Reverse-Engineering
From Ggl's wiki
Contents |
Linux
Tools
reverse engineering tasks need good tools. I like python :), it's OO, fun and it helps to develop faster. Using python directly in the python shell is like using a debugger :>.
Using ptrace()
Attaching to the debuggee
#include <sys/ptrace.h> long ptrace(enum __ptrace_request request, pid_t pid, void *addr, void *data);
- PTRACE_ATTACH
- Attaches to the process specified in pid, making it a traced "child" of the current process.
- PTRACE_CONT
- Restarts the stopped child process. If data is non-zero and not SIGSTOP, it is interpreted as a signal to be delivered to the child; otherwise, no signal is delivered. Thus, for example, the parent can control whether a signal sent to the child is delivered or not. (addr is ignored.)
- PTRACE_KILL
- Sends the child a SIGKILL to terminate it. (addr and data are ignored.)
- PTRACE_DETACH
- Restarts the stopped child as for PTRACE_CONT, but first detaches from the process, undoing the reparenting effect of PTRACE_ATTACH, and the effects of PTRACE_TRACEME. Although per-haps not intended, under Linux a traced child can be detached in this way regardless of which method was used to initiate tracing. (addr is ignored.)
Reading memory and registers
- PTRACE_PEEKTEXT, PTRACE_PEEKDATA
- Reads a word at the location addr in the child's memory, returning the word as the result of the ptrace() call. Linux does not have separate text and data address spaces, so the two requests are currently equivalent. (The argument data is ignored.)
- PTRACE_GETREGS, PTRACE_GETFPREGS
- Copies the child's general purpose or floating-point registers, respectively, to location data in the parent. See <linux/user.h> for information on the format of this data. (addr is ignored.)
Modifying memory and registers
- PTRACE_POKETEXT, PTRACE_POKEDATA
- Copies the word data to location addr in the child's memory. As above, the two requests are currently equivalent.
- PTRACE_SETREGS, PTRACE_SETFPREGS
- Copies the child's general purpose or floating-point registers, respectively, from location data in the parent. As for PTRACE_POKEUSER, some general purpose register modifications may be disallowed. (addr is ignored.)
Stepping through the code
- PTRACE_SYSCALL, PTRACE_SINGLESTEP
- Restarts the stopped child as for PTRACE_CONT, but arranges for the child to be stopped at the next entry to or exit from a system call, or after execution of a single instruction, respectively. (The child will also, as usual, be stopped upon receipt of a signal.) From the parent's perspective, the child will appear to have been stopped by receipt of a SIGTRAP. So, for PTRACE_SYSCALL, for example, the idea s to inspect the arguments to the system call at the first stop, then do another PTRACE_SYSCALL and inspect the return value of the system call at the second stop. (addr is ignored.)
Breakpoints
Basically, software breakpoints work by replacing the first byte of the instruction at the breakpoint address by the int3 (0xCC) instruction.
