.gdbinit 110 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228222922302231223222332234223522362237223822392240224122422243224422452246224722482249225022512252225322542255225622572258225922602261226222632264226522662267226822692270227122722273227422752276227722782279228022812282228322842285228622872288228922902291229222932294229522962297229822992300230123022303230423052306230723082309231023112312231323142315231623172318231923202321232223232324232523262327232823292330233123322333233423352336233723382339234023412342234323442345234623472348234923502351235223532354235523562357235823592360236123622363236423652366236723682369237023712372237323742375237623772378237923802381238223832384238523862387238823892390239123922393239423952396239723982399240024012402240324042405240624072408240924102411241224132414241524162417241824192420242124222423242424252426242724282429243024312432243324342435243624372438243924402441244224432444244524462447244824492450245124522453245424552456245724582459246024612462246324642465246624672468246924702471247224732474247524762477247824792480248124822483248424852486248724882489249024912492249324942495249624972498249925002501250225032504250525062507250825092510251125122513251425152516251725182519252025212522252325242525252625272528252925302531253225332534253525362537253825392540254125422543254425452546254725482549255025512552255325542555255625572558255925602561256225632564256525662567256825692570257125722573257425752576257725782579258025812582258325842585258625872588258925902591259225932594259525962597259825992600260126022603260426052606260726082609261026112612261326142615261626172618261926202621262226232624262526262627262826292630263126322633263426352636263726382639264026412642264326442645264626472648264926502651265226532654265526562657265826592660266126622663266426652666266726682669267026712672267326742675267626772678267926802681268226832684268526862687268826892690269126922693269426952696269726982699270027012702270327042705270627072708270927102711271227132714271527162717271827192720272127222723272427252726272727282729273027312732273327342735273627372738273927402741274227432744274527462747274827492750275127522753275427552756275727582759276027612762276327642765276627672768276927702771277227732774277527762777277827792780278127822783278427852786278727882789279027912792279327942795279627972798279928002801280228032804280528062807280828092810281128122813281428152816281728182819282028212822282328242825282628272828282928302831283228332834283528362837283828392840284128422843284428452846284728482849285028512852285328542855285628572858285928602861286228632864286528662867286828692870287128722873287428752876287728782879288028812882288328842885288628872888288928902891289228932894289528962897289828992900290129022903290429052906290729082909291029112912291329142915291629172918291929202921292229232924292529262927292829292930293129322933293429352936293729382939294029412942294329442945294629472948294929502951295229532954295529562957295829592960296129622963296429652966296729682969297029712972297329742975297629772978297929802981298229832984298529862987298829892990299129922993299429952996299729982999300030013002300330043005300630073008300930103011301230133014301530163017301830193020302130223023302430253026302730283029303030313032303330343035303630373038303930403041304230433044304530463047304830493050305130523053305430553056305730583059306030613062306330643065306630673068306930703071307230733074307530763077307830793080308130823083308430853086308730883089309030913092309330943095309630973098309931003101310231033104310531063107310831093110311131123113311431153116311731183119312031213122312331243125312631273128312931303131313231333134313531363137313831393140314131423143314431453146314731483149315031513152315331543155315631573158315931603161316231633164316531663167316831693170317131723173317431753176317731783179318031813182318331843185318631873188318931903191319231933194319531963197319831993200320132023203320432053206320732083209321032113212321332143215321632173218321932203221322232233224322532263227322832293230323132323233323432353236323732383239324032413242324332443245324632473248324932503251325232533254325532563257325832593260326132623263326432653266326732683269327032713272327332743275327632773278327932803281328232833284328532863287328832893290329132923293329432953296329732983299330033013302330333043305330633073308330933103311331233133314331533163317331833193320332133223323332433253326332733283329333033313332333333343335333633373338333933403341334233433344334533463347334833493350335133523353335433553356335733583359336033613362336333643365336633673368336933703371337233733374337533763377337833793380338133823383338433853386338733883389339033913392339333943395339633973398339934003401340234033404340534063407340834093410341134123413341434153416341734183419342034213422342334243425342634273428342934303431343234333434343534363437343834393440344134423443344434453446344734483449345034513452345334543455345634573458345934603461346234633464346534663467346834693470347134723473347434753476347734783479348034813482348334843485348634873488348934903491349234933494349534963497349834993500350135023503350435053506350735083509351035113512351335143515351635173518351935203521352235233524352535263527352835293530353135323533353435353536353735383539354035413542354335443545354635473548354935503551355235533554355535563557355835593560356135623563356435653566356735683569357035713572357335743575357635773578357935803581358235833584358535863587358835893590359135923593359435953596359735983599360036013602360336043605360636073608360936103611361236133614361536163617361836193620362136223623362436253626362736283629363036313632363336343635363636373638363936403641364236433644364536463647364836493650365136523653365436553656365736583659366036613662366336643665366636673668366936703671367236733674367536763677367836793680368136823683368436853686368736883689369036913692369336943695369636973698369937003701370237033704370537063707370837093710371137123713371437153716371737183719372037213722372337243725372637273728372937303731373237333734373537363737373837393740374137423743374437453746374737483749375037513752375337543755375637573758375937603761376237633764376537663767376837693770377137723773377437753776377737783779378037813782378337843785378637873788378937903791379237933794379537963797379837993800380138023803380438053806380738083809381038113812381338143815381638173818381938203821382238233824382538263827382838293830383138323833383438353836383738383839384038413842384338443845384638473848384938503851385238533854385538563857385838593860386138623863386438653866386738683869387038713872387338743875387638773878387938803881388238833884388538863887388838893890389138923893389438953896389738983899390039013902390339043905390639073908390939103911391239133914391539163917391839193920392139223923392439253926392739283929393039313932393339343935393639373938393939403941394239433944394539463947394839493950395139523953395439553956395739583959396039613962396339643965396639673968396939703971397239733974397539763977397839793980398139823983398439853986398739883989399039913992399339943995399639973998399940004001400240034004400540064007400840094010401140124013401440154016401740184019402040214022402340244025402640274028402940304031403240334034403540364037
  1. # INSTALL INSTRUCTIONS: save as ~/.gdbinit
  2. #
  3. # DESCRIPTION: A user-friendly gdb configuration file, for x86/x86_64 and ARM platforms.
  4. #
  5. # REVISION : 9.0 (23/06/2019)
  6. #
  7. # CONTRIBUTORS: mammon_, elaine, pusillus, mong, zhang le, l0kit,
  8. # truthix the cyberpunk, fG!, gln
  9. #
  10. # FEEDBACK: https://reverse.put.as - reverser@put.as
  11. # GITHUB: https://github.com/gdbinit/Gdbinit
  12. #
  13. # NOTES: 'help user' in gdb will list the commands/descriptions in this file
  14. # 'context on' now enables auto-display of context screen
  15. #
  16. # MAC OS X NOTES: If you are using this on Mac OS X, you must either attach gdb to a process
  17. # or launch gdb without any options and then load the binary file you want to analyse with "exec-file" option
  18. # If you load the binary from the command line, like $gdb binary-name, this will not work as it should
  19. # For more information, read it here https://reverse.put.as/2008/11/28/apples-gdb-bug/
  20. #
  21. # UPDATE: This bug can be fixed in gdb source. Refer to https://reverse.put.as/2009/08/10/fix-for-apples-gdb-bug-or-why-apple-forks-are-bad/
  22. # and https://reverse.put.as/2009/08/26/gdb-patches/ (if you want the fixed binary for i386)
  23. #
  24. # An updated version of the patch and binary is available at https://reverse.put.as/2011/02/21/update-to-gdb-patches-fix-a-new-bug/
  25. #
  26. # iOS NOTES: iOS gdb from Cydia (and Apple's) suffer from the same OS X bug.
  27. # If you are using this on Mac OS X or iOS, you must either attach gdb to a process
  28. # or launch gdb without any options and then load the binary file you want to analyse with "exec-file" option
  29. # If you load the binary from the command line, like $gdb binary-name, this will not work as it should
  30. # For more information, read it here https://reverse.put.as/2008/11/28/apples-gdb-bug/
  31. #
  32. # CHANGELOG: (older changes at the end of the file)
  33. #
  34. # Version 9.0
  35. # Fixes to make everything work with GNU/GDB 8.3+
  36. #
  37. # TODO:
  38. #
  39. # __________________gdb options_________________
  40. add-auto-load-safe-path ./.gdbinit
  41. set pagination 0
  42. set detach-on-fork off
  43. set follow-fork-mode child
  44. set thread apply all bt
  45. # set to 1 to have ARM target debugging as default, use the "arm" command to switch inside gdb
  46. set $ARM = 1
  47. # set to 0 if you have problems with the colorized prompt - reported by Plouj with Ubuntu gdb 7.2
  48. set $COLOREDPROMPT = 1
  49. # color the first line of the disassembly - default is green, if you want to change it search for
  50. # SETCOLOR1STLINE and modify it :-)
  51. set $SETCOLOR1STLINE = 0
  52. # set to 0 to remove disassembly display (useful for scripted commands mass dumping)
  53. set $SHOWDISASM = 1
  54. # set to 0 to remove display of objectivec messages (default is 1)
  55. set $SHOWOBJECTIVEC = 1
  56. # set to 0 to remove display of cpu registers (default is 1)
  57. set $SHOWCPUREGISTERS = 1
  58. # set to 1 to enable display of stack (default is 0)
  59. set $SHOWSTACK = 0
  60. # set to 1 to enable display of data window (default is 0)
  61. set $SHOWDATAWIN = 0
  62. # set to 0 to disable colored display of changed registers
  63. set $SHOWREGCHANGES = 1
  64. # set to 1 so skip command to execute the instruction at the new location
  65. # by default it EIP/RIP will be modified and update the new context but not execute the instruction
  66. set $SKIPEXECUTE = 0
  67. # if $SKIPEXECUTE is 1 configure the type of execution
  68. # 1 = use stepo (do not get into calls), 0 = use stepi (step into calls)
  69. set $SKIPSTEP = 1
  70. # show the ARM opcodes - change to 0 if you don't want such thing (in x/i command)
  71. set $ARMOPCODES = 0
  72. # x86 disassembly flavor: 0 for Intel, 1 for AT&T
  73. set $X86FLAVOR = 0
  74. # use colorized output or not
  75. set $USECOLOR = 1
  76. # to use with remote KDP
  77. set $KDP64BITS = -1
  78. set $64BITS = 0
  79. # macOS version works better with this setting off
  80. set startup-with-shell off
  81. set confirm off
  82. set verbose off
  83. set history filename ~/.gdb_history
  84. set history save
  85. set output-radix 0x10
  86. set input-radix 0x10
  87. # These make gdb never pause in its output
  88. set height 0
  89. set width 0
  90. set $SHOW_CONTEXT = 1
  91. set $SHOW_NEST_INSN = 0
  92. set $CONTEXTSIZE_STACK = 6
  93. set $CONTEXTSIZE_DATA = 8
  94. set $CONTEXTSIZE_CODE = 8
  95. # __________________end gdb options_________________
  96. #
  97. # __________________color functions_________________
  98. #
  99. # color codes
  100. set $BLACK = 0
  101. set $RED = 1
  102. set $GREEN = 2
  103. set $YELLOW = 3
  104. set $BLUE = 4
  105. set $MAGENTA = 5
  106. set $CYAN = 6
  107. set $WHITE = 7
  108. # CHANGME: If you want to modify the "theme" change the colors here
  109. # or just create a ~/.gdbinit.local and set these variables there
  110. set $COLOR_REGNAME = $GREEN
  111. set $COLOR_REGVAL = $BLACK
  112. set $COLOR_REGVAL_MODIFIED = $RED
  113. set $COLOR_SEPARATOR = $BLUE
  114. set $COLOR_CPUFLAGS = $RED
  115. # this is ugly but there's no else if available :-(
  116. define color
  117. if $USECOLOR == 1
  118. # BLACK
  119. if $arg0 == 0
  120. echo \033[30m
  121. else
  122. # RED
  123. if $arg0 == 1
  124. echo \[\e[0;31m\]
  125. else
  126. # GREEN
  127. if $arg0 == 2
  128. echo \033[32m
  129. else
  130. # YELLOW
  131. if $arg0 == 3
  132. echo \033[33m
  133. else
  134. # BLUE
  135. if $arg0 == 4
  136. echo \033[34m
  137. else
  138. # MAGENTA
  139. if $arg0 == 5
  140. echo \033[35m
  141. else
  142. # CYAN
  143. if $arg0 == 6
  144. echo \033[36m
  145. else
  146. # WHITE
  147. if $arg0 == 7
  148. echo \033[37m
  149. end
  150. end
  151. end
  152. end
  153. end
  154. end
  155. end
  156. end
  157. end
  158. end
  159. define color_reset
  160. if $USECOLOR == 1
  161. echo \033[0m
  162. end
  163. end
  164. define color_bold
  165. if $USECOLOR == 1
  166. #echo \033[1m
  167. echo \[\e[1m\]
  168. end
  169. end
  170. define color_underline
  171. if $USECOLOR == 1
  172. echo \033[4m
  173. end
  174. end
  175. # this way anyone can have their custom prompt - argp's idea :-)
  176. # can also be used to redefine anything else in particular the colors aka theming
  177. # just remap the color variables defined above
  178. source ~/.gdbinit.local
  179. # can't use the color functions because we are using the set command
  180. if $COLOREDPROMPT == 1
  181. set extended-prompt \[\e[0;31m\]gdb$ \[\e[0m\]
  182. end
  183. # Initialize these variables else comparisons will fail for coloring
  184. # we must initialize all of them at once, 32 and 64 bits, and ARM.
  185. set $oldrax = 0
  186. set $oldrbx = 0
  187. set $oldrcx = 0
  188. set $oldrdx = 0
  189. set $oldrsi = 0
  190. set $oldrdi = 0
  191. set $oldrbp = 0
  192. set $oldrsp = 0
  193. set $oldr8 = 0
  194. set $oldr9 = 0
  195. set $oldr10 = 0
  196. set $oldr11 = 0
  197. set $oldr12 = 0
  198. set $oldr13 = 0
  199. set $oldr14 = 0
  200. set $oldr15 = 0
  201. set $oldeax = 0
  202. set $oldebx = 0
  203. set $oldecx = 0
  204. set $oldedx = 0
  205. set $oldesi = 0
  206. set $oldedi = 0
  207. set $oldebp = 0
  208. set $oldesp = 0
  209. set $oldr0 = 0
  210. set $oldr1 = 0
  211. set $oldr2 = 0
  212. set $oldr3 = 0
  213. set $oldr4 = 0
  214. set $oldr5 = 0
  215. set $oldr6 = 0
  216. set $oldr7 = 0
  217. set $oldsp = 0
  218. set $oldlr = 0
  219. # used by ptraceme/rptraceme
  220. set $ptrace_bpnum = 0
  221. # ______________window size control___________
  222. define contextsize-stack
  223. if $argc != 1
  224. help contextsize-stack
  225. else
  226. set $CONTEXTSIZE_STACK = $arg0
  227. end
  228. end
  229. document contextsize-stack
  230. Syntax: contextsize-stack NUM
  231. | Set stack dump window size to NUM lines.
  232. end
  233. define contextsize-data
  234. if $argc != 1
  235. help contextsize-data
  236. else
  237. set $CONTEXTSIZE_DATA = $arg0
  238. end
  239. end
  240. document contextsize-data
  241. Syntax: contextsize-data NUM
  242. | Set data dump window size to NUM lines.
  243. end
  244. define contextsize-code
  245. if $argc != 1
  246. help contextsize-code
  247. else
  248. set $CONTEXTSIZE_CODE = $arg0
  249. end
  250. end
  251. document contextsize-code
  252. Syntax: contextsize-code NUM
  253. | Set code window size to NUM lines.
  254. end
  255. # _____________breakpoint aliases_____________
  256. define bpl
  257. info breakpoints
  258. end
  259. document bpl
  260. Syntax: bpl
  261. | List all breakpoints.
  262. end
  263. define bp
  264. if $argc != 1
  265. help bp
  266. else
  267. if $ASLR != 0
  268. break ($arg0 + $ASLR)
  269. else
  270. break $arg0
  271. end
  272. end
  273. end
  274. document bp
  275. Syntax: bp LOCATION
  276. | Set breakpoint.
  277. | LOCATION may be a line number, function name, or "*" and an address.
  278. | To break on a symbol you must enclose symbol name inside "".
  279. | Example:
  280. | bp "[NSControl stringValue]"
  281. | Or else you can use directly the break command (break [NSControl stringValue])
  282. end
  283. define bpc
  284. if $argc != 1
  285. help bpc
  286. else
  287. clear $arg0
  288. end
  289. end
  290. document bpc
  291. Syntax: bpc LOCATION
  292. | Clear breakpoint.
  293. | LOCATION may be a line number, function name, or "*" and an address.
  294. end
  295. define bpe
  296. if $argc != 1
  297. help bpe
  298. else
  299. enable $arg0
  300. end
  301. end
  302. document bpe
  303. Syntax: bpe NUM
  304. | Enable breakpoint with number NUM.
  305. end
  306. define bpd
  307. if $argc != 1
  308. help bpd
  309. else
  310. disable $arg0
  311. end
  312. end
  313. document bpd
  314. Syntax: bpd NUM
  315. | Disable breakpoint with number NUM.
  316. end
  317. define bpt
  318. if $argc != 1
  319. help bpt
  320. else
  321. tbreak $arg0
  322. end
  323. end
  324. document bpt
  325. Syntax: bpt LOCATION
  326. | Set a temporary breakpoint.
  327. | This breakpoint will be automatically deleted when hit!.
  328. | LOCATION may be a line number, function name, or "*" and an address.
  329. end
  330. define bpm
  331. if $argc != 1
  332. help bpm
  333. else
  334. awatch $arg0
  335. end
  336. end
  337. document bpm
  338. Syntax: bpm EXPRESSION
  339. | Set a read/write breakpoint on EXPRESSION, e.g. *address.
  340. end
  341. define bhb
  342. if $argc != 1
  343. help bhb
  344. else
  345. hb $arg0
  346. end
  347. end
  348. document bhb
  349. Syntax: bhb LOCATION
  350. | Set hardware assisted breakpoint.
  351. | LOCATION may be a line number, function name, or "*" and an address.
  352. end
  353. define bht
  354. if $argc != 1
  355. help bht
  356. else
  357. thbreak $arg0
  358. end
  359. end
  360. document bht
  361. Usage: bht LOCATION
  362. | Set a temporary hardware breakpoint.
  363. | This breakpoint will be automatically deleted when hit!
  364. | LOCATION may be a line number, function name, or "*" and an address.
  365. end
  366. # ______________process information____________
  367. define argv
  368. show args
  369. end
  370. document argv
  371. Syntax: argv
  372. | Print program arguments.
  373. end
  374. define stack
  375. if $argc == 0
  376. info stack
  377. end
  378. if $argc == 1
  379. info stack $arg0
  380. end
  381. if $argc > 1
  382. help stack
  383. end
  384. end
  385. document stack
  386. Syntax: stack <COUNT>
  387. | Print backtrace of the call stack, or innermost COUNT frames.
  388. end
  389. define frame
  390. info frame
  391. info args
  392. info locals
  393. end
  394. document frame
  395. Syntax: frame
  396. | Print stack frame.
  397. end
  398. define flagsarm
  399. # conditional flags are
  400. # negative/less than (N), bit 31 of CPSR
  401. # zero (Z), bit 30
  402. # Carry/Borrow/Extend (C), bit 29
  403. # Overflow (V), bit 28
  404. # negative/less than (N), bit 31 of CPSR
  405. if (($cpsr >> 0x1f) & 1)
  406. printf "N "
  407. set $_n_flag = 1
  408. else
  409. printf "n "
  410. set $_n_flag = 0
  411. end
  412. # zero (Z), bit 30
  413. if (($cpsr >> 0x1e) & 1)
  414. printf "Z "
  415. set $_z_flag = 1
  416. else
  417. printf "z "
  418. set $_z_flag = 0
  419. end
  420. # Carry/Borrow/Extend (C), bit 29
  421. if (($cpsr >> 0x1d) & 1)
  422. printf "C "
  423. set $_c_flag = 1
  424. else
  425. printf "c "
  426. set $_c_flag = 0
  427. end
  428. # Overflow (V), bit 28
  429. if (($cpsr >> 0x1c) & 1)
  430. printf "V "
  431. set $_v_flag = 1
  432. else
  433. printf "v "
  434. set $_v_flag = 0
  435. end
  436. # Sticky overflow (Q), bit 27
  437. if (($cpsr >> 0x1b) & 1)
  438. printf "Q "
  439. set $_q_flag = 1
  440. else
  441. printf "q "
  442. set $_q_flag = 0
  443. end
  444. # Java state bit (J), bit 24
  445. # When T=1:
  446. # J = 0 The processor is in Thumb state.
  447. # J = 1 The processor is in ThumbEE state.
  448. if (($cpsr >> 0x18) & 1)
  449. printf "J "
  450. set $_j_flag = 1
  451. else
  452. printf "j "
  453. set $_j_flag = 0
  454. end
  455. # Data endianness bit (E), bit 9
  456. if (($cpsr >> 9) & 1)
  457. printf "E "
  458. set $_e_flag = 1
  459. else
  460. printf "e "
  461. set $_e_flag = 0
  462. end
  463. # Imprecise abort disable bit (A), bit 8
  464. # The A bit is set to 1 automatically. It is used to disable imprecise data aborts.
  465. # It might not be writable in the Nonsecure state if the AW bit in the SCR register is reset.
  466. if (($cpsr >> 8) & 1)
  467. printf "A "
  468. set $_a_flag = 1
  469. else
  470. printf "a "
  471. set $_a_flag = 0
  472. end
  473. # IRQ disable bit (I), bit 7
  474. # When the I bit is set to 1, IRQ interrupts are disabled.
  475. if (($cpsr >> 7) & 1)
  476. printf "I "
  477. set $_i_flag = 1
  478. else
  479. printf "i "
  480. set $_i_flag = 0
  481. end
  482. # FIQ disable bit (F), bit 6
  483. # When the F bit is set to 1, FIQ interrupts are disabled.
  484. # FIQ can be nonmaskable in the Nonsecure state if the FW bit in SCR register is reset.
  485. if (($cpsr >> 6) & 1)
  486. printf "F "
  487. set $_f_flag = 1
  488. else
  489. printf "f "
  490. set $_f_flag = 0
  491. end
  492. # Thumb state bit (F), bit 5
  493. # if 1 then the processor is executing in Thumb state or ThumbEE state depending on the J bit
  494. if (($cpsr >> 5) & 1)
  495. printf "T "
  496. set $_t_flag = 1
  497. else
  498. printf "t "
  499. set $_t_flag = 0
  500. end
  501. # TODO: GE bit ?
  502. end
  503. document flagsarm
  504. Syntax: flagsarm
  505. | Auxiliary function to set ARM cpu flags.
  506. end
  507. define flagsx86
  508. # OF (overflow) flag
  509. if (((unsigned int)$eflags >> 0xB) & 1)
  510. printf "O "
  511. set $_of_flag = 1
  512. else
  513. printf "o "
  514. set $_of_flag = 0
  515. end
  516. # DF (direction) flag
  517. if (((unsigned int)$eflags >> 0xA) & 1)
  518. printf "D "
  519. else
  520. printf "d "
  521. end
  522. # IF (interrupt enable) flag
  523. if (((unsigned int)$eflags >> 9) & 1)
  524. printf "I "
  525. else
  526. printf "i "
  527. end
  528. # TF (trap) flag
  529. if (((unsigned int)$eflags >> 8) & 1)
  530. printf "T "
  531. else
  532. printf "t "
  533. end
  534. # SF (sign) flag
  535. if (((unsigned int)$eflags >> 7) & 1)
  536. printf "S "
  537. set $_sf_flag = 1
  538. else
  539. printf "s "
  540. set $_sf_flag = 0
  541. end
  542. # ZF (zero) flag
  543. if (((unsigned int)$eflags >> 6) & 1)
  544. printf "Z "
  545. set $_zf_flag = 1
  546. else
  547. printf "z "
  548. set $_zf_flag = 0
  549. end
  550. # AF (adjust) flag
  551. if (((unsigned int)$eflags >> 4) & 1)
  552. printf "A "
  553. else
  554. printf "a "
  555. end
  556. # PF (parity) flag
  557. if (((unsigned int)$eflags >> 2) & 1)
  558. printf "P "
  559. set $_pf_flag = 1
  560. else
  561. printf "p "
  562. set $_pf_flag = 0
  563. end
  564. # CF (carry) flag
  565. if ((unsigned int)$eflags & 1)
  566. printf "C "
  567. set $_cf_flag = 1
  568. else
  569. printf "c "
  570. set $_cf_flag = 0
  571. end
  572. printf "\n"
  573. end
  574. document flagsx86
  575. Syntax: flagsx86
  576. | Auxiliary function to set X86/X64 cpu flags.
  577. end
  578. define flags
  579. # call the auxiliary functions based on target cpu
  580. if $ARM == 1
  581. flagsarm
  582. else
  583. flagsx86
  584. end
  585. end
  586. document flags
  587. Syntax: flags
  588. | Print flags register.
  589. end
  590. define eflags
  591. if $ARM == 1
  592. # http://www.heyrick.co.uk/armwiki/The_Status_register
  593. printf " N <%d> Z <%d> C <%d> V <%d>",\
  594. (($cpsr >> 0x1f) & 1), (($cpsr >> 0x1e) & 1), \
  595. (($cpsr >> 0x1d) & 1), (($cpsr >> 0x1c) & 1)
  596. printf " Q <%d> J <%d> GE <%d> E <%d> A <%d>",\
  597. (($cpsr >> 0x1b) & 1), (($cpsr >> 0x18) & 1),\
  598. (($cpsr >> 0x10) & 7), (($cpsr >> 9) & 1), (($cpsr >> 8) & 1)
  599. printf " I <%d> F <%d> T <%d> \n",\
  600. (($cpsr >> 7) & 1), (($cpsr >> 6) & 1), \
  601. (($cpsr >> 5) & 1)
  602. else
  603. printf " OF <%d> DF <%d> IF <%d> TF <%d>",\
  604. (((unsigned int)$eflags >> 0xB) & 1), (((unsigned int)$eflags >> 0xA) & 1), \
  605. (((unsigned int)$eflags >> 9) & 1), (((unsigned int)$eflags >> 8) & 1)
  606. printf " SF <%d> ZF <%d> AF <%d> PF <%d> CF <%d>\n",\
  607. (((unsigned int)$eflags >> 7) & 1), (((unsigned int)$eflags >> 6) & 1),\
  608. (((unsigned int)$eflags >> 4) & 1), (((unsigned int)$eflags >> 2) & 1), ((unsigned int)$eflags & 1)
  609. printf " ID <%d> VIP <%d> VIF <%d> AC <%d>",\
  610. (((unsigned int)$eflags >> 0x15) & 1), (((unsigned int)$eflags >> 0x14) & 1), \
  611. (((unsigned int)$eflags >> 0x13) & 1), (((unsigned int)$eflags >> 0x12) & 1)
  612. printf " VM <%d> RF <%d> NT <%d> IOPL <%d>\n",\
  613. (((unsigned int)$eflags >> 0x11) & 1), (((unsigned int)$eflags >> 0x10) & 1),\
  614. (((unsigned int)$eflags >> 0xE) & 1), (((unsigned int)$eflags >> 0xC) & 3)
  615. end
  616. end
  617. document eflags
  618. Syntax: eflags
  619. | Print eflags register.
  620. end
  621. define cpsr
  622. eflags
  623. end
  624. document cpsr
  625. Syntax: cpsr
  626. | Print cpsr register.
  627. end
  628. define regarm
  629. printf " "
  630. # R0
  631. color $COLOR_REGNAME
  632. printf "R0:"
  633. if ($r0 != $oldr0 && $SHOWREGCHANGES == 1)
  634. color $COLOR_REGVAL_MODIFIED
  635. else
  636. color $COLOR_REGVAL
  637. end
  638. printf " 0x%08X ", $r0
  639. # R1
  640. color $COLOR_REGNAME
  641. printf "R1:"
  642. if ($r1 != $oldr1 && $SHOWREGCHANGES == 1)
  643. color $COLOR_REGVAL_MODIFIED
  644. else
  645. color $COLOR_REGVAL
  646. end
  647. printf " 0x%08X ", $r1
  648. # R2
  649. color $COLOR_REGNAME
  650. printf "R2:"
  651. if ($r2 != $oldr2 && $SHOWREGCHANGES == 1)
  652. color $COLOR_REGVAL_MODIFIED
  653. else
  654. color $COLOR_REGVAL
  655. end
  656. printf " 0x%08X ", $r2
  657. # R3
  658. color $COLOR_REGNAME
  659. printf "R3:"
  660. if ($r3 != $oldr3 && $SHOWREGCHANGES == 1)
  661. color $COLOR_REGVAL_MODIFIED
  662. else
  663. color $COLOR_REGVAL
  664. end
  665. printf " 0x%08X\n", $r3
  666. printf " "
  667. # R4
  668. color $COLOR_REGNAME
  669. printf "R4:"
  670. if ($r4 != $oldr4 && $SHOWREGCHANGES == 1)
  671. color $COLOR_REGVAL_MODIFIED
  672. else
  673. color $COLOR_REGVAL
  674. end
  675. printf " 0x%08X ", $r4
  676. # R5
  677. color $COLOR_REGNAME
  678. printf "R5:"
  679. if ($r5 != $oldr5 && $SHOWREGCHANGES == 1)
  680. color $COLOR_REGVAL_MODIFIED
  681. else
  682. color $COLOR_REGVAL
  683. end
  684. printf " 0x%08X ", $r5
  685. # R6
  686. color $COLOR_REGNAME
  687. printf "R6:"
  688. if ($r6 != $oldr6 && $SHOWREGCHANGES == 1)
  689. color $COLOR_REGVAL_MODIFIED
  690. else
  691. color $COLOR_REGVAL
  692. end
  693. printf " 0x%08X ", $r6
  694. # R7
  695. color $COLOR_REGNAME
  696. printf "R7:"
  697. if ($r7 != $oldr7 && $SHOWREGCHANGES == 1)
  698. color $COLOR_REGVAL_MODIFIED
  699. else
  700. color $COLOR_REGVAL
  701. end
  702. printf " 0x%08X\n", $r7
  703. printf " "
  704. # R8
  705. color $COLOR_REGNAME
  706. printf "R8:"
  707. if ($r8 != $oldr8 && $SHOWREGCHANGES == 1)
  708. color $COLOR_REGVAL_MODIFIED
  709. else
  710. color $COLOR_REGVAL
  711. end
  712. printf " 0x%08X ", $r8
  713. # R9
  714. color $COLOR_REGNAME
  715. printf "R9:"
  716. if ($r9 != $oldr9 && $SHOWREGCHANGES == 1)
  717. color $COLOR_REGVAL_MODIFIED
  718. else
  719. color $COLOR_REGVAL
  720. end
  721. printf " 0x%08X ", $r9
  722. # R10
  723. color $COLOR_REGNAME
  724. printf "R10:"
  725. if ($r10 != $oldr10 && $SHOWREGCHANGES == 1)
  726. color $COLOR_REGVAL_MODIFIED
  727. else
  728. color $COLOR_REGVAL
  729. end
  730. printf " 0x%08X ", $r10
  731. # R11
  732. color $COLOR_REGNAME
  733. printf "R11:"
  734. if ($r11 != $oldr11 && $SHOWREGCHANGES == 1)
  735. color $COLOR_REGVAL_MODIFIED
  736. else
  737. color $COLOR_REGVAL
  738. end
  739. printf " 0x%08X ", $r11
  740. dumpjump
  741. printf "\n"
  742. # R12
  743. color $COLOR_REGNAME
  744. printf " R12:"
  745. if ($r12 != $oldr12 && $SHOWREGCHANGES == 1)
  746. color $COLOR_REGVAL_MODIFIED
  747. else
  748. color $COLOR_REGVAL
  749. end
  750. printf " 0x%08X", $r12
  751. printf " "
  752. # SP
  753. color $COLOR_REGNAME
  754. printf "SP:"
  755. if ($sp != $oldsp && $SHOWREGCHANGES == 1)
  756. color $COLOR_REGVAL_MODIFIED
  757. else
  758. color $COLOR_REGVAL
  759. end
  760. printf " 0x%08X ", $sp
  761. # LR
  762. color $COLOR_REGNAME
  763. printf "LR:"
  764. if ($lr != $oldlr && $SHOWREGCHANGES == 1)
  765. color $COLOR_REGVAL_MODIFIED
  766. else
  767. color $COLOR_REGVAL
  768. end
  769. printf " 0x%08X ", $lr
  770. # PC
  771. color $COLOR_REGNAME
  772. printf "PC:"
  773. color $COLOR_REGVAL_MODIFIED
  774. printf " 0x%08X ", $pc
  775. color_bold
  776. color_underline
  777. color $COLOR_CPUFLAGS
  778. flags
  779. color_reset
  780. printf "\n"
  781. end
  782. document regarm
  783. Syntax: regarm
  784. | Auxiliary function to display ARM registers.
  785. end
  786. define regx64
  787. # 64bits stuff
  788. printf " "
  789. # RAX
  790. color $COLOR_REGNAME
  791. printf "RAX:"
  792. if ($rax != $oldrax && $SHOWREGCHANGES == 1)
  793. color $COLOR_REGVAL_MODIFIED
  794. else
  795. color $COLOR_REGVAL
  796. end
  797. printf " 0x%016lX ", $rax
  798. # RBX
  799. color $COLOR_REGNAME
  800. printf "RBX:"
  801. if ($rbx != $oldrbx && $SHOWREGCHANGES == 1)
  802. color $COLOR_REGVAL_MODIFIED
  803. else
  804. color $COLOR_REGVAL
  805. end
  806. printf " 0x%016lX ", $rbx
  807. # RBP
  808. color $COLOR_REGNAME
  809. printf "RBP:"
  810. if ($rbp != $oldrbp && $SHOWREGCHANGES == 1)
  811. color $COLOR_REGVAL_MODIFIED
  812. else
  813. color $COLOR_REGVAL
  814. end
  815. printf " 0x%016lX ", $rbp
  816. # RSP
  817. color $COLOR_REGNAME
  818. printf "RSP:"
  819. if ($rsp != $oldrsp && $SHOWREGCHANGES == 1)
  820. color $COLOR_REGVAL_MODIFIED
  821. else
  822. color $COLOR_REGVAL
  823. end
  824. printf " 0x%016lX ", $rsp
  825. color_bold
  826. color_underline
  827. color $COLOR_CPUFLAGS
  828. flags
  829. color_reset
  830. printf " "
  831. # RDI
  832. color $COLOR_REGNAME
  833. printf "RDI:"
  834. if ($rdi != $oldrdi && $SHOWREGCHANGES == 1)
  835. color $COLOR_REGVAL_MODIFIED
  836. else
  837. color $COLOR_REGVAL
  838. end
  839. printf " 0x%016lX ", $rdi
  840. # RSI
  841. color $COLOR_REGNAME
  842. printf "RSI:"
  843. if ($rsi != $oldrsi && $SHOWREGCHANGES == 1)
  844. color $COLOR_REGVAL_MODIFIED
  845. else
  846. color $COLOR_REGVAL
  847. end
  848. printf " 0x%016lX ", $rsi
  849. # RDX
  850. color $COLOR_REGNAME
  851. printf "RDX:"
  852. if ($rdx != $oldrdx && $SHOWREGCHANGES == 1)
  853. color $COLOR_REGVAL_MODIFIED
  854. else
  855. color $COLOR_REGVAL
  856. end
  857. printf " 0x%016lX ", $rdx
  858. # RCX
  859. color $COLOR_REGNAME
  860. printf "RCX:"
  861. if ($rcx != $oldrcx && $SHOWREGCHANGES == 1)
  862. color $COLOR_REGVAL_MODIFIED
  863. else
  864. color $COLOR_REGVAL
  865. end
  866. printf " 0x%016lX ", $rcx
  867. # RIP
  868. color $COLOR_REGNAME
  869. printf "RIP:"
  870. color $COLOR_REGVAL_MODIFIED
  871. printf " 0x%016lX\n ", $rip
  872. # R8
  873. color $COLOR_REGNAME
  874. printf "R8 :"
  875. if ($r8 != $oldr8 && $SHOWREGCHANGES == 1)
  876. color $COLOR_REGVAL_MODIFIED
  877. else
  878. color $COLOR_REGVAL
  879. end
  880. printf " 0x%016lX ", $r8
  881. # R9
  882. color $COLOR_REGNAME
  883. printf "R9 :"
  884. if ($r9 != $oldr9 && $SHOWREGCHANGES == 1)
  885. color $COLOR_REGVAL_MODIFIED
  886. else
  887. color $COLOR_REGVAL
  888. end
  889. printf " 0x%016lX ", $r9
  890. # R10
  891. color $COLOR_REGNAME
  892. printf "R10:"
  893. if ($r10 != $oldr10 && $SHOWREGCHANGES == 1)
  894. color $COLOR_REGVAL_MODIFIED
  895. else
  896. color $COLOR_REGVAL
  897. end
  898. printf " 0x%016lX ", $r10
  899. # R11
  900. color $COLOR_REGNAME
  901. printf "R11:"
  902. if ($r11 != $oldr11 && $SHOWREGCHANGES == 1)
  903. color $COLOR_REGVAL_MODIFIED
  904. else
  905. color $COLOR_REGVAL
  906. end
  907. printf " 0x%016lX ", $r11
  908. # R12
  909. color $COLOR_REGNAME
  910. printf "R12:"
  911. if ($r12 != $oldr12 && $SHOWREGCHANGES == 1)
  912. color $COLOR_REGVAL_MODIFIED
  913. else
  914. color $COLOR_REGVAL
  915. end
  916. printf " 0x%016lX\n ", $r12
  917. # R13
  918. color $COLOR_REGNAME
  919. printf "R13:"
  920. if ($r13 != $oldr13 && $SHOWREGCHANGES == 1)
  921. color $COLOR_REGVAL_MODIFIED
  922. else
  923. color $COLOR_REGVAL
  924. end
  925. printf " 0x%016lX ", $r13
  926. # R14
  927. color $COLOR_REGNAME
  928. printf "R14:"
  929. if ($r14 != $oldr14 && $SHOWREGCHANGES == 1)
  930. color $COLOR_REGVAL_MODIFIED
  931. else
  932. color $COLOR_REGVAL
  933. end
  934. printf " 0x%016lX ", $r14
  935. # R15
  936. color $COLOR_REGNAME
  937. printf "R15:"
  938. if ($r15 != $oldr15 && $SHOWREGCHANGES == 1)
  939. color $COLOR_REGVAL_MODIFIED
  940. else
  941. color $COLOR_REGVAL
  942. end
  943. printf " 0x%016lX\n ", $r15
  944. color $COLOR_REGNAME
  945. printf "CS:"
  946. color $COLOR_REGVAL
  947. printf " %04X ", $cs
  948. color $COLOR_REGNAME
  949. printf "DS:"
  950. color $COLOR_REGVAL
  951. printf " %04X ", $ds
  952. color $COLOR_REGNAME
  953. printf "ES:"
  954. color $COLOR_REGVAL
  955. printf " %04X ", $es
  956. color $COLOR_REGNAME
  957. printf "FS:"
  958. color $COLOR_REGVAL
  959. printf " %04X ", $fs
  960. color $COLOR_REGNAME
  961. printf "GS:"
  962. color $COLOR_REGVAL
  963. printf " %04X ", $gs
  964. color $COLOR_REGNAME
  965. printf "SS:"
  966. color $COLOR_REGVAL
  967. printf " %04X", $ss
  968. color_reset
  969. end
  970. document regx64
  971. Syntax: regx64
  972. | Auxiliary function to display X86_64 registers.
  973. end
  974. define regx86
  975. printf " "
  976. # EAX
  977. color $COLOR_REGNAME
  978. printf "EAX:"
  979. if ($eax != $oldeax && $SHOWREGCHANGES == 1)
  980. color $COLOR_REGVAL_MODIFIED
  981. else
  982. color $COLOR_REGVAL
  983. end
  984. printf " 0x%08X ", $eax
  985. # EBX
  986. color $COLOR_REGNAME
  987. printf "EBX:"
  988. if ($ebx != $oldebx && $SHOWREGCHANGES == 1)
  989. color $COLOR_REGVAL_MODIFIED
  990. else
  991. color $COLOR_REGVAL
  992. end
  993. printf " 0x%08X ", $ebx
  994. # ECX
  995. color $COLOR_REGNAME
  996. printf "ECX:"
  997. if ($ecx != $oldecx && $SHOWREGCHANGES == 1)
  998. color $COLOR_REGVAL_MODIFIED
  999. else
  1000. color $COLOR_REGVAL
  1001. end
  1002. printf " 0x%08X ", $ecx
  1003. # EDX
  1004. color $COLOR_REGNAME
  1005. printf "EDX:"
  1006. if ($edx != $oldedx && $SHOWREGCHANGES == 1)
  1007. color $COLOR_REGVAL_MODIFIED
  1008. else
  1009. color $COLOR_REGVAL
  1010. end
  1011. printf " 0x%08X ", $edx
  1012. color_bold
  1013. color_underline
  1014. color $COLOR_CPUFLAGS
  1015. flags
  1016. color_reset
  1017. printf " "
  1018. # ESI
  1019. color $COLOR_REGNAME
  1020. printf "ESI:"
  1021. if ($esi != $oldesi && $SHOWREGCHANGES == 1)
  1022. color $COLOR_REGVAL_MODIFIED
  1023. else
  1024. color $COLOR_REGVAL
  1025. end
  1026. printf " 0x%08X ", $esi
  1027. # EDI
  1028. color $COLOR_REGNAME
  1029. printf "EDI:"
  1030. if ($edi != $oldedi && $SHOWREGCHANGES == 1)
  1031. color $COLOR_REGVAL_MODIFIED
  1032. else
  1033. color $COLOR_REGVAL
  1034. end
  1035. printf " 0x%08X ", $edi
  1036. # EBP
  1037. color $COLOR_REGNAME
  1038. printf "EBP:"
  1039. if ($ebp != $oldebp && $SHOWREGCHANGES == 1)
  1040. color $COLOR_REGVAL_MODIFIED
  1041. else
  1042. color $COLOR_REGVAL
  1043. end
  1044. printf " 0x%08X ", $ebp
  1045. # ESP
  1046. color $COLOR_REGNAME
  1047. printf "ESP:"
  1048. if ($esp != $oldesp && $SHOWREGCHANGES == 1)
  1049. color $COLOR_REGVAL_MODIFIED
  1050. else
  1051. color $COLOR_REGVAL
  1052. end
  1053. printf " 0x%08X ", $esp
  1054. # EIP
  1055. color $COLOR_REGNAME
  1056. printf "EIP:"
  1057. color $COLOR_REGVAL_MODIFIED
  1058. printf " 0x%08X\n ", $eip
  1059. color $COLOR_REGNAME
  1060. printf "CS:"
  1061. color $COLOR_REGVAL
  1062. printf " %04X ", $cs
  1063. color $COLOR_REGNAME
  1064. printf "DS:"
  1065. color $COLOR_REGVAL
  1066. printf " %04X ", $ds
  1067. color $COLOR_REGNAME
  1068. printf "ES:"
  1069. color $COLOR_REGVAL
  1070. printf " %04X ", $es
  1071. color $COLOR_REGNAME
  1072. printf "FS:"
  1073. color $COLOR_REGVAL
  1074. printf " %04X ", $fs
  1075. color $COLOR_REGNAME
  1076. printf "GS:"
  1077. color $COLOR_REGVAL
  1078. printf " %04X ", $gs
  1079. color $COLOR_REGNAME
  1080. printf "SS:"
  1081. color $COLOR_REGVAL
  1082. printf " %04X", $ss
  1083. color_reset
  1084. end
  1085. document regx86
  1086. Syntax: regx86
  1087. | Auxiliary function to display X86 registers.
  1088. end
  1089. define reg
  1090. if $ARM == 1
  1091. regarm
  1092. if ($SHOWREGCHANGES == 1)
  1093. set $oldr0 = $r0
  1094. set $oldr1 = $r1
  1095. set $oldr2 = $r2
  1096. set $oldr3 = $r3
  1097. set $oldr4 = $r4
  1098. set $oldr5 = $r5
  1099. set $oldr6 = $r6
  1100. set $oldr7 = $r7
  1101. set $oldr8 = $r8
  1102. set $oldr9 = $r9
  1103. set $oldr10 = $r10
  1104. set $oldr11 = $r11
  1105. set $oldr12 = $r12
  1106. set $oldsp = $sp
  1107. set $oldlr = $lr
  1108. end
  1109. else
  1110. if ($64BITS == 1)
  1111. regx64
  1112. else
  1113. regx86
  1114. end
  1115. # call smallregisters
  1116. smallregisters
  1117. # display conditional jump routine
  1118. if ($64BITS == 1)
  1119. printf "\t\t\t\t"
  1120. end
  1121. dumpjump
  1122. printf "\n"
  1123. if ($SHOWREGCHANGES == 1)
  1124. if ($64BITS == 1)
  1125. set $oldrax = $rax
  1126. set $oldrbx = $rbx
  1127. set $oldrcx = $rcx
  1128. set $oldrdx = $rdx
  1129. set $oldrsi = $rsi
  1130. set $oldrdi = $rdi
  1131. set $oldrbp = $rbp
  1132. set $oldrsp = $rsp
  1133. set $oldr8 = $r8
  1134. set $oldr9 = $r9
  1135. set $oldr10 = $r10
  1136. set $oldr11 = $r11
  1137. set $oldr12 = $r12
  1138. set $oldr13 = $r13
  1139. set $oldr14 = $r14
  1140. set $oldr15 = $r15
  1141. else
  1142. set $oldeax = $eax
  1143. set $oldebx = $ebx
  1144. set $oldecx = $ecx
  1145. set $oldedx = $edx
  1146. set $oldesi = $esi
  1147. set $oldedi = $edi
  1148. set $oldebp = $ebp
  1149. set $oldesp = $esp
  1150. end
  1151. end
  1152. end
  1153. end
  1154. document reg
  1155. Syntax: reg
  1156. | Print CPU registers.
  1157. end
  1158. define smallregisters
  1159. if ($64BITS == 1)
  1160. #64bits stuff
  1161. # from rax
  1162. set $eax = $rax & 0xffffffff
  1163. set $ax = $rax & 0xffff
  1164. set $al = $ax & 0xff
  1165. set $ah = $ax >> 8
  1166. # from rbx
  1167. set $ebx = $rbx & 0xffffffff
  1168. set $bx = $rbx & 0xffff
  1169. set $bl = $bx & 0xff
  1170. set $bh = $bx >> 8
  1171. # from rcx
  1172. set $ecx = $rcx & 0xffffffff
  1173. set $cx = $rcx & 0xffff
  1174. set $cl = $cx & 0xff
  1175. set $ch = $cx >> 8
  1176. # from rdx
  1177. set $edx = $rdx & 0xffffffff
  1178. set $dx = $rdx & 0xffff
  1179. set $dl = $dx & 0xff
  1180. set $dh = $dx >> 8
  1181. # from rsi
  1182. set $esi = $rsi & 0xffffffff
  1183. set $si = $rsi & 0xffff
  1184. # from rdi
  1185. set $edi = $rdi & 0xffffffff
  1186. set $di = $rdi & 0xffff
  1187. #32 bits stuff
  1188. else
  1189. # from eax
  1190. set $ax = $eax & 0xffff
  1191. set $al = $ax & 0xff
  1192. set $ah = $ax >> 8
  1193. # from ebx
  1194. set $bx = $ebx & 0xffff
  1195. set $bl = $bx & 0xff
  1196. set $bh = $bx >> 8
  1197. # from ecx
  1198. set $cx = $ecx & 0xffff
  1199. set $cl = $cx & 0xff
  1200. set $ch = $cx >> 8
  1201. # from edx
  1202. set $dx = $edx & 0xffff
  1203. set $dl = $dx & 0xff
  1204. set $dh = $dx >> 8
  1205. # from esi
  1206. set $si = $esi & 0xffff
  1207. # from edi
  1208. set $di = $edi & 0xffff
  1209. end
  1210. end
  1211. document smallregisters
  1212. Syntax: smallregisters
  1213. | Create the 16 and 8 bit cpu registers (gdb doesn't have them by default).
  1214. | And 32bits if we are dealing with 64bits binaries.
  1215. end
  1216. define func
  1217. if $argc == 0
  1218. info functions
  1219. end
  1220. if $argc == 1
  1221. info functions $arg0
  1222. end
  1223. if $argc > 1
  1224. help func
  1225. end
  1226. end
  1227. document func
  1228. Syntax: func <REGEXP>
  1229. | Print all function names in target, or those matching REGEXP.
  1230. end
  1231. define var
  1232. if $argc == 0
  1233. info variables
  1234. end
  1235. if $argc == 1
  1236. info variables $arg0
  1237. end
  1238. if $argc > 1
  1239. help var
  1240. end
  1241. end
  1242. document var
  1243. Syntax: var <REGEXP>
  1244. | Print all global and static variable names (symbols), or those matching REGEXP.
  1245. end
  1246. define lib
  1247. info sharedlibrary
  1248. end
  1249. document lib
  1250. Syntax: lib
  1251. | Print shared libraries linked to target.
  1252. end
  1253. define sig
  1254. if $argc == 0
  1255. info signals
  1256. end
  1257. if $argc == 1
  1258. info signals $arg0
  1259. end
  1260. if $argc > 1
  1261. help sig
  1262. end
  1263. end
  1264. document sig
  1265. Syntax: sig <SIGNAL>
  1266. | Print what debugger does when program gets various signals.
  1267. | Specify a SIGNAL as argument to print info on that signal only.
  1268. end
  1269. define threads
  1270. info threads
  1271. end
  1272. document threads
  1273. Syntax: threads
  1274. | Print threads in target.
  1275. end
  1276. define dis
  1277. if $argc == 0
  1278. disassemble
  1279. end
  1280. if $argc == 1
  1281. disassemble $arg0
  1282. end
  1283. if $argc == 2
  1284. disassemble $arg0 $arg1
  1285. end
  1286. if $argc > 2
  1287. help dis
  1288. end
  1289. end
  1290. document dis
  1291. Syntax: dis <ADDR1> <ADDR2>
  1292. | Disassemble a specified section of memory.
  1293. | Default is to disassemble the function surrounding the PC (program counter) of selected frame.
  1294. | With one argument, ADDR1, the function surrounding this address is dumped.
  1295. | Two arguments are taken as a range of memory to dump.
  1296. end
  1297. # __________hex/ascii dump an address_________
  1298. define ascii_char
  1299. if $argc != 1
  1300. help ascii_char
  1301. else
  1302. # thanks elaine :)
  1303. set $_c = *(unsigned char *)($arg0)
  1304. if ($_c < 0x20 || $_c > 0x7E)
  1305. printf "."
  1306. else
  1307. printf "%c", $_c
  1308. end
  1309. end
  1310. end
  1311. document ascii_char
  1312. Syntax: ascii_char ADDR
  1313. | Print ASCII value of byte at address ADDR.
  1314. | Print "." if the value is unprintable.
  1315. end
  1316. define hex_quad
  1317. if $argc != 1
  1318. help hex_quad
  1319. else
  1320. printf "%02X %02X %02X %02X %02X %02X %02X %02X", \
  1321. *(unsigned char*)($arg0), *(unsigned char*)($arg0 + 1), \
  1322. *(unsigned char*)($arg0 + 2), *(unsigned char*)($arg0 + 3), \
  1323. *(unsigned char*)($arg0 + 4), *(unsigned char*)($arg0 + 5), \
  1324. *(unsigned char*)($arg0 + 6), *(unsigned char*)($arg0 + 7)
  1325. end
  1326. end
  1327. document hex_quad
  1328. Syntax: hex_quad ADDR
  1329. | Print eight hexadecimal bytes starting at address ADDR.
  1330. end
  1331. define hexdump
  1332. if $argc == 1
  1333. hexdump_aux $arg0
  1334. else
  1335. if $argc == 2
  1336. set $_count = 0
  1337. while ($_count < $arg1)
  1338. set $_i = ($_count * 0x10)
  1339. hexdump_aux $arg0+$_i
  1340. set $_count++
  1341. end
  1342. else
  1343. help hexdump
  1344. end
  1345. end
  1346. end
  1347. document hexdump
  1348. Syntax: hexdump ADDR <NR_LINES>
  1349. | Display a 16-byte hex/ASCII dump of memory starting at address ADDR.
  1350. | Optional parameter is the number of lines to display if you want more than one.
  1351. end
  1352. define hexdump_aux
  1353. if $argc != 1
  1354. help hexdump_aux
  1355. else
  1356. color_bold
  1357. if ($64BITS == 1)
  1358. printf "0x%016lX : ", $arg0
  1359. else
  1360. printf "0x%08X : ", $arg0
  1361. end
  1362. color_reset
  1363. hex_quad $arg0
  1364. color_bold
  1365. printf " - "
  1366. color_reset
  1367. hex_quad $arg0+8
  1368. printf " "
  1369. color_bold
  1370. ascii_char $arg0+0x0
  1371. ascii_char $arg0+0x1
  1372. ascii_char $arg0+0x2
  1373. ascii_char $arg0+0x3
  1374. ascii_char $arg0+0x4
  1375. ascii_char $arg0+0x5
  1376. ascii_char $arg0+0x6
  1377. ascii_char $arg0+0x7
  1378. ascii_char $arg0+0x8
  1379. ascii_char $arg0+0x9
  1380. ascii_char $arg0+0xA
  1381. ascii_char $arg0+0xB
  1382. ascii_char $arg0+0xC
  1383. ascii_char $arg0+0xD
  1384. ascii_char $arg0+0xE
  1385. ascii_char $arg0+0xF
  1386. color_reset
  1387. printf "\n"
  1388. end
  1389. end
  1390. document hexdump_aux
  1391. Syntax: hexdump_aux ADDR
  1392. | Display a 16-byte hex/ASCII dump of memory at address ADDR.
  1393. end
  1394. # _______________data window__________________
  1395. define ddump
  1396. if $argc != 1
  1397. help ddump
  1398. else
  1399. color $COLOR_SEPARATOR
  1400. if $ARM == 1
  1401. printf "[0x%08X]", $data_addr
  1402. else
  1403. if ($64BITS == 1)
  1404. printf "[0x%04X:0x%016lX]", $ds, $data_addr
  1405. else
  1406. printf "[0x%04X:0x%08X]", $ds, $data_addr
  1407. end
  1408. end
  1409. color $COLOR_SEPARATOR
  1410. printf "------------------------"
  1411. printf "-------------------------------"
  1412. if ($64BITS == 1)
  1413. printf "-------------------------------------"
  1414. end
  1415. color_bold
  1416. color $COLOR_SEPARATOR
  1417. printf "[data]\n"
  1418. color_reset
  1419. set $_count = 0
  1420. while ($_count < $arg0)
  1421. set $_i = ($_count * 0x10)
  1422. hexdump $data_addr+$_i
  1423. set $_count++
  1424. end
  1425. end
  1426. end
  1427. document ddump
  1428. Syntax: ddump NUM
  1429. | Display NUM lines of hexdump for address in $data_addr global variable.
  1430. end
  1431. define dd
  1432. if $argc != 1
  1433. help dd
  1434. else
  1435. set $data_addr = $arg0
  1436. ddump 0x10
  1437. end
  1438. end
  1439. document dd
  1440. Syntax: dd ADDR
  1441. | Display 16 lines of a hex dump of address starting at ADDR.
  1442. end
  1443. define datawin
  1444. if $ARM == 1
  1445. if ((($r0 >> 0x18) == 0x40) || (($r0 >> 0x18) == 0x08) || (($r0 >> 0x18) == 0xBF))
  1446. set $data_addr = $r0
  1447. else
  1448. if ((($r1 >> 0x18) == 0x40) || (($r1 >> 0x18) == 0x08) || (($r1 >> 0x18) == 0xBF))
  1449. set $data_addr = $r1
  1450. else
  1451. if ((($r2 >> 0x18) == 0x40) || (($r2 >> 0x18) == 0x08) || (($r2 >> 0x18) == 0xBF))
  1452. set $data_addr = $r2
  1453. else
  1454. set $data_addr = $sp
  1455. end
  1456. end
  1457. end
  1458. ################################# X86
  1459. else
  1460. if ($64BITS == 1)
  1461. if ((($rsi >> 0x18) == 0x40) || (($rsi >> 0x18) == 0x08) || (($rsi >> 0x18) == 0xBF))
  1462. set $data_addr = $rsi
  1463. else
  1464. if ((($rdi >> 0x18) == 0x40) || (($rdi >> 0x18) == 0x08) || (($rdi >> 0x18) == 0xBF))
  1465. set $data_addr = $rdi
  1466. else
  1467. if ((($rax >> 0x18) == 0x40) || (($rax >> 0x18) == 0x08) || (($rax >> 0x18) == 0xBF))
  1468. set $data_addr = $rax
  1469. else
  1470. set $data_addr = $rsp
  1471. end
  1472. end
  1473. end
  1474. else
  1475. if ((($esi >> 0x18) == 0x40) || (($esi >> 0x18) == 0x08) || (($esi >> 0x18) == 0xBF))
  1476. set $data_addr = $esi
  1477. else
  1478. if ((($edi >> 0x18) == 0x40) || (($edi >> 0x18) == 0x08) || (($edi >> 0x18) == 0xBF))
  1479. set $data_addr = $edi
  1480. else
  1481. if ((($eax >> 0x18) == 0x40) || (($eax >> 0x18) == 0x08) || (($eax >> 0x18) == 0xBF))
  1482. set $data_addr = $eax
  1483. else
  1484. set $data_addr = $esp
  1485. end
  1486. end
  1487. end
  1488. end
  1489. end
  1490. ddump $CONTEXTSIZE_DATA
  1491. end
  1492. document datawin
  1493. Syntax: datawin
  1494. | Display valid address from one register in data window.
  1495. | Registers to choose are: esi, edi, eax, or esp.
  1496. end
  1497. ################################
  1498. ##### ALERT ALERT ALERT ########
  1499. ################################
  1500. # Huge mess going here :) HAHA #
  1501. ################################
  1502. define dumpjump
  1503. if $ARM == 1
  1504. ## Most ARM and Thumb instructions are conditional!
  1505. # each instruction is 32 bits long
  1506. # 4 bits are for condition codes (16 in total) (bits 31:28 in ARM contain the condition or 1111 if instruction is unconditional)
  1507. # 2x4 bits for destination and first operand registers
  1508. # one for the set-status flag
  1509. # an assorted number for other stuff
  1510. # 12 bits for any immediate value
  1511. # $_t_flag == 0 => ARM mode
  1512. # $_t_flag == 1 => Thumb or ThumbEE
  1513. # State bit (T), bit 5
  1514. if (($cpsr >> 5) & 1)
  1515. set $_t_flag = 1
  1516. else
  1517. set $_t_flag = 0
  1518. end
  1519. if $_t_flag == 0
  1520. set $_lastbyte = *(unsigned char *)($pc+3)
  1521. #set $_bit31 = ($_lastbyte >> 7) & 1
  1522. #set $_bit30 = ($_lastbyte >> 6) & 1
  1523. #set $_bit29 = ($_lastbyte >> 5) & 1
  1524. #set $_bit28 = ($_lastbyte >> 4) & 1
  1525. set $_conditional = $_lastbyte >> 4
  1526. dumpjumphelper
  1527. else
  1528. # if bits 15-12 (opcode in Thumb instructions) are equal to 1 1 0 1 (0xD) then we have a conditional branch
  1529. # bits 11-8 for the conditional execution code (check ARMv7 manual A8.3)
  1530. if ( (*(unsigned char *)($pc+1) >> 4) == 0xD )
  1531. set $_conditional = *(unsigned char *)($pc+1) ^ 0xD0
  1532. dumpjumphelper
  1533. end
  1534. end
  1535. ##################### X86
  1536. else
  1537. ## grab the first two bytes from the instruction so we can determine the jump instruction
  1538. set $_byte1 = *(unsigned char *)$pc
  1539. set $_byte2 = *(unsigned char *)($pc+1)
  1540. ## and now check what kind of jump we have (in case it's a jump instruction)
  1541. ## I changed the flags routine to save the flag into a variable, so we don't need to repeat the process :) (search for "define flags")
  1542. ## opcode 0x77: JA, JNBE (jump if CF=0 and ZF=0)
  1543. ## opcode 0x0F87: JNBE, JA
  1544. if ( ($_byte1 == 0x77) || ($_byte1 == 0x0F && $_byte2 == 0x87) )
  1545. # cf=0 and zf=0
  1546. if ($_cf_flag == 0 && $_zf_flag == 0)
  1547. color $RED
  1548. printf " Jump is taken (c=0 and z=0)"
  1549. else
  1550. # cf != 0 or zf != 0
  1551. color $RED
  1552. printf " Jump is NOT taken (c!=0 or z!=0)"
  1553. end
  1554. end
  1555. ## opcode 0x73: JAE, JNB, JNC (jump if CF=0)
  1556. ## opcode 0x0F83: JNC, JNB, JAE (jump if CF=0)
  1557. if ( ($_byte1 == 0x73) || ($_byte1 == 0x0F && $_byte2 == 0x83) )
  1558. # cf=0
  1559. if ($_cf_flag == 0)
  1560. color $RED
  1561. printf " Jump is taken (c=0)"
  1562. else
  1563. # cf != 0
  1564. color $RED
  1565. printf " Jump is NOT taken (c!=0)"
  1566. end
  1567. end
  1568. ## opcode 0x72: JB, JC, JNAE (jump if CF=1)
  1569. ## opcode 0x0F82: JNAE, JB, JC
  1570. if ( ($_byte1 == 0x72) || ($_byte1 == 0x0F && $_byte2 == 0x82) )
  1571. # cf=1
  1572. if ($_cf_flag == 1)
  1573. color $RED
  1574. printf " Jump is taken (c=1)"
  1575. else
  1576. # cf != 1
  1577. color $RED
  1578. printf " Jump is NOT taken (c!=1)"
  1579. end
  1580. end
  1581. ## opcode 0x76: JBE, JNA (jump if CF=1 or ZF=1)
  1582. ## opcode 0x0F86: JBE, JNA
  1583. if ( ($_byte1 == 0x76) || ($_byte1 == 0x0F && $_byte2 == 0x86) )
  1584. # cf=1 or zf=1
  1585. if (($_cf_flag == 1) || ($_zf_flag == 1))
  1586. color $RED
  1587. printf " Jump is taken (c=1 or z=1)"
  1588. else
  1589. # cf != 1 or zf != 1
  1590. color $RED
  1591. printf " Jump is NOT taken (c!=1 or z!=1)"
  1592. end
  1593. end
  1594. ## opcode 0xE3: JCXZ, JECXZ, JRCXZ (jump if CX=0 or ECX=0 or RCX=0)
  1595. if ($_byte1 == 0xE3)
  1596. # cx=0 or ecx=0
  1597. if (($ecx == 0) || ($cx == 0))
  1598. color $RED
  1599. printf " Jump is taken (cx=0 or ecx=0)"
  1600. else
  1601. color $RED
  1602. printf " Jump is NOT taken (cx!=0 or ecx!=0)"
  1603. end
  1604. end
  1605. ## opcode 0x74: JE, JZ (jump if ZF=1)
  1606. ## opcode 0x0F84: JZ, JE, JZ (jump if ZF=1)
  1607. if ( ($_byte1 == 0x74) || ($_byte1 == 0x0F && $_byte2 == 0x84) )
  1608. # ZF = 1
  1609. if ($_zf_flag == 1)
  1610. color $RED
  1611. printf " Jump is taken (z=1)"
  1612. else
  1613. # ZF = 0
  1614. color $RED
  1615. printf " Jump is NOT taken (z!=1)"
  1616. end
  1617. end
  1618. ## opcode 0x7F: JG, JNLE (jump if ZF=0 and SF=OF)
  1619. ## opcode 0x0F8F: JNLE, JG (jump if ZF=0 and SF=OF)
  1620. if ( ($_byte1 == 0x7F) || ($_byte1 == 0x0F && $_byte2 == 0x8F) )
  1621. # zf = 0 and sf = of
  1622. if (($_zf_flag == 0) && ($_sf_flag == $_of_flag))
  1623. color $RED
  1624. printf " Jump is taken (z=0 and s=o)"
  1625. else
  1626. color $RED
  1627. printf " Jump is NOT taken (z!=0 or s!=o)"
  1628. end
  1629. end
  1630. ## opcode 0x7D: JGE, JNL (jump if SF=OF)
  1631. ## opcode 0x0F8D: JNL, JGE (jump if SF=OF)
  1632. if ( ($_byte1 == 0x7D) || ($_byte1 == 0x0F && $_byte2 == 0x8D) )
  1633. # sf = of
  1634. if ($_sf_flag == $_of_flag)
  1635. color $RED
  1636. printf " Jump is taken (s=o)"
  1637. else
  1638. color $RED
  1639. printf " Jump is NOT taken (s!=o)"
  1640. end
  1641. end
  1642. ## opcode: 0x7C: JL, JNGE (jump if SF != OF)
  1643. ## opcode: 0x0F8C: JNGE, JL (jump if SF != OF)
  1644. if ( ($_byte1 == 0x7C) || ($_byte1 == 0x0F && $_byte2 == 0x8C) )
  1645. # sf != of
  1646. if ($_sf_flag != $_of_flag)
  1647. color $RED
  1648. printf " Jump is taken (s!=o)"
  1649. else
  1650. color $RED
  1651. printf " Jump is NOT taken (s=o)"
  1652. end
  1653. end
  1654. ## opcode 0x7E: JLE, JNG (jump if ZF = 1 or SF != OF)
  1655. ## opcode 0x0F8E: JNG, JLE (jump if ZF = 1 or SF != OF)
  1656. if ( ($_byte1 == 0x7E) || ($_byte1 == 0x0F && $_byte2 == 0x8E) )
  1657. # zf = 1 or sf != of
  1658. if (($_zf_flag == 1) || ($_sf_flag != $_of_flag))
  1659. color $RED
  1660. printf " Jump is taken (zf=1 or sf!=of)"
  1661. else
  1662. color $RED
  1663. printf " Jump is NOT taken (zf!=1 or sf=of)"
  1664. end
  1665. end
  1666. ## opcode 0x75: JNE, JNZ (jump if ZF = 0)
  1667. ## opcode 0x0F85: JNE, JNZ (jump if ZF = 0)
  1668. if ( ($_byte1 == 0x75) || ($_byte1 == 0x0F && $_byte2 == 0x85) )
  1669. # ZF = 0
  1670. if ($_zf_flag == 0)
  1671. color $RED
  1672. printf " Jump is taken (z=0)"
  1673. else
  1674. # ZF = 1
  1675. color $RED
  1676. printf " Jump is NOT taken (z!=0)"
  1677. end
  1678. end
  1679. ## opcode 0x71: JNO (OF = 0)
  1680. ## opcode 0x0F81: JNO (OF = 0)
  1681. if ( ($_byte1 == 0x71) || ($_byte1 == 0x0F && $_byte2 == 0x81) )
  1682. # OF = 0
  1683. if ($_of_flag == 0)
  1684. color $RED
  1685. printf " Jump is taken (o=0)"
  1686. else
  1687. # OF != 0
  1688. color $RED
  1689. printf " Jump is NOT taken (o!=0)"
  1690. end
  1691. end
  1692. ## opcode 0x7B: JNP, JPO (jump if PF = 0)
  1693. ## opcode 0x0F8B: JPO (jump if PF = 0)
  1694. if ( ($_byte1 == 0x7B) || ($_byte1 == 0x0F && $_byte2 == 0x8B) )
  1695. # PF = 0
  1696. if ($_pf_flag == 0)
  1697. color $RED
  1698. printf " Jump is NOT taken (p=0)"
  1699. else
  1700. # PF != 0
  1701. color $RED
  1702. printf " Jump is taken (p!=0)"
  1703. end
  1704. end
  1705. ## opcode 0x79: JNS (jump if SF = 0)
  1706. ## opcode 0x0F89: JNS (jump if SF = 0)
  1707. if ( ($_byte1 == 0x79) || ($_byte1 == 0x0F && $_byte2 == 0x89) )
  1708. # SF = 0
  1709. if ($_sf_flag == 0)
  1710. color $RED
  1711. printf " Jump is taken (s=0)"
  1712. else
  1713. # SF != 0
  1714. color $RED
  1715. printf " Jump is NOT taken (s!=0)"
  1716. end
  1717. end
  1718. ## opcode 0x70: JO (jump if OF=1)
  1719. ## opcode 0x0F80: JO (jump if OF=1)
  1720. if ( ($_byte1 == 0x70) || ($_byte1 == 0x0F && $_byte2 == 0x80) )
  1721. # OF = 1
  1722. if ($_of_flag == 1)
  1723. color $RED
  1724. printf " Jump is taken (o=1)"
  1725. else
  1726. # OF != 1
  1727. color $RED
  1728. printf " Jump is NOT taken (o!=1)"
  1729. end
  1730. end
  1731. ## opcode 0x7A: JP, JPE (jump if PF=1)
  1732. ## opcode 0x0F8A: JP, JPE (jump if PF=1)
  1733. if ( ($_byte1 == 0x7A) || ($_byte1 == 0x0F && $_byte2 == 0x8A) )
  1734. # PF = 1
  1735. if ($_pf_flag == 1)
  1736. color $RED
  1737. printf " Jump is taken (p=1)"
  1738. else
  1739. # PF = 0
  1740. color $RED
  1741. printf " Jump is NOT taken (p!=1)"
  1742. end
  1743. end
  1744. ## opcode 0x78: JS (jump if SF=1)
  1745. ## opcode 0x0F88: JS (jump if SF=1)
  1746. if ( ($_byte1 == 0x78) || ($_byte1 == 0x0F && $_byte2 == 0x88) )
  1747. # SF = 1
  1748. if ($_sf_flag == 1)
  1749. color $RED
  1750. printf " Jump is taken (s=1)"
  1751. else
  1752. # SF != 1
  1753. color $RED
  1754. printf " Jump is NOT taken (s!=1)"
  1755. end
  1756. end
  1757. end
  1758. end
  1759. document dumpjump
  1760. Syntax: dumpjump
  1761. | Display if conditional jump will be taken or not.
  1762. end
  1763. define dumpjumphelper
  1764. # 0000 - EQ: Z == 1
  1765. if ($_conditional == 0x0)
  1766. if ($_z_flag == 1)
  1767. color $RED
  1768. printf " Jump is taken (z==1)"
  1769. else
  1770. color $RED
  1771. printf " Jump is NOT taken (z!=1)"
  1772. end
  1773. end
  1774. # 0001 - NE: Z == 0
  1775. if ($_conditional == 0x1)
  1776. if ($_z_flag == 0)
  1777. color $RED
  1778. printf " Jump is taken (z==0)"
  1779. else
  1780. color $RED
  1781. printf " Jump is NOT taken (z!=0)"
  1782. end
  1783. end
  1784. # 0010 - CS: C == 1
  1785. if ($_conditional == 0x2)
  1786. if ($_c_flag == 1)
  1787. color $RED
  1788. printf " Jump is taken (c==1)"
  1789. else
  1790. color $RED
  1791. printf " Jump is NOT taken (c!=1)"
  1792. end
  1793. end
  1794. # 0011 - CC: C == 0
  1795. if ($_conditional == 0x3)
  1796. if ($_c_flag == 0)
  1797. color $RED
  1798. printf " Jump is taken (c==0)"
  1799. else
  1800. color $RED
  1801. printf " Jump is NOT taken (c!=0)"
  1802. end
  1803. end
  1804. # 0100 - MI: N == 1
  1805. if ($_conditional == 0x4)
  1806. if ($_n_flag == 1)
  1807. color $RED
  1808. printf " Jump is taken (n==1)"
  1809. else
  1810. color $RED
  1811. printf " Jump is NOT taken (n!=1)"
  1812. end
  1813. end
  1814. # 0101 - PL: N == 0
  1815. if ($_conditional == 0x5)
  1816. if ($_n_flag == 0)
  1817. color $RED
  1818. printf " Jump is taken (n==0)"
  1819. else
  1820. color $RED
  1821. printf " Jump is NOT taken (n!=0)"
  1822. end
  1823. end
  1824. # 0110 - VS: V == 1
  1825. if ($_conditional == 0x6)
  1826. if ($_v_flag == 1)
  1827. color $RED
  1828. printf " Jump is taken (v==1)"
  1829. else
  1830. color $RED
  1831. printf " Jump is NOT taken (v!=1)"
  1832. end
  1833. end
  1834. # 0111 - VC: V == 0
  1835. if ($_conditional == 0x7)
  1836. if ($_v_flag == 0)
  1837. color $RED
  1838. printf " Jump is taken (v==0)"
  1839. else
  1840. color $RED
  1841. printf " Jump is NOT taken (v!=0)"
  1842. end
  1843. end
  1844. # 1000 - HI: C == 1 and Z == 0
  1845. if ($_conditional == 0x8)
  1846. if ($_c_flag == 1 && $_z_flag == 0)
  1847. color $RED
  1848. printf " Jump is taken (c==1 and z==0)"
  1849. else
  1850. color $RED
  1851. printf " Jump is NOT taken (c!=1 or z!=0)"
  1852. end
  1853. end
  1854. # 1001 - LS: C == 0 or Z == 1
  1855. if ($_conditional == 0x9)
  1856. if ($_c_flag == 0 || $_z_flag == 1)
  1857. color $RED
  1858. printf " Jump is taken (c==0 or z==1)"
  1859. else
  1860. color $RED
  1861. printf " Jump is NOT taken (c!=0 or z!=1)"
  1862. end
  1863. end
  1864. # 1010 - GE: N == V
  1865. if ($_conditional == 0xA)
  1866. if ($_n_flag == $_v_flag)
  1867. color $RED
  1868. printf " Jump is taken (n==v)"
  1869. else
  1870. color $RED
  1871. printf " Jump is NOT taken (n!=v)"
  1872. end
  1873. end
  1874. # 1011 - LT: N != V
  1875. if ($_conditional == 0xB)
  1876. if ($_n_flag != $_v_flag)
  1877. color $RED
  1878. printf " Jump is taken (n!=v)"
  1879. else
  1880. color $RED
  1881. printf " Jump is NOT taken (n==v)"
  1882. end
  1883. end
  1884. # 1100 - GT: Z == 0 and N == V
  1885. if ($_conditional == 0xC)
  1886. if ($_z_flag == 0 && $_n_flag == $_v_flag)
  1887. color $RED
  1888. printf " Jump is taken (z==0 and n==v)"
  1889. else
  1890. color $RED
  1891. printf " Jump is NOT taken (z!=0 or n!=v)"
  1892. end
  1893. end
  1894. # 1101 - LE: Z == 1 or N != V
  1895. if ($_conditional == 0xD)
  1896. if ($_z_flag == 1 || $_n_flag != $_v_flag)
  1897. color $RED
  1898. printf " Jump is taken (z==1 or n!=v)"
  1899. else
  1900. color $RED
  1901. printf " Jump is NOT taken (z!=1 or n==v)"
  1902. end
  1903. end
  1904. end
  1905. document dumpjumphelper
  1906. Syntax: dumpjumphelper
  1907. | Helper function to decide if conditional jump will be taken or not, for ARM and Thumb.
  1908. end
  1909. # _______________process context______________
  1910. # initialize variable
  1911. set $displayobjectivec = 0
  1912. define context
  1913. color $COLOR_SEPARATOR
  1914. if $SHOWCPUREGISTERS == 1
  1915. printf "----------------------------------------"
  1916. printf "----------------------------------"
  1917. if ($64BITS == 1)
  1918. printf "---------------------------------------------"
  1919. end
  1920. color $COLOR_SEPARATOR
  1921. color_bold
  1922. printf "[regs]\n"
  1923. color_reset
  1924. reg
  1925. color $CYAN
  1926. end
  1927. if $SHOWSTACK == 1
  1928. color $COLOR_SEPARATOR
  1929. if $ARM == 1
  1930. printf "[0x%08X]", $sp
  1931. else
  1932. if ($64BITS == 1)
  1933. printf "[0x%04X:0x%016lX]", $ss, $rsp
  1934. else
  1935. printf "[0x%04X:0x%08X]", $ss, $esp
  1936. end
  1937. end
  1938. color $COLOR_SEPARATOR
  1939. printf "-------------------------"
  1940. printf "-----------------------------"
  1941. if ($64BITS == 1)
  1942. printf "-------------------------------------"
  1943. end
  1944. color $COLOR_SEPARATOR
  1945. color_bold
  1946. printf "[stack]\n"
  1947. color_reset
  1948. set $context_i = $CONTEXTSIZE_STACK
  1949. while ($context_i > 0)
  1950. set $context_t = $sp + 0x10 * ($context_i - 1)
  1951. hexdump $context_t
  1952. set $context_i--
  1953. end
  1954. end
  1955. # show the objective C message being passed to msgSend
  1956. if $SHOWOBJECTIVEC == 1
  1957. #FIXME: X64 and ARM
  1958. # What a piece of crap that's going on here :)
  1959. # detect if it's the correct opcode we are searching for
  1960. if $ARM == 0
  1961. set $__byte1 = *(unsigned char *)$pc
  1962. set $__byte = *(int *)$pc
  1963. if ($__byte == 0x4244489)
  1964. set $objectivec = $eax
  1965. set $displayobjectivec = 1
  1966. end
  1967. if ($__byte == 0x4245489)
  1968. set $objectivec = $edx
  1969. set $displayobjectivec = 1
  1970. end
  1971. if ($__byte == 0x4244c89)
  1972. set $objectivec = $ecx
  1973. set $displayobjectivec = 1
  1974. end
  1975. else
  1976. set $__byte1 = 0
  1977. end
  1978. # and now display it or not (we have no interest in having the info displayed after the call)
  1979. if $__byte1 == 0xE8
  1980. if $displayobjectivec == 1
  1981. color $COLOR_SEPARATOR
  1982. printf "--------------------------------------------------------------------"
  1983. if ($64BITS == 1)
  1984. printf "---------------------------------------------"
  1985. end
  1986. color $COLOR_SEPARATOR
  1987. color_bold
  1988. printf "[ObjectiveC]\n"
  1989. color_reset
  1990. color $BLACK
  1991. x/s $objectivec
  1992. end
  1993. set $displayobjectivec = 0
  1994. end
  1995. if $displayobjectivec == 1
  1996. color $COLOR_SEPARATOR
  1997. printf "--------------------------------------------------------------------"
  1998. if ($64BITS == 1)
  1999. printf "---------------------------------------------"
  2000. end
  2001. color $COLOR_SEPARATOR
  2002. color_bold
  2003. printf "[ObjectiveC]\n"
  2004. color_reset
  2005. color $BLACK
  2006. x/s $objectivec
  2007. end
  2008. end
  2009. color_reset
  2010. # and this is the end of this little crap
  2011. if $SHOWDATAWIN == 1
  2012. datawin
  2013. end
  2014. if $SHOWDISASM == 1
  2015. color $COLOR_SEPARATOR
  2016. printf "--------------------------------------------------------------------------"
  2017. if ($64BITS == 1)
  2018. printf "---------------------------------------------"
  2019. end
  2020. color $COLOR_SEPARATOR
  2021. color_bold
  2022. printf "[code]\n"
  2023. color_reset
  2024. set $context_i = $CONTEXTSIZE_CODE
  2025. if ($context_i > 0)
  2026. if ($SETCOLOR1STLINE == 1)
  2027. color $GREEN
  2028. if ($ARM == 1)
  2029. # | $cpsr.t (Thumb flag)
  2030. x/i (unsigned int)$pc | (($cpsr >> 5) & 1)
  2031. else
  2032. x/i $pc
  2033. end
  2034. color_reset
  2035. else
  2036. if ($ARM == 1)
  2037. # | $cpsr.t (Thumb flag)
  2038. x/i (unsigned int)$pc | (($cpsr >> 5) & 1)
  2039. else
  2040. x/i $pc
  2041. end
  2042. end
  2043. set $context_i--
  2044. end
  2045. while ($context_i > 0)
  2046. x /i
  2047. set $context_i--
  2048. end
  2049. end
  2050. color $COLOR_SEPARATOR
  2051. printf "----------------------------------------"
  2052. printf "----------------------------------------"
  2053. if ($64BITS == 1)
  2054. printf "---------------------------------------------\n"
  2055. else
  2056. printf "\n"
  2057. end
  2058. color_reset
  2059. end
  2060. document context
  2061. Syntax: context
  2062. | Print context window, i.e. regs, stack, ds:esi and disassemble cs:eip.
  2063. end
  2064. define context-on
  2065. set $SHOW_CONTEXT = 1
  2066. printf "Displaying of context is now ON\n"
  2067. end
  2068. document context-on
  2069. Syntax: context-on
  2070. | Enable display of context on every program break.
  2071. end
  2072. define context-off
  2073. set $SHOW_CONTEXT = 0
  2074. printf "Displaying of context is now OFF\n"
  2075. end
  2076. document context-off
  2077. Syntax: context-off
  2078. | Disable display of context on every program break.
  2079. end
  2080. # _______________process control______________
  2081. define n
  2082. if $argc == 0
  2083. nexti
  2084. end
  2085. if $argc == 1
  2086. nexti $arg0
  2087. end
  2088. if $argc > 1
  2089. help n
  2090. end
  2091. end
  2092. document n
  2093. Syntax: n <NUM>
  2094. | Step one instruction, but proceed through subroutine calls.
  2095. | If NUM is given, then repeat it NUM times or till program stops.
  2096. | This is alias for nexti.
  2097. end
  2098. define go
  2099. if $argc == 0
  2100. stepi
  2101. end
  2102. if $argc == 1
  2103. stepi $arg0
  2104. end
  2105. if $argc > 1
  2106. help go
  2107. end
  2108. end
  2109. document go
  2110. Syntax: go <NUM>
  2111. | Step one instruction exactly.
  2112. | If NUM is given, then repeat it NUM times or till program stops.
  2113. | This is alias for stepi.
  2114. end
  2115. define pret
  2116. finish
  2117. end
  2118. document pret
  2119. Syntax: pret
  2120. | Execute until selected stack frame returns (step out of current call).
  2121. | Upon return, the value returned is printed and put in the value history.
  2122. end
  2123. define init
  2124. set $SHOW_NEST_INSN = 0
  2125. tbreak _init
  2126. r
  2127. end
  2128. document init
  2129. Syntax: init
  2130. | Run program and break on _init().
  2131. end
  2132. define start
  2133. set $SHOW_NEST_INSN = 0
  2134. tbreak _start
  2135. r
  2136. end
  2137. document start
  2138. Syntax: start
  2139. | Run program and break on _start().
  2140. end
  2141. define sstart
  2142. set $SHOW_NEST_INSN = 0
  2143. tbreak __libc_start_main
  2144. r
  2145. end
  2146. document sstart
  2147. Syntax: sstart
  2148. | Run program and break on __libc_start_main().
  2149. | Useful for stripped executables.
  2150. end
  2151. define main
  2152. set $SHOW_NEST_INSN = 0
  2153. tbreak main
  2154. r
  2155. end
  2156. document main
  2157. Syntax: main
  2158. | Run program and break on main().
  2159. end
  2160. # FIXME64
  2161. #### WARNING ! WARNING !!
  2162. #### More more messy stuff starting !!!
  2163. #### I was thinking about how to do this and then it ocurred me that it could be as simple as this ! :)
  2164. define stepoframework
  2165. if $ARM == 1
  2166. # bl and bx opcodes
  2167. # bx Rn => ARM bits 27-20: 0 0 0 1 0 0 1 0 , bits 7-4: 0 0 0 1 ; Thumb bits: 15-7: 0 1 0 0 0 1 1 1 0
  2168. # blx Rn => ARM bits 27-20: 0 0 0 1 0 0 1 0 , bits 7-4: 0 0 1 1 ; Thumb bits: 15-7: 0 1 0 0 0 1 1 1 1
  2169. # bl # => ARM bits 27-24: 1 0 1 1 ; Thumb bits: 15-11: 1 1 1 1 0
  2170. # blx # => ARM bits 31-25: 1 1 1 1 1 0 1 ; Thumb bits: 15-11: 1 1 1 1 0
  2171. set $_nextaddress = 0
  2172. # ARM Mode
  2173. if ($_t_flag == 0)
  2174. set $_branchesint = *(unsigned int*)$pc
  2175. set $_bit31 = ($_branchesint >> 0x1F) & 1
  2176. set $_bit30 = ($_branchesint >> 0x1E) & 1
  2177. set $_bit29 = ($_branchesint >> 0x1D) & 1
  2178. set $_bit28 = ($_branchesint >> 0x1C) & 1
  2179. set $_bit27 = ($_branchesint >> 0x1B) & 1
  2180. set $_bit26 = ($_branchesint >> 0x1A) & 1
  2181. set $_bit25 = ($_branchesint >> 0x19) & 1
  2182. set $_bit24 = ($_branchesint >> 0x18) & 1
  2183. set $_bit23 = ($_branchesint >> 0x17) & 1
  2184. set $_bit22 = ($_branchesint >> 0x16) & 1
  2185. set $_bit21 = ($_branchesint >> 0x15) & 1
  2186. set $_bit20 = ($_branchesint >> 0x14) & 1
  2187. set $_bit7 = ($_branchesint >> 0x7) & 1
  2188. set $_bit6 = ($_branchesint >> 0x6) & 1
  2189. set $_bit5 = ($_branchesint >> 0x5) & 1
  2190. set $_bit4 = ($_branchesint >> 0x4) & 1
  2191. # set $_lastbyte = *(unsigned char *)($pc+3)
  2192. # set $_bits2724 = $_lastbyte & 0x1
  2193. # set $_bits3128 = $_lastbyte >> 4
  2194. # if ($_bits3128 == 0xF)
  2195. # set $_bits2724 = $_lastbyte & 0xA
  2196. # set $_bits2724 = $_bits2724 >> 1
  2197. # end
  2198. # set $_previousbyte = *(unsigned char *)($pc+2)
  2199. # set $_bits2320 = $_previousbyte >> 4
  2200. # printf "bits2724: %x bits2320: %x\n", $_bits2724, $_bits2320
  2201. if ($_bit27 == 0 && $_bit26 == 0 && $_bit25 == 0 && $_bit24 == 1 && $_bit23 == 0 && $_bit22 == 0 && $_bit21 == 1 && $_bit20 == 0 && $_bit7 == 0 && $_bit6 == 0 && $_bit5 == 0 && $_bit4 == 1)
  2202. printf "Found a bx Rn\n"
  2203. set $_nextaddress = $pc+0x4
  2204. end
  2205. if ($_bit27 == 0 && $_bit26 == 0 && $_bit25 == 0 && $_bit24 == 1 && $_bit23 == 0 && $_bit22 == 0 && $_bit21 == 1 && $_bit20 == 0 && $_bit7 == 0 && $_bit6 == 0 && $_bit5 == 1 && $_bit4 == 1)
  2206. printf "Found a blx Rn\n"
  2207. set $_nextaddress = $pc+0x4
  2208. end
  2209. if ($_bit27 == 1 && $_bit26 == 0 && $_bit25 == 1 && $_bit24 == 1)
  2210. printf "Found a bl #\n"
  2211. set $_nextaddress = $pc+0x4
  2212. end
  2213. if ($_bit31 == 1 && $_bit30 == 1 && $_bit29 == 1 && $_bit28 == 1 && $_bit27 == 1 && $_bit26 == 0 && $_bit25 == 1)
  2214. printf "Found a blx #\n"
  2215. set $_nextaddress = $pc+0x4
  2216. end
  2217. # Thumb Mode
  2218. else
  2219. # 32 bits instructions in Thumb are divided into two half words
  2220. set $_hw1 = *(unsigned short*)($pc)
  2221. set $_hw2 = *(unsigned short*)($pc+2)
  2222. # bl/blx (immediate)
  2223. # hw1: bits 15-11: 1 1 1 1 0
  2224. # hw2: bits 15-14: 1 1 ; BL bit 12: 1 ; BLX bit 12: 0
  2225. if ( ($_hw1 >> 0xC) == 0xF && (($_hw1 >> 0xB) & 1) == 0)
  2226. if ( ((($_hw2 >> 0xF) & 1) == 1) && ((($_hw2 >> 0xE) & 1) == 1) )
  2227. set $_nextaddress = $pc+0x4
  2228. end
  2229. end
  2230. end
  2231. # if we have found a call to bypass we set a temporary breakpoint on next instruction and continue
  2232. if ($_nextaddress != 0)
  2233. tbreak *$_nextaddress
  2234. continue
  2235. printf "[StepO] Next address will be %x\n", $_nextaddress
  2236. # else we just single step
  2237. else
  2238. nexti
  2239. end
  2240. ###################################### X86
  2241. else
  2242. ## we know that an opcode starting by 0xE8 has a fixed length
  2243. ## for the 0xFF opcodes, we can enumerate what is possible to have
  2244. # first we grab the first 3 bytes from the current program counter
  2245. set $_byte1 = *(unsigned char *)$pc
  2246. set $_byte2 = *(unsigned char *)($pc+1)
  2247. set $_byte3 = *(unsigned char *)($pc+2)
  2248. # and start the fun
  2249. # if it's a 0xE8 opcode, the total instruction size will be 5 bytes
  2250. # so we can simply calculate the next address and use a temporary breakpoint ! Voila :)
  2251. set $_nextaddress = 0
  2252. # this one is the must useful for us !!!
  2253. if ($_byte1 == 0xE8)
  2254. set $_nextaddress = $pc + 0x5
  2255. else
  2256. # just other cases we might be interested in... maybe this should be removed since the 0xE8 opcode is the one we will use more
  2257. # this is a big fucking mess and can be improved for sure :) I don't like the way it is ehehehe
  2258. if ($_byte1 == 0xFF)
  2259. # call *%eax (0xFFD0) || call *%edx (0xFFD2) || call *(%ecx) (0xFFD1) || call (%eax) (0xFF10) || call *%esi (0xFFD6) || call *%ebx (0xFFD3) || call DWORD PTR [edx] (0xFF12)
  2260. if ($_byte2 == 0xD0 || $_byte2 == 0xD1 || $_byte2 == 0xD2 || $_byte2 == 0xD3 || $_byte2 == 0xD6 || $_byte2 == 0x10 || $_byte2 == 0x11 || $_byte2 == 0xD7 || $_byte2 == 0x12)
  2261. set $_nextaddress = $pc + 0x2
  2262. end
  2263. # call *0x??(%ebp) (0xFF55??) || call *0x??(%esi) (0xFF56??) || call *0x??(%edi) (0xFF5F??) || call *0x??(%ebx)
  2264. # call *0x??(%edx) (0xFF52??) || call *0x??(%ecx) (0xFF51??) || call *0x??(%edi) (0xFF57??) || call *0x??(%eax) (0xFF50??)
  2265. if ($_byte2 == 0x55 || $_byte2 == 0x56 || $_byte2 == 0x5F || $_byte2 == 0x53 || $_byte2 == 0x52 || $_byte2 == 0x51 || $_byte2 == 0x57 || $_byte2 == 0x50)
  2266. set $_nextaddress = $pc + 0x3
  2267. end
  2268. # call *0x????????(%ebx) (0xFF93????????) ||
  2269. if ($_byte2 == 0x93 || $_byte2 == 0x94 || $_byte2 == 0x90 || $_byte2 == 0x92 || $_byte2 == 0x95 || $_byte2 == 0x15)
  2270. set $_nextaddress = $pc + 6
  2271. end
  2272. # call *0x????????(%ebx,%eax,4) (0xFF94??????????)
  2273. if ($_byte2 == 0x94)
  2274. set $_nextaddress = $pc + 7
  2275. end
  2276. end
  2277. # FIXME: still missing a few?
  2278. if ($_byte1 == 0x41 || $_byte1 == 0x40)
  2279. if ($_byte2 == 0xFF)
  2280. if ($_byte3 == 0xD0 || $_byte3 == 0xD1 || $_byte3 == 0xD2 || $_byte3 == 0xD3 || $_byte3 == 0xD4 || $_byte3 == 0xD5 || $_byte3 == 0xD6 || $_byte3 == 0xD7)
  2281. set $_nextaddress = $pc + 0x3
  2282. end
  2283. end
  2284. end
  2285. end
  2286. # if we have found a call to bypass we set a temporary breakpoint on next instruction and continue
  2287. if ($_nextaddress != 0)
  2288. if ($arg0 == 1)
  2289. thbreak *$_nextaddress
  2290. else
  2291. tbreak *$_nextaddress
  2292. end
  2293. continue
  2294. # else we just single step
  2295. else
  2296. nexti
  2297. end
  2298. end
  2299. end
  2300. document stepoframework
  2301. Syntax: stepoframework
  2302. | Auxiliary function to stepo command.
  2303. end
  2304. define stepo
  2305. stepoframework 0
  2306. end
  2307. document stepo
  2308. Syntax: stepo
  2309. | Step over calls (interesting to bypass the ones to msgSend).
  2310. | This function will set a temporary breakpoint on next instruction after the call so the call will be bypassed.
  2311. | You can safely use it instead nexti or n since it will single step code if it's not a call instruction (unless you want to go into the call function).
  2312. end
  2313. define stepoh
  2314. stepoframework 1
  2315. end
  2316. document stepoh
  2317. Syntax: stepoh
  2318. | Same as stepo command but uses temporary hardware breakpoints.
  2319. end
  2320. # FIXME: ARM
  2321. define skip
  2322. x/2i $pc
  2323. set $instruction_size = (int)($_ - $pc)
  2324. set $pc = $pc + $instruction_size
  2325. if ($SKIPEXECUTE == 1)
  2326. if ($SKIPSTEP == 1)
  2327. stepo
  2328. else
  2329. stepi
  2330. end
  2331. else
  2332. context
  2333. end
  2334. end
  2335. document skip
  2336. Syntax: skip
  2337. | Skip over the instruction located at EIP/RIP. By default, the instruction will not be executed!
  2338. | Some configurable options are available on top of gdbinit to override this.
  2339. end
  2340. # _______________eflags commands______________
  2341. # conditional flags are
  2342. # negative/less than (N), bit 31 of CPSR
  2343. # zero (Z), bit 30
  2344. # Carry/Borrow/Extend (C), bit 29
  2345. # Overflow (V), bit 28
  2346. # negative/less than (N), bit 31 of CPSR
  2347. define cfn
  2348. if $ARM == 1
  2349. set $tempflag = $cpsr->n
  2350. if ($tempflag & 1)
  2351. set $cpsr->n = $tempflag&~0x1
  2352. else
  2353. set $cpsr->n = $tempflag|0x1
  2354. end
  2355. end
  2356. end
  2357. document cfn
  2358. Syntax: cfn
  2359. | Change Negative/Less Than Flag.
  2360. end
  2361. define cfc
  2362. # Carry/Borrow/Extend (C), bit 29
  2363. if $ARM == 1
  2364. set $tempflag = $cpsr->c
  2365. if ($tempflag & 1)
  2366. set $cpsr->c = $tempflag&~0x1
  2367. else
  2368. set $cpsr->c = $tempflag|0x1
  2369. end
  2370. else
  2371. if ((unsigned int)$eflags & 1)
  2372. set $eflags = (unsigned int)$eflags&~0x1
  2373. else
  2374. set $eflags = (unsigned int)$eflags|0x1
  2375. end
  2376. end
  2377. end
  2378. document cfc
  2379. Syntax: cfc
  2380. | Change Carry Flag.
  2381. end
  2382. define cfp
  2383. if (((unsigned int)$eflags >> 2) & 1)
  2384. set $eflags = (unsigned int)$eflags&~0x4
  2385. else
  2386. set $eflags = (unsigned int)$eflags|0x4
  2387. end
  2388. end
  2389. document cfp
  2390. Syntax: cfp
  2391. | Change Parity Flag.
  2392. end
  2393. define cfa
  2394. if (((unsigned int)$eflags >> 4) & 1)
  2395. set $eflags = (unsigned int)$eflags&~0x10
  2396. else
  2397. set $eflags = (unsigned int)$eflags|0x10
  2398. end
  2399. end
  2400. document cfa
  2401. Syntax: cfa
  2402. | Change Auxiliary Carry Flag.
  2403. end
  2404. define cfz
  2405. # zero (Z), bit 30
  2406. if $ARM == 1
  2407. set $tempflag = $cpsr->z
  2408. if ($tempflag & 1)
  2409. set $cpsr->z = $tempflag&~0x1
  2410. else
  2411. set $cpsr->z = $tempflag|0x1
  2412. end
  2413. else
  2414. if (((unsigned int)$eflags >> 6) & 1)
  2415. set $eflags = (unsigned int)$eflags&~0x40
  2416. else
  2417. set $eflags = (unsigned int)$eflags|0x40
  2418. end
  2419. end
  2420. end
  2421. document cfz
  2422. Syntax: cfz
  2423. | Change Zero Flag.
  2424. end
  2425. define cfs
  2426. if (((unsigned int)$eflags >> 7) & 1)
  2427. set $eflags = (unsigned int)$eflags&~0x80
  2428. else
  2429. set $eflags = (unsigned int)$eflags|0x80
  2430. end
  2431. end
  2432. document cfs
  2433. Syntax: cfs
  2434. | Change Sign Flag.
  2435. end
  2436. define cft
  2437. if (((unsigned int)$eflags >>8) & 1)
  2438. set $eflags = (unsigned int)$eflags&~0x100
  2439. else
  2440. set $eflags = (unsigned int)$eflags|0x100
  2441. end
  2442. end
  2443. document cft
  2444. Syntax: cft
  2445. | Change Trap Flag.
  2446. end
  2447. define cfi
  2448. if (((unsigned int)$eflags >> 9) & 1)
  2449. set $eflags = (unsigned int)$eflags&~0x200
  2450. else
  2451. set $eflags = (unsigned int)$eflags|0x200
  2452. end
  2453. end
  2454. document cfi
  2455. Syntax: cfi
  2456. | Change Interrupt Flag.
  2457. | Only privileged applications (usually the OS kernel) may modify IF.
  2458. | This only applies to protected mode (real mode code may always modify IF).
  2459. end
  2460. define cfd
  2461. if (((unsigned int)$eflags >>0xA) & 1)
  2462. set $eflags = (unsigned int)$eflags&~0x400
  2463. else
  2464. set $eflags = (unsigned int)$eflags|0x400
  2465. end
  2466. end
  2467. document cfd
  2468. Syntax: cfd
  2469. | Change Direction Flag.
  2470. end
  2471. define cfo
  2472. if (((unsigned int)$eflags >> 0xB) & 1)
  2473. set $eflags = (unsigned int)$eflags&~0x800
  2474. else
  2475. set $eflags = (unsigned int)$eflags|0x800
  2476. end
  2477. end
  2478. document cfo
  2479. Syntax: cfo
  2480. | Change Overflow Flag.
  2481. end
  2482. # Overflow (V), bit 28
  2483. define cfv
  2484. if $ARM == 1
  2485. set $tempflag = $cpsr->v
  2486. if ($tempflag & 1)
  2487. set $cpsr->v = $tempflag&~0x1
  2488. else
  2489. set $cpsr->v = $tempflag|0x1
  2490. end
  2491. end
  2492. end
  2493. document cfv
  2494. Syntax: cfv
  2495. | Change Overflow Flag.
  2496. end
  2497. # ____________________patch___________________
  2498. # the usual nops are mov r0,r0 for arm (0xe1a00000)
  2499. # and mov r8,r8 in Thumb (0x46c0)
  2500. # armv7 has other nops
  2501. # FIXME: make sure that the interval fits the 32bits address for arm and 16bits for thumb
  2502. # status: works, fixme
  2503. define nop
  2504. if ($argc > 2 || $argc == 0)
  2505. help nop
  2506. end
  2507. if $ARM == 1
  2508. if ($argc == 1)
  2509. if ($cpsr->t &1)
  2510. # thumb
  2511. set *(short *)$arg0 = 0x46c0
  2512. else
  2513. # arm
  2514. set *(int *)$arg0 = 0xe1a00000
  2515. end
  2516. else
  2517. set $addr = $arg0
  2518. if ($cpsr->t & 1)
  2519. # thumb
  2520. while ($addr < $arg1)
  2521. set *(short *)$addr = 0x46c0
  2522. set $addr = $addr + 2
  2523. end
  2524. else
  2525. # arm
  2526. while ($addr < $arg1)
  2527. set *(int *)$addr = 0xe1a00000
  2528. set $addr = $addr + 4
  2529. end
  2530. end
  2531. end
  2532. else
  2533. if ($argc == 1)
  2534. set *(unsigned char *)$arg0 = 0x90
  2535. else
  2536. set $addr = $arg0
  2537. while ($addr < $arg1)
  2538. set *(unsigned char *)$addr = 0x90
  2539. set $addr = $addr + 1
  2540. end
  2541. end
  2542. end
  2543. end
  2544. document nop
  2545. Syntax: nop ADDR1 [ADDR2]
  2546. | Patch a single byte at address ADDR1, or a series of bytes between ADDR1 and ADDR2 to a NOP (0x90) instruction.
  2547. | ARM or Thumb code will be patched accordingly.
  2548. end
  2549. define null
  2550. if ( $argc >2 || $argc == 0)
  2551. help null
  2552. end
  2553. if ($argc == 1)
  2554. set *(unsigned char *)$arg0 = 0
  2555. else
  2556. set $addr = $arg0
  2557. while ($addr < $arg1)
  2558. set *(unsigned char *)$addr = 0
  2559. set $addr = $addr +1
  2560. end
  2561. end
  2562. end
  2563. document null
  2564. Syntax: null ADDR1 [ADDR2]
  2565. | Patch a single byte at address ADDR1 to NULL (0x00), or a series of bytes between ADDR1 and ADDR2.
  2566. end
  2567. # FIXME: thumb breakpoint ?
  2568. define int3
  2569. if $argc != 1
  2570. help int3
  2571. else
  2572. if $ARM == 1
  2573. set $ORIGINAL_INT3 = *(unsigned int *)$arg0
  2574. set $ORIGINAL_INT3ADDRESS = $arg0
  2575. set *(unsigned int*)$arg0 = 0xe7ffdefe
  2576. else
  2577. # save original bytes and address
  2578. set $ORIGINAL_INT3 = *(unsigned char *)$arg0
  2579. set $ORIGINAL_INT3ADDRESS = $arg0
  2580. # patch
  2581. set *(unsigned char *)$arg0 = 0xCC
  2582. end
  2583. end
  2584. end
  2585. document int3
  2586. Syntax int3 ADDR
  2587. | Patch byte at address ADDR to an INT3 (0xCC) instruction or the equivalent software breakpoint for ARM.
  2588. end
  2589. define rint3
  2590. if $ARM == 1
  2591. set *(unsigned int *)$ORIGINAL_INT3ADDRESS = $ORIGINAL_INT3
  2592. set $pc = $ORIGINAL_INT3ADDRESS
  2593. else
  2594. set *(unsigned char *)$ORIGINAL_INT3ADDRESS = $ORIGINAL_INT3
  2595. if ($64BITS == 1)
  2596. set $rip = $ORIGINAL_INT3ADDRESS
  2597. else
  2598. set $eip = $ORIGINAL_INT3ADDRESS
  2599. end
  2600. end
  2601. end
  2602. document rint3
  2603. Syntax: rint3
  2604. | Restore the original byte previous to int3 patch issued with "int3" command.
  2605. end
  2606. define patch
  2607. if $argc != 3
  2608. help patch
  2609. end
  2610. set $patchaddr = $arg0
  2611. set $patchbytes = $arg1
  2612. set $patchsize = $arg2
  2613. if ($patchsize == 1)
  2614. set *(unsigned char*)$patchaddr = $patchbytes
  2615. end
  2616. if ($patchsize == 2)
  2617. set $lendianbytes = (unsigned short)(($patchbytes << 8) | ($patchbytes >> 8))
  2618. set *(unsigned short*)$patchaddr = $lendianbytes
  2619. end
  2620. if ($patchsize == 4)
  2621. set $lendianbytes = (unsigned int)( (($patchbytes << 8) & 0xFF00FF00 ) | (($patchbytes >> 8) & 0xFF00FF ))
  2622. set $lendianbytes = (unsigned int)($lendianbytes << 0x10 | $lendianbytes >> 0x10)
  2623. set *(unsigned int*)$patchaddr = $lendianbytes
  2624. end
  2625. if ($patchsize == 8)
  2626. set $lendianbytes = (unsigned long long)( (($patchbytes << 8) & 0xFF00FF00FF00FF00ULL ) | (($patchbytes >> 8) & 0x00FF00FF00FF00FFULL ) )
  2627. set $lendianbytes = (unsigned long long)( (($lendianbytes << 0x10) & 0xFFFF0000FFFF0000ULL ) | (($lendianbytes >> 0x10) & 0x0000FFFF0000FFFFULL ) )
  2628. set $lendianbytes = (unsigned long long)( ($lendianbytes << 0x20) | ($lendianbytes >> 0x20) )
  2629. set *(unsigned long long*)$patchaddr = $lendianbytes
  2630. end
  2631. end
  2632. document patch
  2633. Syntax: patch address bytes size
  2634. | Patch a given address, converting the bytes to little-endian.
  2635. | Assumes input bytes are unsigned values and should be in hexadecimal format (0x...).
  2636. | Size must be 1, 2, 4, 8 bytes.
  2637. | Main purpose is to be used with the output from the asm commands.
  2638. end
  2639. # ____________________cflow___________________
  2640. define print_insn_type
  2641. if $argc != 1
  2642. help print_insn_type
  2643. else
  2644. if ($arg0 < 0 || $arg0 > 5)
  2645. printf "UNDEFINED/WRONG VALUE"
  2646. end
  2647. if ($arg0 == 0)
  2648. printf "UNKNOWN"
  2649. end
  2650. if ($arg0 == 1)
  2651. printf "JMP"
  2652. end
  2653. if ($arg0 == 2)
  2654. printf "JCC"
  2655. end
  2656. if ($arg0 == 3)
  2657. printf "CALL"
  2658. end
  2659. if ($arg0 == 4)
  2660. printf "RET"
  2661. end
  2662. if ($arg0 == 5)
  2663. printf "INT"
  2664. end
  2665. end
  2666. end
  2667. document print_insn_type
  2668. Syntax: print_insn_type INSN_TYPE_NUMBER
  2669. | Print human-readable mnemonic for the instruction type (usually $INSN_TYPE).
  2670. end
  2671. define get_insn_type
  2672. if $argc != 1
  2673. help get_insn_type
  2674. else
  2675. set $INSN_TYPE = 0
  2676. set $_byte1 = *(unsigned char *)$arg0
  2677. if ($_byte1 == 0x9A || $_byte1 == 0xE8)
  2678. # "call"
  2679. set $INSN_TYPE = 3
  2680. end
  2681. if ($_byte1 >= 0xE9 && $_byte1 <= 0xEB)
  2682. # "jmp"
  2683. set $INSN_TYPE = 1
  2684. end
  2685. if ($_byte1 >= 0x70 && $_byte1 <= 0x7F)
  2686. # "jcc"
  2687. set $INSN_TYPE = 2
  2688. end
  2689. if ($_byte1 >= 0xE0 && $_byte1 <= 0xE3 )
  2690. # "jcc"
  2691. set $INSN_TYPE = 2
  2692. end
  2693. if ($_byte1 == 0xC2 || $_byte1 == 0xC3 || $_byte1 == 0xCA || \
  2694. $_byte1 == 0xCB || $_byte1 == 0xCF)
  2695. # "ret"
  2696. set $INSN_TYPE = 4
  2697. end
  2698. if ($_byte1 >= 0xCC && $_byte1 <= 0xCE)
  2699. # "int"
  2700. set $INSN_TYPE = 5
  2701. end
  2702. if ($_byte1 == 0x0F )
  2703. # two-byte opcode
  2704. set $_byte2 = *(unsigned char *)($arg0 + 1)
  2705. if ($_byte2 >= 0x80 && $_byte2 <= 0x8F)
  2706. # "jcc"
  2707. set $INSN_TYPE = 2
  2708. end
  2709. end
  2710. if ($_byte1 == 0xFF)
  2711. # opcode extension
  2712. set $_byte2 = *(unsigned char *)($arg0 + 1)
  2713. set $_opext = ($_byte2 & 0x38)
  2714. if ($_opext == 0x10 || $_opext == 0x18)
  2715. # "call"
  2716. set $INSN_TYPE = 3
  2717. end
  2718. if ($_opext == 0x20 || $_opext == 0x28)
  2719. # "jmp"
  2720. set $INSN_TYPE = 1
  2721. end
  2722. end
  2723. end
  2724. end
  2725. document get_insn_type
  2726. Syntax: get_insn_type ADDR
  2727. | Recognize instruction type at address ADDR.
  2728. | Take address ADDR and set the global $INSN_TYPE variable to
  2729. | 0, 1, 2, 3, 4, 5 if the instruction at that address is
  2730. | unknown, a jump, a conditional jump, a call, a return, or an interrupt.
  2731. end
  2732. define step_to_call
  2733. set $_saved_ctx = $SHOW_CONTEXT
  2734. set $SHOW_CONTEXT = 0
  2735. set $SHOW_NEST_INSN = 0
  2736. set logging file /dev/null
  2737. set logging redirect on
  2738. set logging on
  2739. set $_cont = 1
  2740. while ($_cont > 0)
  2741. stepi
  2742. get_insn_type $pc
  2743. if ($INSN_TYPE == 3)
  2744. set $_cont = 0
  2745. end
  2746. end
  2747. set logging off
  2748. if ($_saved_ctx > 0)
  2749. context
  2750. end
  2751. set $SHOW_CONTEXT = $_saved_ctx
  2752. set $SHOW_NEST_INSN = 0
  2753. set logging file ~/gdb.txt
  2754. set logging redirect off
  2755. set logging on
  2756. printf "step_to_call command stopped at:\n "
  2757. x/i $pc
  2758. printf "\n"
  2759. set logging off
  2760. end
  2761. document step_to_call
  2762. Syntax: step_to_call
  2763. | Single step until a call instruction is found.
  2764. | Stop before the call is taken.
  2765. | Log is written into the file ~/gdb.txt.
  2766. end
  2767. define trace_calls
  2768. printf "Tracing...please wait...\n"
  2769. set $_saved_ctx = $SHOW_CONTEXT
  2770. set $SHOW_CONTEXT = 0
  2771. set $SHOW_NEST_INSN = 0
  2772. set $_nest = 1
  2773. set listsize 0
  2774. set logging overwrite on
  2775. set logging file ~/gdb_trace_calls.txt
  2776. set logging on
  2777. set logging off
  2778. set logging overwrite off
  2779. while ($_nest > 0)
  2780. get_insn_type $pc
  2781. # handle nesting
  2782. if ($INSN_TYPE == 3)
  2783. set $_nest = $_nest + 1
  2784. else
  2785. if ($INSN_TYPE == 4)
  2786. set $_nest = $_nest - 1
  2787. end
  2788. end
  2789. # if a call, print it
  2790. if ($INSN_TYPE == 3)
  2791. set logging file ~/gdb_trace_calls.txt
  2792. set logging redirect off
  2793. set logging on
  2794. set $x = $_nest - 2
  2795. while ($x > 0)
  2796. printf "\t"
  2797. set $x = $x - 1
  2798. end
  2799. x/i $pc
  2800. end
  2801. set logging off
  2802. set logging file /dev/null
  2803. set logging redirect on
  2804. set logging on
  2805. stepi
  2806. set logging redirect off
  2807. set logging off
  2808. end
  2809. set $SHOW_CONTEXT = $_saved_ctx
  2810. set $SHOW_NEST_INSN = 0
  2811. printf "Done, check ~/gdb_trace_calls.txt\n"
  2812. end
  2813. document trace_calls
  2814. Syntax: trace_calls
  2815. | Create a runtime trace of the calls made by target.
  2816. | Log overwrites(!) the file ~/gdb_trace_calls.txt.
  2817. end
  2818. define trace_run
  2819. printf "Tracing...please wait...\n"
  2820. set $_saved_ctx = $SHOW_CONTEXT
  2821. set $SHOW_CONTEXT = 0
  2822. set $SHOW_NEST_INSN = 1
  2823. set logging overwrite on
  2824. set logging file ~/gdb_trace_run.txt
  2825. set logging redirect on
  2826. set logging on
  2827. set $_nest = 1
  2828. while ( $_nest > 0 )
  2829. get_insn_type $pc
  2830. # jmp, jcc, or cll
  2831. if ($INSN_TYPE == 3)
  2832. set $_nest = $_nest + 1
  2833. else
  2834. # ret
  2835. if ($INSN_TYPE == 4)
  2836. set $_nest = $_nest - 1
  2837. end
  2838. end
  2839. stepi
  2840. end
  2841. printf "\n"
  2842. set $SHOW_CONTEXT = $_saved_ctx
  2843. set $SHOW_NEST_INSN = 0
  2844. set logging redirect off
  2845. set logging off
  2846. # clean up trace file
  2847. shell grep -v ' at ' ~/gdb_trace_run.txt > ~/gdb_trace_run.1
  2848. shell grep -v ' in ' ~/gdb_trace_run.1 > ~/gdb_trace_run.txt
  2849. shell rm -f ~/gdb_trace_run.1
  2850. printf "Done, check ~/gdb_trace_run.txt\n"
  2851. end
  2852. document trace_run
  2853. Syntax: trace_run
  2854. | Create a runtime trace of target.
  2855. | Log overwrites(!) the file ~/gdb_trace_run.txt.
  2856. end
  2857. define entry_point
  2858. set logging redirect on
  2859. set logging file /tmp/gdb-entry_point
  2860. set logging on
  2861. info files
  2862. set logging off
  2863. shell entry_point="$(/usr/bin/grep 'Entry point:' /tmp/gdb-entry_point | /usr/bin/awk '{ print $3 }')"; echo "$entry_point"; echo 'set $entry_point_address = '"$entry_point" > /tmp/gdb-entry_point
  2864. source /tmp/gdb-entry_point
  2865. shell /bin/rm -f /tmp/gdb-entry_point
  2866. end
  2867. document entry_point
  2868. Syntax: entry_point
  2869. | Prints the entry point address of the target and stores it in the variable entry_point.
  2870. end
  2871. define break_entrypoint
  2872. entry_point
  2873. break *$entry_point_address
  2874. end
  2875. document break_entrypoint
  2876. Syntax: break_entrypoint
  2877. | Sets a breakpoint on the entry point of the target.
  2878. end
  2879. define objc_symbols
  2880. set logging redirect on
  2881. set logging file /tmp/gdb-objc_symbols
  2882. set logging on
  2883. info target
  2884. set logging off
  2885. # XXX: define paths for objc-symbols and SymTabCreator
  2886. shell target="$(/usr/bin/head -1 /tmp/gdb-objc_symbols | /usr/bin/head -1 | /usr/bin/awk -F '"' '{ print $2 }')"; objc-symbols "$target" | SymTabCreator -o /tmp/gdb-symtab
  2887. set logging on
  2888. add-symbol-file /tmp/gdb-symtab
  2889. set logging off
  2890. shell /bin/rm -f /tmp/gdb-objc_symbols
  2891. end
  2892. document objc_symbols
  2893. Syntax: objc_symbols
  2894. | Loads stripped objc symbols into gdb using objc-symbols and SymTabCreator
  2895. | See http://stackoverflow.com/questions/17554070/import-class-dump-info-into-gdb
  2896. | and https://github.com/0xced/class-dump/tree/objc-symbols (for the required utils)
  2897. end
  2898. #define ptraceme
  2899. # catch syscall ptrace
  2900. # commands
  2901. # if ($64BITS == 0)
  2902. # if ($ebx == 0)
  2903. # set $eax = 0
  2904. # continue
  2905. # end
  2906. # else
  2907. # if ($rdi == 0)
  2908. # set $rax = 0
  2909. # continue
  2910. # end
  2911. # end
  2912. # end
  2913. # set $ptrace_bpnum = $bpnum
  2914. #end
  2915. #document ptraceme
  2916. #Syntax: ptraceme
  2917. #| Hook ptrace to bypass PTRACE_TRACEME anti debugging technique
  2918. #end
  2919. define rptraceme
  2920. if ($ptrace_bpnum != 0)
  2921. delete $ptrace_bpnum
  2922. set $ptrace_bpnum = 0
  2923. end
  2924. end
  2925. document rptraceme
  2926. Syntax: rptraceme
  2927. | Remove ptrace hook.
  2928. end
  2929. # ____________________misc____________________
  2930. define hook-stop
  2931. if (sizeof(void*) == 8)
  2932. set $64BITS = 1
  2933. else
  2934. set $64BITS = 0
  2935. end
  2936. if ($KDP64BITS != -1)
  2937. if ($KDP64BITS == 0)
  2938. set $64BITS = 0
  2939. else
  2940. set $64BITS = 1
  2941. end
  2942. end
  2943. # Display instructions formats
  2944. if $ARM == 1
  2945. if $ARMOPCODES == 1
  2946. set arm show-opcode-bytes 1
  2947. end
  2948. else
  2949. if $X86FLAVOR == 0
  2950. set disassembly-flavor intel
  2951. else
  2952. set disassembly-flavor att
  2953. end
  2954. end
  2955. # this makes 'context' be called at every BP/step
  2956. if ($SHOW_CONTEXT > 0)
  2957. context
  2958. end
  2959. if ($SHOW_NEST_INSN > 0)
  2960. set $x = $_nest
  2961. while ($x > 0)
  2962. printf "\t"
  2963. set $x = $x - 1
  2964. end
  2965. end
  2966. end
  2967. document hook-stop
  2968. Syntax: hook-stop
  2969. | !!! FOR INTERNAL USE ONLY - DO NOT CALL !!!
  2970. end
  2971. # original by Tavis Ormandy (http://my.opera.com/taviso/blog/index.dml/tag/gdb) (great fix!)
  2972. # modified to work with Mac OS X by fG!
  2973. # seems nasm shipping with Mac OS X has problems accepting input from stdin or heredoc
  2974. # input is read into a variable and sent to a temporary file which nasm can read
  2975. define assemble
  2976. # dont enter routine again if user hits enter
  2977. dont-repeat
  2978. if ($argc)
  2979. if (*$arg0 = *$arg0)
  2980. # check if we have a valid address by dereferencing it,
  2981. # if we havnt, this will cause the routine to exit.
  2982. end
  2983. printf "Instructions will be written to %#x.\n", $arg0
  2984. else
  2985. printf "Instructions will be written to stdout.\n"
  2986. end
  2987. printf "Type instructions, one per line."
  2988. color_bold
  2989. printf " Do not forget to use NASM assembler syntax!\n"
  2990. color_reset
  2991. printf "End with a line saying just \"end\".\n"
  2992. if ($argc)
  2993. if ($64BITS == 1)
  2994. # argument specified, assemble instructions into memory at address specified.
  2995. shell ASMOPCODE="$(while read -ep '>' r && test "$r" != end ; do echo -E "$r"; done)" ; GDBASMFILENAME=$RANDOM; \
  2996. echo -e "BITS 64\n$ASMOPCODE" >/tmp/$GDBASMFILENAME ; /usr/local/bin/nasm -f bin -o /dev/stdout /tmp/$GDBASMFILENAME | /usr/bin/hexdump -ve '1/1 "set *((unsigned char *) $arg0 + %#2_ax) = %#02x\n"' >/tmp/gdbassemble ; /bin/rm -f /tmp/$GDBASMFILENAME
  2997. source /tmp/gdbassemble
  2998. # all done. clean the temporary file
  2999. shell /bin/rm -f /tmp/gdbassemble
  3000. else
  3001. # argument specified, assemble instructions into memory at address specified.
  3002. shell ASMOPCODE="$(while read -ep '>' r && test "$r" != end ; do echo -E "$r"; done)" ; GDBASMFILENAME=$RANDOM; \
  3003. echo -e "BITS 32\n$ASMOPCODE" >/tmp/$GDBASMFILENAME ; /usr/bin/nasm -f bin -o /dev/stdout /tmp/$GDBASMFILENAME | /usr/bin/hexdump -ve '1/1 "set *((unsigned char *) $arg0 + %#2_ax) = %#02x\n"' >/tmp/gdbassemble ; /bin/rm -f /tmp/$GDBASMFILENAME
  3004. source /tmp/gdbassemble
  3005. # all done. clean the temporary file
  3006. shell /bin/rm -f /tmp/gdbassemble
  3007. end
  3008. else
  3009. if ($64BITS == 1)
  3010. # no argument, assemble instructions to stdout
  3011. shell ASMOPCODE="$(while read -ep '>' r && test "$r" != end ; do echo -E "$r"; done)" ; GDBASMFILENAME=$RANDOM; \
  3012. echo -e "BITS 64\n$ASMOPCODE" >/tmp/$GDBASMFILENAME ; /usr/local/bin/nasm -f bin -o /dev/stdout /tmp/$GDBASMFILENAME | /usr/local/bin/ndisasm -i -b64 /dev/stdin ; \
  3013. /bin/rm -f /tmp/$GDBASMFILENAME
  3014. else
  3015. # no argument, assemble instructions to stdout
  3016. shell ASMOPCODE="$(while read -ep '>' r && test "$r" != end ; do echo -E "$r"; done)" ; GDBASMFILENAME=$RANDOM; \
  3017. echo -e "BITS 32\n$ASMOPCODE" >/tmp/$GDBASMFILENAME ; /usr/bin/nasm -f bin -o /dev/stdout /tmp/$GDBASMFILENAME | /usr/bin/ndisasm -i -b32 /dev/stdin ; \
  3018. /bin/rm -f /tmp/$GDBASMFILENAME
  3019. end
  3020. end
  3021. end
  3022. document assemble
  3023. Syntax: assemble <ADDR>
  3024. | Assemble instructions using nasm.
  3025. | Type a line containing "end" to indicate the end.
  3026. | If an address is specified, insert/modify instructions at that address.
  3027. | If no address is specified, assembled instructions are printed to stdout.
  3028. | Use the pseudo instruction "org ADDR" to set the base address.
  3029. end
  3030. define assemble32
  3031. # dont enter routine again if user hits enter
  3032. dont-repeat
  3033. if ($argc)
  3034. if (*$arg0 = *$arg0)
  3035. # check if we have a valid address by dereferencing it,
  3036. # if we havnt, this will cause the routine to exit.
  3037. end
  3038. printf "Instructions will be written to %#x.\n", $arg0
  3039. else
  3040. printf "Instructions will be written to stdout.\n"
  3041. end
  3042. printf "Type instructions, one per line."
  3043. color_bold
  3044. printf " Do not forget to use NASM assembler syntax!\n"
  3045. color_reset
  3046. printf "End with a line saying just \"end\".\n"
  3047. if ($argc)
  3048. # argument specified, assemble instructions into memory at address specified.
  3049. shell ASMOPCODE="$(while read -ep '>' r && test "$r" != end ; do echo -E "$r"; done)" ; GDBASMFILENAME=$RANDOM; \
  3050. echo -e "BITS 32\n$ASMOPCODE" >/tmp/$GDBASMFILENAME ; /usr/bin/nasm -f bin -o /dev/stdout /tmp/$GDBASMFILENAME | /usr/bin/hexdump -ve '1/1 "set *((unsigned char *) $arg0 + %#2_ax) = %#02x\n"' >/tmp/gdbassemble ; /bin/rm -f /tmp/$GDBASMFILENAME
  3051. source /tmp/gdbassemble
  3052. # all done. clean the temporary file
  3053. shell /bin/rm -f /tmp/gdbassemble
  3054. else
  3055. # no argument, assemble instructions to stdout
  3056. shell ASMOPCODE="$(while read -ep '>' r && test "$r" != end ; do echo -E "$r"; done)" ; GDBASMFILENAME=$RANDOM; \
  3057. echo -e "BITS 32\n$ASMOPCODE" >/tmp/$GDBASMFILENAME ; /usr/bin/nasm -f bin -o /dev/stdout /tmp/$GDBASMFILENAME | /usr/bin/ndisasm -i -b32 /dev/stdin ; \
  3058. /bin/rm -f /tmp/$GDBASMFILENAME
  3059. end
  3060. end
  3061. document assemble32
  3062. Syntax: assemble32 <ADDR>
  3063. | Assemble 32 bits instructions using nasm.
  3064. | Type a line containing "end" to indicate the end.
  3065. | If an address is specified, insert/modify instructions at that address.
  3066. | If no address is specified, assembled instructions are printed to stdout.
  3067. | Use the pseudo instruction "org ADDR" to set the base address.
  3068. end
  3069. define assemble64
  3070. # dont enter routine again if user hits enter
  3071. dont-repeat
  3072. if ($argc)
  3073. if (*$arg0 = *$arg0)
  3074. # check if we have a valid address by dereferencing it,
  3075. # if we havnt, this will cause the routine to exit.
  3076. end
  3077. printf "Instructions will be written to %#x.\n", $arg0
  3078. else
  3079. printf "Instructions will be written to stdout.\n"
  3080. end
  3081. printf "Type instructions, one per line."
  3082. color_bold
  3083. printf " Do not forget to use NASM assembler syntax!\n"
  3084. color_reset
  3085. printf "End with a line saying just \"end\".\n"
  3086. if ($argc)
  3087. # argument specified, assemble instructions into memory at address specified.
  3088. shell ASMOPCODE="$(while read -ep '>' r && test "$r" != end ; do echo -E "$r"; done)" ; GDBASMFILENAME=$RANDOM; \
  3089. echo -e "BITS 64\n$ASMOPCODE" >/tmp/$GDBASMFILENAME ; /usr/local/bin/nasm -f bin -o /dev/stdout /tmp/$GDBASMFILENAME | /usr/bin/hexdump -ve '1/1 "set *((unsigned char *) $arg0 + %#2_ax) = %#02x\n"' >/tmp/gdbassemble ; /bin/rm -f /tmp/$GDBASMFILENAME
  3090. source /tmp/gdbassemble
  3091. # all done. clean the temporary file
  3092. shell /bin/rm -f /tmp/gdbassemble
  3093. else
  3094. # no argument, assemble instructions to stdout
  3095. shell ASMOPCODE="$(while read -ep '>' r && test "$r" != end ; do echo -E "$r"; done)" ; GDBASMFILENAME=$RANDOM; \
  3096. echo -e "BITS 64\n$ASMOPCODE" >/tmp/$GDBASMFILENAME ; /usr/local/bin/nasm -f bin -o /dev/stdout /tmp/$GDBASMFILENAME | /usr/local/bin/ndisasm -i -b64 /dev/stdin ; \
  3097. /bin/rm -f /tmp/$GDBASMFILENAME
  3098. end
  3099. end
  3100. document assemble64
  3101. Syntax: assemble64 <ADDR>
  3102. | Assemble 64 bits instructions using nasm.
  3103. | Type a line containing "end" to indicate the end.
  3104. | If an address is specified, insert/modify instructions at that address.
  3105. | If no address is specified, assembled instructions are printed to stdout.
  3106. | Use the pseudo instruction "org ADDR" to set the base address.
  3107. end
  3108. define asm
  3109. if $argc == 1
  3110. assemble $arg0
  3111. else
  3112. assemble
  3113. end
  3114. end
  3115. document asm
  3116. Syntax: asm <ADDR>
  3117. | Shortcut to the asssemble command.
  3118. end
  3119. define asm32
  3120. if $argc == 1
  3121. assemble32 $arg0
  3122. else
  3123. assemble32
  3124. end
  3125. end
  3126. document asm32
  3127. Syntax: asm32 <ADDR>
  3128. | Shortcut to the assemble32 command.
  3129. end
  3130. define asm64
  3131. if $argc == 1
  3132. assemble64 $arg0
  3133. else
  3134. assemble64
  3135. end
  3136. end
  3137. document asm64
  3138. Syntax: asm64 <ADDR>
  3139. | Shortcut to the assemble64 command.
  3140. end
  3141. define assemble_gas
  3142. printf "\nType code to assemble and hit Ctrl-D when finished.\n"
  3143. printf "You must use GNU assembler (AT&T) syntax.\n"
  3144. shell filename=$(mktemp); \
  3145. binfilename=$(mktemp); \
  3146. echo -e "Writing into: ${filename}\n"; \
  3147. cat > $filename; echo ""; \
  3148. as -o $binfilename < $filename; \
  3149. objdump -d -j .text $binfilename; \
  3150. rm -f $binfilename; \
  3151. rm -f $filename; \
  3152. echo -e "temporaly files deleted.\n"
  3153. end
  3154. document assemble_gas
  3155. Syntax: assemble_gas
  3156. | Assemble instructions to binary opcodes. Uses GNU as and objdump.
  3157. end
  3158. define dump_hexfile
  3159. dump ihex memory $arg0 $arg1 $arg2
  3160. end
  3161. document dump_hexfile
  3162. Syntax: dump_hexfile FILENAME ADDR1 ADDR2
  3163. | Write a range of memory to a file in Intel ihex (hexdump) format.
  3164. | The range is specified by ADDR1 and ADDR2 addresses.
  3165. end
  3166. define dump_binfile
  3167. dump memory $arg0 $arg1 $arg2
  3168. end
  3169. document dump_binfile
  3170. Syntax: dump_binfile FILENAME ADDR1 ADDR2
  3171. | Write a range of memory to a binary file.
  3172. | The range is specified by ADDR1 and ADDR2 addresses.
  3173. end
  3174. define dumpmacho
  3175. if $argc != 2
  3176. help dumpmacho
  3177. end
  3178. set $headermagic = *$arg0
  3179. # the || operator isn't working as it should, wtf!!!
  3180. if $headermagic != 0xfeedface
  3181. if $headermagic != 0xfeedfacf
  3182. printf "[Error] Target address doesn't contain a valid Mach-O binary!\n"
  3183. help dumpmacho
  3184. end
  3185. end
  3186. set $headerdumpsize = *($arg0+0x14)
  3187. if $headermagic == 0xfeedface
  3188. dump memory $arg1 $arg0 ($arg0+0x1c+$headerdumpsize)
  3189. end
  3190. if $headermagic == 0xfeedfacf
  3191. dump memory $arg1 $arg0 ($arg0+0x20+$headerdumpsize)
  3192. end
  3193. end
  3194. document dumpmacho
  3195. Syntax: dumpmacho STARTADDRESS FILENAME
  3196. | Dump the Mach-O header to a file.
  3197. | You need to input the start address (use info shared command to find it).
  3198. end
  3199. define cls
  3200. shell clear
  3201. end
  3202. document cls
  3203. Syntax: cls
  3204. | Clear screen.
  3205. end
  3206. define search
  3207. set $start = (char *) $arg0
  3208. set $end = (char *) $arg1
  3209. set $pattern = (short) $arg2
  3210. set $p = $start
  3211. while $p < $end
  3212. if (*(short *) $p) == $pattern
  3213. printf "pattern 0x%hx found at 0x%x\n", $pattern, $p
  3214. end
  3215. set $p++
  3216. end
  3217. end
  3218. document search
  3219. Syntax: search <START> <END> <PATTERN>
  3220. | Search for the given pattern beetween $start and $end address.
  3221. end
  3222. # _________________user tips_________________
  3223. # The 'tips' command is used to provide tutorial-like info to the user
  3224. define tips
  3225. printf "Tip Topic Commands:\n"
  3226. printf "\ttip_display : Automatically display values on each break\n"
  3227. printf "\ttip_patch : Patching binaries\n"
  3228. printf "\ttip_strip : Dealing with stripped binaries\n"
  3229. printf "\ttip_syntax : AT&T vs Intel syntax\n"
  3230. end
  3231. document tips
  3232. Syntax: tips
  3233. | Provide a list of tips from users on various topics.
  3234. end
  3235. define tip_patch
  3236. printf "\n"
  3237. printf " PATCHING MEMORY\n"
  3238. printf "Any address can be patched using the 'set' command:\n"
  3239. printf "\t`set ADDR = VALUE` \te.g. `set *0x8049D6E = 0x90`\n"
  3240. printf "\n"
  3241. printf " PATCHING BINARY FILES\n"
  3242. printf "Use `set write` in order to patch the target executable\n"
  3243. printf "directly, instead of just patching memory\n"
  3244. printf "\t`set write on` \t`set write off`\n"
  3245. printf "Note that this means any patches to the code or data segments\n"
  3246. printf "will be written to the executable file\n"
  3247. printf "When either of these commands has been issued,\n"
  3248. printf "the file must be reloaded.\n"
  3249. printf "\n"
  3250. end
  3251. document tip_patch
  3252. Syntax: tip_patch
  3253. | Tips on patching memory and binary files.
  3254. end
  3255. define tip_strip
  3256. printf "\n"
  3257. printf " STOPPING BINARIES AT ENTRY POINT\n"
  3258. printf "Stripped binaries have no symbols, and are therefore tough to\n"
  3259. printf "start automatically. To debug a stripped binary, use\n"
  3260. printf "\tinfo file\n"
  3261. printf "to get the entry point of the file\n"
  3262. printf "The first few lines of output will look like this:\n"
  3263. printf "\tSymbols from '/tmp/a.out'\n"
  3264. printf "\tLocal exec file:\n"
  3265. printf "\t `/tmp/a.out', file type elf32-i386.\n"
  3266. printf "\t Entry point: 0x80482e0\n"
  3267. printf "Use this entry point to set an entry point:\n"
  3268. printf "\t`tbreak *0x80482e0`\n"
  3269. printf "The breakpoint will delete itself after the program stops as\n"
  3270. printf "the entry point\n"
  3271. printf "\n"
  3272. end
  3273. document tip_strip
  3274. Syntax: tip_strip
  3275. | Tips on dealing with stripped binaries.
  3276. end
  3277. define tip_syntax
  3278. printf "\n"
  3279. printf "\t INTEL SYNTAX AT&T SYNTAX\n"
  3280. printf "\tmnemonic dest, src, imm mnemonic src, dest, imm\n"
  3281. printf "\t[base+index*scale+disp] disp(base, index, scale)\n"
  3282. printf "\tregister: eax register: %%eax\n"
  3283. printf "\timmediate: 0xFF immediate: $0xFF\n"
  3284. printf "\tdereference: [addr] dereference: addr(,1)\n"
  3285. printf "\tabsolute addr: addr absolute addr: *addr\n"
  3286. printf "\tbyte insn: mov byte ptr byte insn: movb\n"
  3287. printf "\tword insn: mov word ptr word insn: movw\n"
  3288. printf "\tdword insn: mov dword ptr dword insn: movd\n"
  3289. printf "\tfar call: call far far call: lcall\n"
  3290. printf "\tfar jump: jmp far far jump: ljmp\n"
  3291. printf "\n"
  3292. printf "Note that order of operands in reversed, and that AT&T syntax\n"
  3293. printf "requires that all instructions referencing memory operands \n"
  3294. printf "use an operand size suffix (b, w, d, q)\n"
  3295. printf "\n"
  3296. end
  3297. document tip_syntax
  3298. Syntax: tip_syntax
  3299. | Summary of Intel and AT&T syntax differences.
  3300. end
  3301. define tip_display
  3302. printf "\n"
  3303. printf "Any expression can be set to automatically be displayed every time\n"
  3304. printf "the target stops. The commands for this are:\n"
  3305. printf "\t`display expr' : automatically display expression 'expr'\n"
  3306. printf "\t`display' : show all displayed expressions\n"
  3307. printf "\t`undisplay num' : turn off autodisplay for expression # 'num'\n"
  3308. printf "Examples:\n"
  3309. printf "\t`display/x *(int *)$esp` : print top of stack\n"
  3310. printf "\t`display/x *(int *)($ebp+8)` : print first parameter\n"
  3311. printf "\t`display (char *)$esi` : print source string\n"
  3312. printf "\t`display (char *)$edi` : print destination string\n"
  3313. printf "\n"
  3314. end
  3315. document tip_display
  3316. Syntax: tip_display
  3317. | Tips on automatically displaying values when a program stops.
  3318. end
  3319. # bunch of semi-useless commands
  3320. # enable and disable shortcuts for stop-on-solib-events fantastic trick!
  3321. define enablesolib
  3322. set stop-on-solib-events 1
  3323. printf "Stop-on-solib-events is enabled!\n"
  3324. end
  3325. document enablesolib
  3326. Syntax: enablesolib
  3327. | Shortcut to enable stop-on-solib-events trick.
  3328. end
  3329. define disablesolib
  3330. set stop-on-solib-events 0
  3331. printf "Stop-on-solib-events is disabled!\n"
  3332. end
  3333. document disablesolib
  3334. Syntax: disablesolib
  3335. | Shortcut to disable stop-on-solib-events trick.
  3336. end
  3337. # enable commands for different displays
  3338. define enabledisasm
  3339. set $SHOWDISASM = 1
  3340. end
  3341. document enabledisasm
  3342. Syntax: enabledisasm
  3343. | Enable disassembly display.
  3344. end
  3345. define enableobjectivec
  3346. set $SHOWOBJECTIVEC = 1
  3347. end
  3348. document enableobjectivec
  3349. Syntax: enableobjectivec
  3350. | Enable display of objective-c information in the context window.
  3351. end
  3352. define enablecpuregisters
  3353. set $SHOWCPUREGISTERS = 1
  3354. end
  3355. document enablecpuregisters
  3356. Syntax: enablecpuregisters
  3357. | Enable display of cpu registers in the context window.
  3358. end
  3359. define enablestack
  3360. set $SHOWSTACK = 1
  3361. end
  3362. document enablestack
  3363. Syntax: enablestack
  3364. | Enable display of stack in the context window.
  3365. end
  3366. define enabledatawin
  3367. set $SHOWDATAWIN = 1
  3368. end
  3369. document enabledatawin
  3370. Syntax: enabledatawin
  3371. | Enable display of data window in the context window.
  3372. end
  3373. # disable commands for different displays
  3374. define disabledisasm
  3375. set $SHOWDISASM = 0
  3376. end
  3377. document disabledisasm
  3378. Syntax: disabledisasm
  3379. | Disable disassembly display.
  3380. end
  3381. define disableobjectivec
  3382. set $SHOWOBJECTIVEC = 0
  3383. end
  3384. document disableobjectivec
  3385. Syntax: disableobjectivec
  3386. | Disable display of objective-c information in the context window.
  3387. end
  3388. define disablecpuregisters
  3389. set $SHOWCPUREGISTERS = 0
  3390. end
  3391. document disablecpuregisters
  3392. Syntax: disablecpuregisters
  3393. | Disable display of cpu registers in the context window.
  3394. end
  3395. define disablestack
  3396. set $SHOWSTACK = 0
  3397. end
  3398. document disablestack
  3399. Syntax: disablestack
  3400. | Disable display of stack information in the context window.
  3401. end
  3402. define disabledatawin
  3403. set $SHOWDATAWIN = 0
  3404. end
  3405. document disabledatawin
  3406. Syntax: disabledatawin
  3407. | Disable display of data window in the context window.
  3408. end
  3409. define arm
  3410. if $ARMOPCODES == 1
  3411. set arm show-opcode-bytes 1
  3412. end
  3413. set $ARM = 1
  3414. end
  3415. document arm
  3416. Syntax: arm
  3417. | Set gdb to work with ARM binaries.
  3418. end
  3419. define ioskdp
  3420. set $SHOW_CONTEXT = 0
  3421. set $SHOW_NEST_INSN = 0
  3422. end
  3423. document ioskdp
  3424. Syntax: ioskdp
  3425. | Disable dumping context information for iOS KDP debugging
  3426. end
  3427. define intelsyntax
  3428. if $ARM == 0
  3429. set disassembly-flavor intel
  3430. set $X86FLAVOR = 0
  3431. end
  3432. end
  3433. document intelsyntax
  3434. Syntax: intelsyntax
  3435. | Change disassembly syntax to intel flavor.
  3436. end
  3437. define attsyntax
  3438. if $ARM == 0
  3439. set disassembly-flavor att
  3440. set $X86FLAVOR = 1
  3441. end
  3442. end
  3443. document attsyntax
  3444. Syntax: attsyntax
  3445. | Change disassembly syntax to at&t flavor.
  3446. end
  3447. define kernel32
  3448. if $argc != 0
  3449. # try to load kgmacros files
  3450. # failure is silent if non-existent...
  3451. source $arg0
  3452. set architecture i386
  3453. if $argc == 2
  3454. target remote localhost:$arg1
  3455. else
  3456. target remote localhost:8832
  3457. end
  3458. else
  3459. help kernel32
  3460. end
  3461. end
  3462. document kernel32
  3463. Syntax: kernel32 PATH_TO_KGMACROS <PORT>
  3464. | Attach to VMware gdb stub for 32 bits kernel.
  3465. | The path to kgmacros must be supplied as first parameter.
  3466. | If you don't want to load kgmacros just put something as the first parameter.
  3467. | Optional parameter is the port to connect to, in case you are not using the default 8832
  3468. | or want to kernel debug more than one active virtual machine.
  3469. | By supplying a bogus kgmacros this command should be compatible with any OS.
  3470. end
  3471. define kernel64
  3472. if $argc != 0
  3473. # try to load kgmacros files
  3474. # failure is silent if non-existent...
  3475. source $arg0
  3476. set architecture i386:x86-64
  3477. if $argc == 2
  3478. target remote localhost:$arg1
  3479. else
  3480. target remote localhost:8864
  3481. end
  3482. else
  3483. help kernel64
  3484. end
  3485. end
  3486. document kernel64
  3487. Syntax: kernel64 PATH_TO_KGMACROS <PORT>
  3488. | Attach to VMware gdb stub for 64 bits kernel.
  3489. | The path to kgmacros must be supplied as first parameter.
  3490. | If you don't want to load kgmacros just put something as the first parameter.
  3491. | Optional parameter is the port to connect to, in case you are not using the default 8864
  3492. | or want to kernel debug more than one active virtual machine.
  3493. | By supplying a bogus kgmacros this command should be compatible with any OS.
  3494. end
  3495. define 32bits
  3496. set $KDP64BITS = 0
  3497. set $64BITS = 0
  3498. end
  3499. define 64bits
  3500. set $KDP64BITS = 1
  3501. set $64BITS = 1
  3502. end
  3503. define resetkdp
  3504. set $KDP64BITS = -1
  3505. end
  3506. define header
  3507. if $argc != 1
  3508. help header
  3509. else
  3510. dump memory /tmp/gdbinit_header_dump $arg0 $arg0 + 4096
  3511. shell /usr/bin/otool -h /tmp/gdbinit_header_dump
  3512. shell /bin/rm -f /tmp/gdbinit_header_dump
  3513. end
  3514. end
  3515. document header
  3516. Syntax: header MACHO_HEADER_START_ADDRESS
  3517. | Dump the Mach-O header located at given address
  3518. end
  3519. define loadcmds
  3520. if $argc != 1
  3521. help loadcmds
  3522. else
  3523. # this size should be good enough for most binaries
  3524. dump memory /tmp/gdbinit_header_dump $arg0 $arg0 + 4096 * 10
  3525. shell /usr/bin/otool -l /tmp/gdbinit_header_dump
  3526. shell /bin/rm -f /tmp/gdbinit_header_dump
  3527. end
  3528. end
  3529. document loadcmds
  3530. Syntax: loadcmds MACHO_HEADER_START_ADDRESS
  3531. | Dump the Mach-O load commands
  3532. end
  3533. # defining it here doesn't get the space #$#$%"#!
  3534. define disablecolorprompt
  3535. set prompt gdb$
  3536. end
  3537. document disablecolorprompt
  3538. | Remove color from prompt
  3539. end
  3540. define enablecolorprompt
  3541. set prompt \033[31mgdb$ \033[0m
  3542. end
  3543. document enablecolorprompt
  3544. | Enable color prompt
  3545. end
  3546. #EOF
  3547. # Older change logs:
  3548. # Version 8.0.6 (05/09/2013)
  3549. # - Add patch command to convert bytes to little-endian and patch memory
  3550. #
  3551. # Version 8.0.5 (18/08/2013)
  3552. # - Add commands header and loadcmds to dump Mach-O header information
  3553. # - Other fixes and additions from previous commits
  3554. #
  3555. # Version 8.0.4 (08/05/2013)
  3556. # - Detect automatically 32 or 64 bits archs using sizeof(void*).
  3557. # Thanks to Tyilo for the simple but very effective idea!
  3558. # - Typo in hexdump command also fixed by vuquangtrong.
  3559. # - Add shortcuts to attach to VMware kernel debugging gdb stub (kernel32 and kernel64)
  3560. #
  3561. # Version 8.0.3 (21/03/2013)
  3562. # - Add option to colorize or not output (thanks to argp and skier for the request and ideas!)
  3563. # - Convert the escape codes into functions so colors can be easily customized
  3564. # - Other enhancements available at git commit logs
  3565. # Thanks to Plouj, argp, xristos for their ideas and fixes!
  3566. #
  3567. # Version 8.0.2 (31/07/2012)
  3568. # - Merge pull request from mheistermann to support local modifications in a .gdbinit.local file
  3569. # - Add a missing opcode to the stepo command
  3570. #
  3571. # Version 8.0.1 (23/04/2012)
  3572. # - Small bug fix to the attsyntax and intelsyntax commands (changing X86 flavor variable was missing)
  3573. #
  3574. # Version 8.0 (13/04/2012)
  3575. # - Merged x86/x64 and ARM versions
  3576. # - Added commands intelsyntax and attsyntax to switch between x86 disassembly flavors
  3577. # - Added new configuration variables ARM, ARMOPCODES, and X86FLAVOR
  3578. # - Code cleanups and fixes to the indentation
  3579. # - Bug fixes to some ARM related code
  3580. # - Added the dumpmacho command to memory dump the mach-o header to a file
  3581. #
  3582. # Version 7.4.4 (02/01/2012)
  3583. # - Added the "skip" command. This will jump to the next instruction after EIP/RIP without executing the current one.
  3584. # Thanks to @bSr43 for the tip to retrieve the current instruction size.
  3585. #
  3586. # Version 7.4.3 (04/11/2011)
  3587. # - Modified "hexdump" command to support a variable number of lines (optional parameter)
  3588. # - Removed restrictions on type of addresses in the "dd" command - Thanks to Plouj for the warning :-)
  3589. # I don't know what was the original thinking behind those :-)
  3590. # - Modified the assemble command to support 64bits - You will need to recompile nasm since the version shipped with OS X doesn't supports 64bits (www.nasm.us).
  3591. # Assumes that the new binary is installed at /usr/local/bin - modify the variable at the top if you need so.
  3592. # It will assemble based on the target arch being debugged. If you want to use gdb for a quick asm just use the 32bits or 64bits commands to set your target.
  3593. # Thanks to snare for the warning and original patch :-)
  3594. # - Added "asm" command - it's a shortcut to the "assemble" command.
  3595. # - Added configuration variable for colorized prompt. Plouj reported some issues with Ubuntu's gdb 7.2 if prompt is colorized.
  3596. #
  3597. # Version 7.4.2 (11/08/2011)
  3598. # Small fix to a weird bug happening on FreeBSD 8.2. It doesn't like a "if(" instruction, needs to be "if (". Weird!
  3599. # Many thanks to Evan for reporting and sending the patch :-)
  3600. # Added the ptraceme/rptraceme commands to bypass PTRACE_TRACME anti-debugging technique.
  3601. # Grabbed this from http://falken.tuxfamily.org/?p=171
  3602. # It's commented out due to a gdb problem in OS X (refer to http://reverse.put.as/2011/08/20/another-patch-for-apples-gdb-the-definecommands-problem/ )
  3603. # Just uncomment it if you want to use in ptrace enabled systems.
  3604. #
  3605. # Version 7.4.1 (21/06/2011) - fG!
  3606. # Added patch sent by sbz, more than 1 year ago, which I forgot to add :-/
  3607. # This will allow to search for a given pattern between start and end address.
  3608. # On sbz words: "It's usefull to find call, ret or everything like that." :-)
  3609. # New command is "search"
  3610. #
  3611. # Version 7.4 (20/06/2011) - fG!
  3612. # When registers change between instructions the color will change to red (like it happens in OllyDBG)
  3613. # This is the default behavior, if you don't like it, modify the variable SHOWREGCHANGES
  3614. # Added patch sent by Philippe Langlois
  3615. # color the first disassembly line - change the setting below on SETCOLOR1STLINE - by default it's disabled
  3616. #
  3617. # Version 7.3.2 (21/02/2011) - fG!
  3618. # Added the command rint3 and modified the int3 command. The new command will restore the byte in previous int3 patch.
  3619. #
  3620. # Version 7.3.1 (29/06/2010) - fG!
  3621. # Added enablelib/disablelib command to quickly set the stop-on-solib-events trick
  3622. # Implemented the stepoh command equivalent to the stepo but using hardware breakpoints
  3623. # More fixes to stepo
  3624. #
  3625. # Version 7.3 (16/04/2010) - fG!
  3626. # Support for 64bits targets. Default is 32bits, you should modify the variable or use the 32bits or 64bits to choose the mode.
  3627. # I couldn't find another way to recognize the type of binary… Testing the register doesn't work that well.
  3628. # TODO: fix objectivec messages and stepo for 64bits
  3629. # Version 7.2.1 (24/11/2009) - fG!
  3630. # Another fix to stepo (0xFF92 missing)
  3631. #
  3632. # Version 7.2 (11/10/2009) - fG!
  3633. # Added the smallregisters function to create 16 and 8 bit versions from the registers EAX, EBX, ECX, EDX
  3634. # Revised and fixed all the dumpjump stuff, following Intel manuals. There were some errors (thx to rev who pointed the jle problem).
  3635. # Small fix to stepo command (missed a few call types)
  3636. #
  3637. # Version 7.1.7 - fG!
  3638. # Added the possibility to modify what's displayed with the context window. You can change default options at the gdb options part. For example, kernel debugging is much slower if the stack display is enabled...
  3639. # New commands enableobjectivec, enablecpuregisters, enablestack, enabledatawin and their disable equivalents (to support realtime change of default options)
  3640. # Fixed problem with the assemble command. I was calling /bin/echo which doesn't support the -e option ! DUH ! Should have used bash internal version.
  3641. # Small fixes to colors...
  3642. # New commands enablesolib and disablesolib . Just shortcuts for the stop-on-solib-events fantastic trick ! Hey... I'm lazy ;)
  3643. # Fixed this: Possible removal of "u" command, info udot is missing in gdb 6.8-debian . Doesn't exist on OS X so bye bye !!!
  3644. # Displays affected flags in jump decisions
  3645. #
  3646. # Version 7.1.6 - fG!
  3647. # Added modified assemble command from Tavis Ormandy (further modified to work with Mac OS X) (shell commands used use full path name, working for Leopard, modify for others if necessary)
  3648. # Renamed thread command to threads because thread is an internal gdb command that allows to move between program threads
  3649. #
  3650. # Version 7.1.5 (04/01/2009) - fG!
  3651. # Fixed crash on Leopard ! There was a If Else condition where the else had no code and that made gdb crash on Leopard (CRAZY!!!!)
  3652. # Better code indention
  3653. #
  3654. # Version 7.1.4 (02/01/2009) - fG!
  3655. # Bug in show objective c messages with Leopard ???
  3656. # Nop routine support for single address or range (contribution from gln [ghalen at hack.se])
  3657. # Used the same code from nop to null routine
  3658. #
  3659. # Version 7.1.3 (31/12/2008) - fG!
  3660. # Added a new command 'stepo'. This command will step a temporary breakpoint on next instruction after the call, so you can skip over
  3661. # the call. Did this because normal commands not always skip over (mainly with objc_msgSend)
  3662. #
  3663. # Version 7.1.2 (31/12/2008) - fG!
  3664. # Support for the jump decision (will display if a conditional jump will be taken or not)
  3665. #
  3666. # Version 7.1.1 (29/12/2008) - fG!
  3667. # Moved gdb options to the beginning (makes more sense)
  3668. # Added support to dump message being sent to msgSend (easier to understand what's going on)
  3669. #
  3670. # Version 7.1
  3671. # Fixed serious (and old) bug in dd and datawin, causing dereference of
  3672. # obviously invalid address. See below:
  3673. # gdb$ dd 0xffffffff
  3674. # FFFFFFFF : Cannot access memory at address 0xffffffff
  3675. #
  3676. # Version 7.0
  3677. # Added cls command.
  3678. # Improved documentation of many commands.
  3679. # Removed bp_alloc, was neither portable nor usefull.
  3680. # Checking of passed argument(s) in these commands:
  3681. # contextsize-stack, contextsize-data, contextsize-code
  3682. # bp, bpc, bpe, bpd, bpt, bpm, bhb,...
  3683. # Fixed bp and bhb inconsistencies, look at * signs in Version 6.2
  3684. # Bugfix in bhb command, changed "break" to "hb" command body
  3685. # Removed $SHOW_CONTEXT=1 from several commands, this variable
  3686. # should only be controlled globally with context-on and context-off
  3687. # Improved stack, func, var and sig, dis, n, go,...
  3688. # they take optional argument(s) now
  3689. # Fixed wrong $SHOW_CONTEXT assignment in context-off
  3690. # Fixed serious bug in cft command, forgotten ~ sign
  3691. # Fixed these bugs in step_to_call:
  3692. # 1) the correct logging sequence is:
  3693. # set logging file > set logging redirect > set logging on
  3694. # 2) $SHOW_CONTEXT is now correctly restored from $_saved_ctx
  3695. # Fixed these bugs in trace_calls:
  3696. # 1) the correct logging sequence is:
  3697. # set logging file > set logging overwrite >
  3698. # set logging redirect > set logging on
  3699. # 2) removed the "clean up trace file" part, which is not needed now,
  3700. # stepi output is properly redirected to /dev/null
  3701. # 3) $SHOW_CONTEXT is now correctly restored from $_saved_ctx
  3702. # Fixed bug in trace_run:
  3703. # 1) $SHOW_CONTEXT is now correctly restored from $_saved_ctx
  3704. # Fixed print_insn_type -- removed invalid semicolons!, wrong value checking,
  3705. # Added TODO entry regarding the "u" command
  3706. # Changed name from gas_assemble to assemble_gas due to consistency
  3707. # Output from assemble and assemble_gas is now similar, because i made
  3708. # both of them to use objdump, with respect to output format (AT&T|Intel).
  3709. # Whole code was checked and made more consistent, readable/maintainable.
  3710. #
  3711. # Version 6.2
  3712. # Add global variables to allow user to control stack, data and code window sizes
  3713. # Increase readability for registers
  3714. # Some corrections (hexdump, ddump, context, cfp, assemble, gas_asm, tips, prompt)
  3715. #
  3716. # Version 6.1-color-user
  3717. # Took the Gentoo route and ran sed s/user/user/g
  3718. #
  3719. # Version 6.1-color
  3720. # Added color fixes from
  3721. # http://gnurbs.blogsome.com/2006/12/22/colorizing-mamons-gdbinit/
  3722. #
  3723. # Version 6.1
  3724. # Fixed filename in step_to_call so it points to /dev/null
  3725. # Changed location of logfiles from /tmp to ~
  3726. #
  3727. # Version 6
  3728. # Added print_insn_type, get_insn_type, context-on, context-off commands
  3729. # Added trace_calls, trace_run, step_to_call commands
  3730. # Changed hook-stop so it checks $SHOW_CONTEXT variable
  3731. #
  3732. # Version 5
  3733. # Added bpm, dump_bin, dump_hex, bp_alloc commands
  3734. # Added 'assemble' by elaine, 'gas_asm' by mong
  3735. # Added Tip Topics for aspiring users ;)
  3736. #
  3737. # Version 4
  3738. # Added eflags-changing insns by pusillus
  3739. # Added bp, nop, null, and int3 patch commands, also hook-stop
  3740. #
  3741. # Version 3
  3742. # Incorporated elaine's if/else goodness into the hex/ascii dump
  3743. #
  3744. # Version 2
  3745. # Radix bugfix by elaine