremetal()
* Rename is_baremetal() -> is_pagefault_supported() (and invert meaning)
* Update pwndbg/aglib/memory.py
---------
Co-authored-by: Disconnect3d <dominik.b.czarnota@gmail.com>
* Added types to hexdump()'s parameters
* hexdump(): upgraded format strings to f-strings, while fixing the offset when data is empty
* hexdump(): offset is now correctly computed and updated accross repeated calls to hexdump.
This fixes two bugs:
1. Offset was increased by the number of lines displayed by the hexdump() command,
which was incorrect, as some lines may be compressed;
2. When dumping a number of bytes that is not divisible by the number of bytes per line,
offset would be incorrectly updated.
* Linter
* hexdump: fixed type of retrieved config entry hexdump_group_use_big_endian
* Fixed test_hexdump_saved_address_and_offset test to account for random stack address
* Upgraded the linked-lists.c test program to 6 items in order to test the "deference-limit" setting
* Chain: changes to the deference-limit parameter were not reflected in the program due to an early cast to int()
* Linter
* Port Pwndbg to LLDB
* Fix splitting mistakes
* I love typos
* We already check for Python 3.11 manually
* Update pwndbg/dbg/lldb/__init__.py
Co-authored-by: patryk4815 <bux.patryk@gmail.com>
* Fix use of wrong variable name that was preventing the vmmap from being used in LLDB memory reads
* Use cached vmmap for `read_memory` in LLDB
* Fix Pwndbg CLI jank
* Try using SBAddress to resolve objfile names in LLDB vmmap
* Fix missing changes in `pwndbg.gdblib`
* Update pwndbg/aglib/arch.py
* Update pwndbg/aglib/arch.py
* Remove outdated comment about `pwndbg.aglib.arch`
* Update pwndbg/dbg/lldb/repl/io.py
Co-authored-by: Disconnect3d <dominik.b.czarnota@gmail.com>
* Fix lints
* Fix new test so that it points to `pwndbg.aglib.disasm`
* Fix lints
---------
Co-authored-by: patryk4815 <bux.patryk@gmail.com>
Co-authored-by: Disconnect3d <dominik.b.czarnota@gmail.com>
* basic binary ninja integration
* start centralizing integrations into uniform interface
* finish most integrations
* make binja integration contain all ida features
* allow switching servers
* remove unused functions
* format
* fix unit tests
* satisfy mypy + warn instead of error on invalid provider
* fix decompilation not working in function prologue
* better config options and il config
* lint
* fix bn_sym test
* add decomp command
* add bn_eval gdb function
* format binja_script.py
* satisfy mypy again
* doc update
* move integrations to separate subdir + make test_loads more versatile
* format
* forgot to push a file
* format
* highlight next instruction instead of previous one in decomp
* fix disassembly il level
* prefer function tags over data tags
* add bn_var function
* add variable labeling
* more configurability, documentation, bug fixes
* code cleanup
* format
* remove code duplication between chain.py and memory.py
* add short-lived cache for some integration functions
* use every register available to help with frame inference
* lint
* don't waste time checking irrelevant registers
* move performance hit in cache only to except case
* fix issue with conflict resolution
* lint
* fix rebase mistake
* Additional type hints
Activate `vermin --eval-annotations` to catch invalid type hints for Python 3.8.
Use `typing_extensions.ParamSpec` to avoid hiding function arguments through decorators.
* Fix safe linking detection
* Fix cast of glibc_version parameter in < Python 3.10
* Use "queue.Queue[int]" for Python 3.8 compatibility
* Address review
* Add comments and address review
* V1 - annotations for values of registers and memory to display result of instructions.
* Emulator telescope(), more x86 instructions
* Emulation change - keep track of before & after instruction execution. Telescope format correctly, read size taken into account
* Add config options to configure emulation and annotations, vmovaps alignment warning, string length in disasm telescope, cache previously annotated instructions
* Create PwndbgInstruction type for better typing and easier future development
* More consistent spacing, options to disable annotations, ADD instruction shows operands
* Rebase from dev
* Correctly go to .next address in disasm view (was incorrectly going to call targets)
* Precompute register str to reduce code duplication
* Correct telescope memory read width, bring target printing back to previous behavior when symbol can be resolved
* More consistent looking annotation spacing/padding, fixed edge case bugs with cached instructions
* Even cleaner padding
* Additional comments and debugging, ironed out last bugs
* debugging tight loops
* Cache fixed - nearpc only annotates what can be statically resolved
* lint and show instructions that cannot dereference
* Reapply btrace crash fix after rebase
* Less code duplication, implement XCHG and AND instructions, moved more methods from x86 subclass to superclass
* aarch64 set flags register in Unicorn correctly
* fix
* Don't recreate emulator regname->const map every time the emulator is instantiated
* Use emulation to set .next within enhancement
* Improve ret instruction target address setting
* Green checkmarks for jumps on all architectures
* Fixed .next and .target setting
* All architectures now have correct logic for determining .next and .target. Green checkmarks for taking conditional branches now appear for all architectures, added things to determine that type of branch being taken, and simplified printing by replacing symbol_addr with new field 'target_string'
* Instruction debug print fix
* Correct jump instruction checking
* Fixed target_string resolution
* Fix conditional jump check, also make default target resolution better
* target_const determined more accurately
* reverse iteration order of last change
* Pwndbg.condition is more retyped and more correct, make manual determinations of condition override the emulators (it can be incorrect in cases). Uncover why MIPS sometimes takes incorrect jumps in the emulator (delay slot)
* MIPS annotations work really good now. Jumps are correctly predicted (with green checkmarks). Implemented manual condition() function for MIPS. Only highlight the correct instance of instruction at PC when there are multiple in view (tight loops). Allow manual .condition to override emulator in determiningg .next.
* Additional debug info on instructions
* Print arch in instruction
* aarch64 branch fix
* aarch64 branch fix (real)
* lint
* Final changes - fixing .size error
* lint
* Add dev_dump_instruction command, add default memory read in resolve_used_value, update comments and remove .size from enhancedoperand as it only exists on x86
* More uniform spacing on annotations
* Various comments converted to docstrings, aarch64 enhancer created, post-rebase
* import aarch64
* Aarch64 mov, ldr, add, sub
* adrp
* ADR
* lint
* Fun with git rebase
* lint
* lint again after re-installing dependencies
* New caching strategy implemented to ensure no state caching when jumping large distances. Handled edge cases of user manually setting a register or memory, 'set regname=2'
* lint
* Fixed two regressions (nearpc shouldn't take jumps, even ones we know statically, and replace all constants in the assembly with symbols). Tweak tests to reflect new annotations
* lint
* one last test
* Fix chain format dereferencing for non-singleton lists, now correctly deferences and displays chains for future instructions when not emulating (dereference until pointer goes to writable memory)
* Add jumps-only setting to emulation (on, off, jumps-only), fixes to chain deferencing and enhancing
* Properly dereference memory before and after execution of instructions, adding a new before_value_resolved field (same for after). This also reduces code duplication.
* Debogusify the format()/telescoping dereferencing logic
* lint
* post-rebase fixes
* Fix case the breaks a test - don't attempt to read larger than ptrsize such as in SIMD instruction memory reads
* Typo in emulate setting
* Developer docs for annotations
* Fix case where emulator attempts to read and unpack very large, 16 byte+ wide values while telescoping
* Move symbol.py to gdblib
* Renamed private methods
* Renamed pwndbg.symbol to pwndbg.gdblib.symbol
* Cleanup symbol.py
* Fix lint issues
* Handle tls error on symbol lookup
* Fix merge conflicts
* Remove old way of looking up symbols
Those lines are redundant in our case: pwndbg is not imported or launched directly.
Also, the coding lines were relevant in Py2 but are not really needed in Py3.
The problem was that after some of the recent changes to chain/get to prevent dereferencing too much addresses and having better display when dereferencing limit is 0 (used for bare metal debugging) the bins command displayed wrong results for everything except fastbins.
This was due to the fact we are adding the dereference start address to the list.
This fixes the `bins` command by adding `include_start=True` keyword argument to the `chain.get` function. The `bins` simply uses `include_start=False`.
* Make chain.get() to check vmmap first in bare metal mode
Make chain.get() limit to de-reference within the known page in
bare metal mode.
Since the address are all valid when mmu is not enable and all
the value are valid physical address. It will be de-referenced
even these addresses are not used and actually, it is data in
the most of case. Ex. 0x1 often means the value 1, not the
address 0x1.
Also, for issue #371, some addresses may be the MMIO registers.
The read operation on these address will break the state.
It is better to limit the de-reference address range. This patch
will also fix it, hopefully.
* Add custom vmmap add/del API in vmmap.py
In some cases, ex. bare metal, the pages information can not be
detected automatically. Also, the most of pwndbg feature rely on
page information such as highlighting.
User may want to create page information manually and maintain it
by himself.
This commit add python APIs to manually add/del page information
and they are isolated.
* Fix stack page detection in bare metal mode
We can not detect the stack page size in bare metal mode by
1. finding the ELF location after the stack page
2. page fault
A simple workaround is returning the current $sp page
and assume it is the stack page.
* Add vmmap control command to add/del customized vmmap
In some cases, ex. bare metal, the pages information can not be
detected automatically. Also, the most of pwndbg feature rely on
page information such as highlighting.
User may want to create page information manually and maintain it
by himself.
I add few commands to make user can add/del pages and load page
information from ELF sections.
* Fix the command amount for auto test to pass CI
* Add warning message
* Fix descriptions
* Fix cache issue and use bisect in insert API
* Keep LinuxOnly in find_elf_magic
* remove XXX
* Add dereference-limit and heap-dereference-limit parameters
This allows setting the number of pointers dereferenced during 'telescope'
and in the register context. Separately, the number of heap bins which
are dereferenced can be set.
* Cast LIMIT to an integer, and address off-by-one
* Added support for using different malloc algorithms and implemented
ptmalloc commands
- Added support for the mp_ structure from glibc
- Fixed the bug when the base of [heap] is not sbrk_base (occurs
when bss is very large).
- Added an interface for interacting with ptmalloc heaps
* Added fastbins, unsortedbins, smallbins, largebins
- Implemented the bin functions both in the ptmalloc interface in
the heap/ directory and the commands function
- Completed the bins command which prints all the commands
- Added option to bin commands `verbose` specifies the users desire
to print empty bins - linked lists with out any nodes from malloc
- Changed bin representation to OrderedDict
* remove old bins command
* Ptmalloc bug fixes
- switched constants.ptmalloc from using pwndbg.typeinfo to a gdb
api function to prevent bugs when libc-dbg isn't installed
- Other minor changes
* Added some functionality for when libc-dbg is not present
- Added checks for finding symbols
* Ran isort on pwndbg
* Made few changes based on feedback from pull requests
- Cleaned up spaces_table
- Syntax changes
* Moved formatting code away from logic
- Moved format_bin from pwndbg.heap.ptmalloc to pwndbg.commands.heap
* Fixed bug in spaces_table for 32 bit archs
* Changed malloc_chunk command to display FASTBIN instead of PREV_INUSE
- Fixed local isort version problems
* Small bug fixes, tweaks, and added features list.
- Changed pwndbg.chain.format to use the offset for the very last
index in the chain.
- Fixed bug with ptmalloc's main_arena property.
- Added images to cap and links to FEATURES.md.
- Changed bin commands to print hex instead of base 10.
* Modified docstring to match other docstrings in pwndbg
* Memoize properties, fix merge conflicst, fix constants
- Moved the macros from the constants directory into the Heap
class, left the constants there.
- Switched from lazy loading to the memoize events.
* Fixed double spaces after images from a previous pull request.
* Added more examples to FEATURES.md for heaps
* Fix typos in FEATURES.md
* more colors and fully customizable and themeable styles
* implemented Trigger annotation for callbacks to any config keys
This can be quite useful we we need to call some code to react
on config value changes like reloading values and caches.
This approach allows to react on any config keys.
* splitting color functions to sub modules for better separation
* allow config triggers to be resolved from Parameter types
this way its safer against refactoring then simply string constants
somewhere in the codebase.
* splitting visual theme related configs to own command via scopes
This way we can use gdb internals config infrastructure for both worlds
and just separate them within a certain scope.
* switched theme config naming schema to naturally scope by its context
* more theme configuration for telescope, backtrace, chain
* colored config value printing with dynamic ljust of config/theme output
* Basic implementation of heap commands
* Optionally allow a user to specify the main_arena address
* Fix coloring, walk heap to find top_chunk
* Remove unnecessary casts
* Added docs and constructed values from types
k4lizen
OBarronCS
patryk4815
Charles Fol
Matt.
Jason An
Aaron Adams
peace-maker
∂ω∂
Disconnect3d
Gulshan Singh
cnwangjihe
Meng-Huan Yu
Alexandro Sanchez
Zach Riggle
Zach Riggle
blendin
Levente Polyak