* Implements kdmesg for Linux kernels 5.10+.
* Minor optimizations and fixes to kdmesg.
* Fix lint errors
* Add test_command_kdmesg() to test_commands_kernel.py to test kdmesg.
* Fix lint errors
* Add docs
* Docs
* Improved documentation
* Lint fixes
* Improve documentation
* Fix lint errors
* Add functionality for -T, --ctime argument to print time in human readable format
* Fix lint errors
* Docs update
* Add test for -T arg in kdmesg
* Fix lint errors
* Fix -T arg to reflect current time, not offset
* Fix lint errors
* Bugfix for older versions of the kernel
* Fix lint errors
* Error checks
* Fix lint errors
* Test fix
* Fix lint errors
* page walks
* Improving kernel-vmmap
* added test for kernel vmmap
* improve userland heap handling
* improve kernelland sections handling
* fixed typo
* fixed test
* adding support for info mem
* changed array to tuple based on suggestions
* removing esp fixup stacks from display
* including call stacks
* implemented pagewalk
* added pagewalk test
* improved testing / output
* added docs
* renaming
* actually adding the remamed file
* adding decoration for cpu arch
* Revert "adding decoration for cpu arch"
This reverts commit 84aa120f68.
* added arch check for pagewalk
* adding req on symbols
* supporting mem info
* refactored pagewalk helpers
* added support for older versions of qemu-x86_64
* improved pagewalk helper function signature
* improved processing of vmmap
* refactored a bit more
* refactored a bit more
* removed changes to kernel/vmmap
* adding option to not process pages
* improving support to info mem
* changed to tuple
* changed to tuple
* changed to tuple
* added aarch64 mem mapping
* improved testing
* fixing for arm64
* a bit more amending
* fixing test
* fixed edge cases
* page walks
* Improving kernel-vmmap
* added test for kernel vmmap
* improve userland heap handling
* improve kernelland sections handling
* fixed typo
* fixed test
* adding support for info mem
* changed array to tuple based on suggestions
* removing esp fixup stacks from display
* including call stacks
* implemented pagewalk
* added pagewalk test
* improved testing / output
* added docs
* renaming
* actually adding the remamed file
* adding decoration for cpu arch
* Revert "adding decoration for cpu arch"
This reverts commit 84aa120f68.
* added arch check for pagewalk
* adding req on symbols
* supporting mem info
* refactored pagewalk helpers
* added support for older versions of qemu-x86_64
* improved pagewalk helper function signature
* improved processing of vmmap
* refactored a bit more
* refactored a bit more
* removed changes to kernel/vmmap
* adding option to not process pages
* improving support to info mem
* changed to tuple
* changed to tuple
* changed to tuple
* added aarch64 mem mapping
* improved testing
* fixing for arm64
* a bit more amending
* fixing test
* fixing the issue that the script does not drop to a pdb shell when a test fails and the pdb option is specified
* allowing to manually connect to gdb
* changed to pdb
* page walks
* implemented pagewalk
* added pagewalk test
* improved testing / output
* added docs
* renaming
* actually adding the remamed file
* adding decoration for cpu arch
* Revert "adding decoration for cpu arch"
This reverts commit 84aa120f68.
* added arch check for pagewalk
* refactored pagewalk helpers
* improved pagewalk helper function signature
* refactored a bit more
* refactored a bit more
* removed changes to kernel/vmmap
* add short intro to configuration
* spruce up attachp message
* move notes and examples to appropriate sections, and assert that
* leakfind upd and add probeleak
* track-heap: report chunk size as hex
* add more commands to docs
* add comment to the profiler
* add docstrings for each top-level module
* highlight in profiler description
* fix attachp test
* pwndbg isn't an lldb plugin, mention bata24/gef, update sizes
* rephrase one readme line
* make what about... section more concise
* add a reference to original blog post
* lengthen description for dev-dump-instruction
* unbork go debugging page
* rename misc -> tutorials
* ida integration
* update context command description
* add video example to context docs
* add more clear separation in configuration docs
* proper capitalization on GDB, Pwndbg, LLDB in docs
* lint :P
* upd readme line
* fix tests and more clear grammar
* use `pwndbg` in gif instead of `gdb --quiet`
* update contributing/making-a-gif
* fix: show "x" when the condition instruction will not be taken
Fixes#3025
* Update disasm.py
* Update disasm.py
* Update disasm.py
* Fix X marker in cross-arch tests (aarch64, riscv64)
* install uv and use it to create venv
* fix lint.sh to use all necessary deps
* make the test scripts use uv
* put uv into system path
* more clear setup.sh output
* don't look for uv in venv
* update the workflows to use uv
* lowercase pwndbg in upd message
* fix coverage invocation
* more robust test invocation
* pre-sync docs build
* don't pass venv to find_uv in [gdb/lldb]init
* uv sync before lint for more robustness
* make lldb work out of the box together with gdb
* don't uninstall dependancies when syncing
* modify scripts to use uv inside venv
* update workflows
* fix lint for scripts/
* update doc verifier workflow
* let nix magic check uv.lock
* use the venv as specified from venv in scripts so it works in docker
* add uv to project deps
* fix tests venv location
* revert uv venv lookup changes
* fix kernel tests
* fix nix
* work without venv, refactor code, packagers enjoy
* fix dockerfiles
* no posix; bash is my new best friend
* dont make venv in nix
* cleaned up paths
* Update gdbinit.py
* rebase: update link and uv lock
* Update lldbinit.py
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update scripts/common.sh
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update gdbinit.py
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fixup bad rebase (setuptools)
* don't use UV if the .skip-venv file exists
* document the PWNDBG_PLEASE_SKIP_VENV option
* fix nix devshell
* Update lldbinit.py
* extend -> append
---------
Co-authored-by: Disconnect3d <dominik.b.czarnota@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Remove {next,step}* tests from all commands tests
This optimizes CI test run; those commands are also kinda tested
elsewhere, maybe not fully, but let's leave it as it is for now...
* add total vs cumulative time for tests
* Change usage of pwndbg.aglib.memory.pvoid to optimized pwndbg.aglib.memory.read_pointer_width
* lint
* Use google style docstring, remove old pvoid function
---------
Co-authored-by: Disconnect3d <dominik.b.czarnota@gmail.com>
* gdb: suggest &main instead of main (address of symbol) in commands
* remove raise
* Revert "gdb: suggest &main instead of main (address of symbol) in commands"
This reverts commit 64e6d85c8e.
* Fix distance
* Remove todo
The `test_next_command_doesnt_freeze_crashed_binary` test incorrectly
used `REFERENCE_BINARY` instead of `CRASH_SIMPLE_BINARY` so it didn't
really checked what happens when we run next commands on a crashing binary
but instead it ran it on a working binary...
This also speeds up test execution for the
`test_next_command_doesnt_freeze_crashed_binary[stepsyscall]` test from
30s to 1s on my machine.
* Add the rebase address for elf command.
* linting
* linting
* Add file offset and rel address in memory. Build a table for display
* Modify the display information table. Add the coloring based output
* generate docs
* Fix unnecessary run of enhancement code
* Avoid another unnecessary instruction disassembly
* Update ARM IT block tests to reflect improved behavior in standalone disassembly
* restructure development docs
* clarify that qemu-tests are actually qemu-system-tests are actually kernel tests
* finish index.md; factor out dev notes and writing tests
* cleanup 'writing tests' and loose links/anchors
* update .github files
---------
Co-authored-by: Disconnect3d <dominik.b.czarnota@gmail.com>
* fix: use @pwndbg.commands.Command instead of @pwndbg.commands.ArgparsedCommand
* fix: linting
* Minor cleanup: f-strings and replaced 'latest' links with version-specific ones
* fix type annotations for return values
* add tests for canary command on x86-64 and i386
* fix linting
* added/modified registers for kernel pwning
* added a RegisterContext class for more complex register context handling
* cleaned up register context selection and flag bits
* further cleaned up register context selection
* fixing None deref issue
* handling NoneType registers
* linting
* removed most of the extra register classes
* fully removed extra register classes in commands/context.py
* renamed var so that the linter doesn't confuse the var name with dataclass type name
* some comments on newly added classes
* fixed issues based on suggestions
* fixed issues when debug symbols are not present in x64 kernel
* added full buddy allocator debugging support and abstracted indent context
* added options for pcplist
* added dynamic arg checking and implemented __len__ for GDBValue
* added new ParsedBuddyArgs class and THBs support and improved overall handling
* handling function params using a class to cleanly pass values around such that can find free pages
* added help info
* added comments for newly added classes
* changed cmd name and added test
* added reference and linting
* added docs
* fixed typo
* fixed quotes
* supporting filter by numa node index
* actually filtering by node index
* added/modified registers for kernel pwning
* added a RegisterContext class for more complex register context handling
* cleaned up register context selection and flag bits
* further cleaned up register context selection
* fixing None deref issue
* handling NoneType registers
* linting
* removed most of the extra register classes
* fully removed extra register classes in commands/context.py
* renamed var so that the linter doesn't confuse the var name with dataclass type name
* some comments on newly added classes
* fixed issues based on suggestions
* fixed issues when debug symbols are not present in x64 kernel
* Apply suggestions from code review
Co-authored-by: OBarronCS <55004530+OBarronCS@users.noreply.github.com>
* reduced performance overhead & added some examples for arm biflags & error handling
---------
Co-authored-by: OBarronCS <55004530+OBarronCS@users.noreply.github.com>
* test that gdb and argparse give the same help message
* fix misc test
* rstrip outputs
* added comment explaining the down aliases
* Update pwndbg/commands/ida.py
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update tests/gdb-tests/tests/test_misc.py
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Disconnect3d <dominik.b.czarnota@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* - Use process network namespace instead of debugger network namespace for /proc/net/* files.
- Add tcp6 support
* - use tid
* - fix format ipv6
* fix lint
* add test + fixes
* convert little to big endian
* convert little to big endian
* Use Zig for compiling for cross architecture tests.
* comments/typos
* Check if GDB supports crossarch targets, inline _start definition in assembly, add comments
* expand and add examples to pwndbg convenience functions
* update usage descriptions in _gen_*
* refactor out some common logic
* implement function doc generation
* change some mkdocs defaults around to be better for the general case
* generate function docs
* cleanup some examples, help, and quote escaping explanation
* move fsbase and gsbase definitions (and use decorator)
* cleanup signature for fsbase and gsbase
* autogen functions
* type annotation
* fix ida and binja descriptions
* rename arguments, reorder docs for `help function` and assert convention
* add missing imports
* use inspect.getdoc instead of directly accessing __doc__
for more consistency across python versions
* regen docs with getdoc()
* rewire exit and lint
* let users know about convenience functions through the `pwndbg` command
* sys.exit instead of exit
* Add a test that steps through each instruction in a program in different arches to detect crashes in annotations code
* lint
* Add symlinks so qemu can find libraries, simplify selecting correct qemu version
* lint
* compile cross-arch binaries with -static
* Add map of cross-arch library paths to avoid creating symlink
* lint
* clean up cross-arch makefile, skip the slow tests unless an environment variable is set
* correct compiler versions
* remove empty lines
* Makefile comment
* Add syscall to basic.c
* Increase performance
* Always run the tests
* lint
* initial PwndbgArchitecture
* pwndbg.aglib.arch refers to the PwndbgArchitecture instance
* Update pwndbg/aglib/arch.py
Co-authored-by: patryk4815 <bux.patryk@gmail.com>
* stuff
* Simplify setting the architecture, remove duplicated code
* ABI and SyscallABI now retrieved from the arch object
* lint
* fix syscall abi fetch
* rename
* lint
* Update pwndbg/aglib/arch.py
Co-authored-by: patryk4815 <bux.patryk@gmail.com>
* Update pwndbg/aglib/arch.py
Co-authored-by: patryk4815 <bux.patryk@gmail.com>
* Remove unused comment
* comment
* ABI fetch fix
* lint
* simplify sparc capstone constant
* Change how architectures are registered
* Ensure all uses of function abi/syscall abi have a check to see if they are not None
* More gracefully report error on unrecognized architectures
* Fix ABI function argument fetch
* remove old comment
* Add class for loongarch + s390x, add test to ensure all arches have a class defined
* Add variable 'max_instruction_size' to arch classes
* Rename mock arch to MockAmd64Arch
* Rebase
* Remove Protocol due to bug in __init__ in Python 3.10
* Remove name_raw, add ArchAttribute's + MIPS constants
* add @override decorator
* rebase
---------
Co-authored-by: patryk4815 <bux.patryk@gmail.com>
* Refactor DisassemblyAssistant so they can be used to share/track information between instructions being enhanced in the same pass
* Fix incorrect change in breakonconditionalbranch + add comment
* rebase
* Move disasm/__init__.py -> ../disassembly.py in order to avoid a circular import. Create central list of all DisassemblyAssistant's
* move disassembly.py file back to disasm folder
* Upgrade to Capstone V6
* Fix final bugs related to changes in metadata/shift encoding in Capstone v6. All tests pass
* rebase prep
* Update to Capstone v6 alpha 4
* lint
* Apply patch to fix nixos packaging
* Fix "set glibc 2.31" which got broken recently
I haven't tracked when it got broken, but we were setting a tuple for a string parameter.
It did not work on 2025.02.19 but worked on 2025.01.20.
I also added a testcase for this behavior now.
* Update glibc.py
* parameter pretty printing, improved help doc
* make var descriptions short (put it in help doc), define enumerations
* swap value and description column
* lint
* revert to ' for quoting, fix some tests
* golf the config a bit
* fix config filtering test
* lint
* tls: dump the tls address by default
Use a `dt tcbhead_t <tls_address>` if there is a `tcbhead_t`. If there
is not, use telescope to dump it
Refactor the tls tests and add some new ones based on the change.
* Update pwndbg/commands/tls.py
* Update pwndbg/commands/tls.py
* Update pwndbg/commands/tls.py
* Update tls.py
---------
Co-authored-by: Disconnect3d <dominik.b.czarnota@gmail.com>
* Expose list of breakpoint locations in aglib
The list of addresses with active breakpoints can be retrieved using `Debugger.breakpoint_locations()`.
* Highlight breakpoints in `nearpc` output
Addresses in the disassembly which have an active breakpoint attached to them
are prefixed using by `b+` and highlighted in red by default.
This can be configured using the new `highlight-breakpoints`, `nearpc-breakpoint`,
and `nearpc-breakpoint-color` theme config options.
* Fix `breakpoint_locations` on lldb
* Update tests/gdb-tests/tests/test_nearpc.py
* Refactor breakpoint prefix logic
* Account for leading space before prefix again
* Move prefix coloring and preparation outside loop
---------
Co-authored-by: Disconnect3d <dominik.b.czarnota@gmail.com>
* Reduce context shaking when quickly stepping
by reserving empty lines after the command prompt
* clarify the extra lines property
* add config option
* disable line-reservation for tests
* lint
We're now using `writelines` to output the context data which wasn't implemented
for the CallOutput redirection layer. Add a smoke test for that output redirection.
Refs #2654
* Allow dumpargs to format bit flags
If flags are supplied for a funciton in `functions_data.py`, the
`dumpargs` command can pretty-print the combination of flags used in the
call.
* Update format for flags arguments.
The format now includes the original integer value *and* the extracted
flag names (if any). A sample output would be `0x03 (FLAG_2|0x01)`.
* Fix lint
* Address review comments
* Remove import after rebase
---------
Co-authored-by: Loren Van Spronsen <lorenvs@google.com>
Co-authored-by: Disconnect3d <dominik.b.czarnota@gmail.com>
* Create an authoritative list of architectures that Pwndbg supports. Add test to ensure some important mappings exist - add i8086 pwnlib mapping
* make pwnlib mapping 'none' by default
* Update pwndbg/dbg/gdb/__init__.py
Co-authored-by: patryk4815 <bux.patryk@gmail.com>
* Update pwndbg/lib/arch.py
Co-authored-by: patryk4815 <bux.patryk@gmail.com>
* Update pwndbg/lib/arch.py
Co-authored-by: patryk4815 <bux.patryk@gmail.com>
* More type safety with the list of supported types, handle iwmmxt, iwmmxt2, and xscale manually
---------
Co-authored-by: patryk4815 <bux.patryk@gmail.com>
The output of the expressions section changes even when running `context` multiple times after each other. The output variables in GDB are counted up when reexecuting the watched commands for example. The other sections don't change their output. This caused the history to be extended infinitely when using `ctxp` while having a `cwatch` command executed.
Special case the `expressions` context section in the history handling to avoid reevaluating the watched commands/expressions while browsing the history. This doesn't add the context output to the history when the expressions VALUES change somehow like it is done for the other sections, but since we cannot know if gdb counted up their output variable names from $1 to $2 or the value changed, this is a compromise.
* Fix#2549: block config.<name> assignments
This commit blocks `config.<param> = <value>` assignments as they should be done via `config.<param>.value = <value>`
instead.
* Update config.py
* add .value
patryk4815
Matt.
Elijah Hauber
OBarronCS
jxuanli
Jason An
Allen Chang
Disconnect3d
k4lizen
Emanuele19
1anp3sk
Er3X
Thomas Leroy
davi
peace-maker
tesuji
Gaurav Verma
Kevin
Loren Van Spronsen
Tanmay R K
Richard Liu
CptGibbon
Aaron Adams