mirror of https://github.com/pwndbg/pwndbg.git
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
1.8 KiB
1.8 KiB
leakfind
usage: leakfind [-h] [-p [PAGE_NAME]] [-o [MAX_OFFSET]] [-d [MAX_DEPTH]]
[-s [STEP]] [--negative_offset [NEGATIVE_OFFSET]]
[address]
Attempt to find a leak chain given a starting address.
Scans memory near the given address, looks for pointers, and continues that process to attempt to find leaks.
Positional arguments
| Positional Argument | Help |
|---|---|
| address | Starting address to find a leak chain from (default: $sp) |
Optional arguments
| Short | Long | Help |
|---|---|---|
| -h | --help | show this help message and exit |
| -p | --page_name | Substring required to be part of the name of any found pages |
| -o | --max_offset | Max offset to add to addresses when looking for leak (default: 72) |
| -d | --max_depth | Maximum depth to follow pointers to (default: 4) |
| -s | --step | Step to add between pointers so they are considered. For example, if this is 4 it would only consider pointers at an offset divisible by 4 from the starting pointer (default: 1) |
| --negative_offset | Max negative offset to search before an address when looking for a leak (default: 0) |
Examples
pwndbg> leakfind $rsp --page_name=filename --max_offset=0x48 --max_depth=6.
This would look for any chains of leaks that point to a section in filename
which begin near $rsp, are never 0x48 bytes further from a known pointer,
and are a maximum length of 6.