Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

added the got command to show fastly the state of the GOT table #79

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

added the got command to show fastly the state of the GOT table #79

wants to merge 3 commits into from

Conversation

degrigis
Copy link
Contributor

@degrigis degrigis commented Jun 5, 2016

Added the command "got" used to retrieve fastly the state of the GOT table.
It works for 32 and 64 binaries and also for PIE programs.

Example 64 bit - PIE OFF :
image

Example 64 bit - PIE ON:
image

Example 32 bit:
image

@anthraxx
Copy link

anthraxx commented Jun 5, 2016

This looks awesome, I did some tests and looks cool... just noticed a small detail:
under certain binaries i don't get any symbols printed for the GOT entries.
for example with my version of nmap i don't get any symbols explaining the pointers:

gdb-peda$ got
[...]
0x768570:   0x0042c386  0x00000000

however when i run readelf:

> readelf -r /usr/bin/nmap|grep 768570  
000000768570  00a600000007 R_X86_64_JUMP_SLO 0000000000000000 sleep@GLIBC_2.2.5 + 0

What do you think about not just relying on gdb and therefor purely relying on the x/wx command issued in line 4521: ea2d695#diff-c1c917467ee788f52846b75c797b9eb0R4521 or 4516: ea2d695#diff-c1c917467ee788f52846b75c797b9eb0R4516 but also propagate the readelf value contained in the f_line variable from line 4512: ea2d695#diff-c1c917467ee788f52846b75c797b9eb0R4512. This way we could always output some useful information about the got/plt entry even when gdb does not provide anything for the x/wx command.

This would always be rock solid when we don't get useful additions by GDB and could look somewhat like:

gdb-peda$ got
[...]
0x768570:   0x0042c386  0x00000000  sleep@GLIBC_2.2.5

@anthraxx
Copy link

anthraxx commented Jun 5, 2016

It would be cool if you can apply this patch in addition to yours to achieve the previous mentioned printing of the name:
https://github.com/anthraxx/peda/commit/aa63d4fa076036e8e735079a6bc8bb89cbd6ae06

Additionally there is a warning_msg function from the utils file to print warnings, please also update the pull request by changing those two warnings like:

https://github.com/anthraxx/peda/commit/7fb48563826724c0a896db34b72bf14ecaea31e5

degrigis added 2 commits June 6, 2016 20:24
Signed-off-by: degrigis <[email protected]>
@degrigis
Copy link
Contributor Author

degrigis commented Jun 6, 2016

Ok, I've got time to improve a little bit the output of the commands following your advice @anthraxx.

The situation now is the following:
image

image

I've re-used the information inside the f_line for the name and filtered a little bit the output from x/wx for both 32 and 64 bits to extract the addresses.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants