Merge remote-tracking branch

'origin/GP-2495_Dan_PR-4546_jmillikin_wine-win32-gdb-scripts' (Closes #4546)
2026-05-27 23:17:03 +08:00 · 2022-09-12 11:11:21 -04:00
parent b951224fce 63619e00ae
commit 0d52a4dfc2
6 changed files with 172 additions and 5 deletions
@@ -1,4 +1,6 @@
 ##VERSION: 2.0
 ##MODULE IP: JSch License
 Module.manifest||GHIDRA||||END|
-data/scripts/define_info_proc_mappings||GHIDRA||||END|
+data/scripts/fallback_info_proc_mappings.gdb||GHIDRA||||END|
+data/scripts/getpid-linux-i386.gdb||GHIDRA||||END|
+data/scripts/wine32_info_proc_mappings.gdb||GHIDRA||||END|
@@ -1,4 +0,0 @@
-define info proc mappings
-echo 0x0 0x7FFFFFFFFFFFFFFF 0x8000000000000000 0x0 lomem \n
-echo 0x8000000000000000 0xFFFFFFFFFFFFFFFF 0x8000000000000000 0x0 himem
-end
@@ -0,0 +1,26 @@
+# Override the "info proc mappings" command in GDB to report the full 64-bit address space
+#
+# This presents the space in two regions, low and high, to avoid signedness bugs in Ghidra.
+#
+# To use:
+#  1. Consider the actual memory size of your target and copy and/or adjust this script
+#  2. Connect Ghidra to GDB on Linux
+#  3. From the interpreter, run:
+#
+#        source fallback_info_proc_mappings.gdb
+#
+#     Note that you may need to provide the full path to the script
+#
+# You can now launch or connect to your target in the usual way. This may cause Ghidra to display
+# more memory than is actually present on the target. As a result, randomly scrolling in the
+# dynamic listing may cause several erroneous reads, which may in turn may cause the target and/or
+# GDB to crash. Use with caution. The more accurate your memory map, the safer.
+#
+# Note that the connection should only be used with the target for which this script was tailored.
+# Re-using the connection for another target may result in sub-optimal performance and/or undefined
+# behavior.
+
+define info proc mappings
+echo 0x0 0x7FFFFFFFFFFFFFFF 0x8000000000000000 0x0 lomem \n
+echo 0x8000000000000000 0xFFFFFFFFFFFFFFFF 0x8000000000000000 0x0 himem
+end
@@ -0,0 +1,22 @@
+# A GDB command to obtain the PID of a traced process, which must be running
+# on an x86 Linux host. This is primarily useful when running gdbserver.exe
+# under Wine.
+#
+# Note that binaries linked with non-executable stacks, such as those
+# created by the `-z,noexecstack` or `/NXCOMPAT` options, should replace
+# `($esp-7)` with an address that will be mapped to an executable region.
+# Selection of such an address is platform- and binary-specific.
+
+define getpid-linux-i386
+  # MOV eax,20 [SYS_getpid]
+  # INT 0x80
+  # RET
+  set $linux_getpid = {int (void)}($esp-7)
+  set {unsigned char[8]}($linux_getpid) = {\
+    0xB8, 0x14, 0x00, 0x00, 0x00, \
+    0xCD, 0x80, \
+    0xC3 \
+  }
+  output $linux_getpid()
+  echo \n
+end
@@ -0,0 +1,94 @@
+## ###
+#  IP: GHIDRA
+# 
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#  
+#       http://www.apache.org/licenses/LICENSE-2.0
+#  
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+##
+# A GDB command for fetching /proc/{pid}/maps from a remote gdbserver,
+# formatted in the style of `info proc mappings`.
+#
+# usage: remote-proc-mappings PID
+
+import contextlib
+import os
+import threading
+
+@contextlib.contextmanager
+def pipe_fds():
+    r_fd, w_fd = os.pipe()
+    r_file = os.fdopen(r_fd, mode="rb")
+    w_file = os.fdopen(w_fd, mode="wb")
+    try:
+        yield (r_file, w_file)
+    finally:
+        r_file.close()
+        w_file.close()
+
+class ReadThread(threading.Thread):
+    def __init__(self, reader):
+        super(ReadThread, self).__init__()
+        self.__r = reader
+        self.bytes = None
+
+    def run(self):
+        self.bytes = bytearray(self.__r.read())
+
+def reformat_line(raw_line):
+    split = raw_line.decode("utf-8").split(None, 5)
+    # split[0] range
+    # split[1] mode
+    # split[2] offset
+    # split[3] major_minor
+    # split[4] inode
+    # split[5] object name
+    start_addr_s, end_addr_s = split[0].split("-")
+    start_addr = int(start_addr_s, 16)
+    end_addr = int(end_addr_s, 16)
+    if len(split) == 6:
+        objfile = split[5]
+    else:
+        objfile = ""
+    return "0x{:X} 0x{:X} 0x{:X} 0x{:X} {} {}\n".format(
+        start_addr, end_addr,
+        end_addr - start_addr,
+        int(split[2], 16),
+        split[1],
+        objfile,
+    )
+
+class RemoteProcMappings(gdb.Command):
+    def __init__(self):
+        super(RemoteProcMappings, self).__init__("remote-proc-mappings", gdb.COMMAND_STATUS)
+
+    def invoke(self, arg, from_tty):
+        argv = gdb.string_to_argv(arg)
+        if len(argv) != 1:
+            gdb.write("usage: remote-proc-mappings PID\n", gdb.STDERR)
+            return
+
+        remote_pid = int(argv[0])
+
+        with pipe_fds() as (r_file, w_file):
+            read_thread = ReadThread(reader = r_file)
+            read_thread.start()
+            maps_path = "/proc/{}/maps".format(remote_pid)
+            pipe_writer_path = "/dev/fd/{}".format(w_file.fileno())
+            gdb.execute("remote get {} {}".format(maps_path, pipe_writer_path))
+            w_file.close()
+            read_thread.join()
+            raw_bytes = read_thread.bytes
+
+        for raw_line in raw_bytes.split(b"\n"):
+            if raw_line:
+                gdb.write(reformat_line(raw_line))
+
+RemoteProcMappings()
@@ -0,0 +1,27 @@
+# Override the "info proc mappings" command in GDB to fetch them from a remote wine32 target
+#
+# To use:
+#  1. Read the documentation for getpid-linux-i386.gdb carefully! You may need to copy and/or make
+#     target-specific adjustments, since it needs to inject machine code. Some preliminary static
+#     analysis may be required.
+#  2. Use Wine on Linux to launch gdbserver.exe with your target binary
+#  3. Connect Ghidra to GDB on Linux
+#  4. From the interpreter, run:
+#
+#        source getpid-linux-i386.gdb
+#        source remote-proc-mappings.py
+#        source wine32_info_proc_mappings.gdb
+#
+#     Note that you may need to provide full paths to the scripts
+#
+# You can now connect to the "remote" gdbserver.exe in the usual way, and Ghidra's Debugger should
+# work as usual. Note that the connection should only be used for 32-bit x86 Windows targets
+# running under Wine for Linux. Re-using the connection for another target may result in undefined
+# behavior.
+
+define info proc mappings
+  python
+remote_pid = gdb.execute("getpid-linux-i386", to_string=True).strip()
+gdb.execute("remote-proc-mappings {}".format(remote_pid))
+  end
+end