1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
|
# gdb script: break at the 999/719 RETURN sites of the libcuda scanner
# FUN_0054fa00 and dump the record values the scanner actually read (they are
# still in its stack locals, so the host clearing the notification afterwards
# cannot race this capture).
#
# Scanner layout (disassembly of libcuda+0x44fa00):
# rec = *(*(*(ctx+0x9488)+0x10)+0x10)
# locals: rbp-0x40 rec[+0x00], rbp-0x3c rec[+0x04], rbp-0x38 rec[+0x08],
# rbp-0x34 rec[+0x0c] (s16), rbp-0x32 rec[+0x0e] (s16)
# 0x44fb80 -> return 999 when force != 0 and (rec[+8]|rec[+0xc]|rec[+0xe])
# 0x44fb6c -> return 0x2cf
# Run: sudo gdb -p <cdt-pid> -batch -x /tmp/bp999v2.py
import gdb
out = gdb.execute("info proc mappings", to_string=True)
base = None
for line in out.splitlines():
if "libcuda" in line and "r-xp" in line:
f = line.split()
base = int(f[0], 16) - int(f[3], 16)
break
print("BASE=0x%x" % (base or 0))
if base is None:
raise SystemExit
gdb.execute("set pagination off")
gdb.execute("set confirm off")
gdb.execute("break *0x%x" % (base + 0x44fb80))
gdb.execute("break *0x%x" % (base + 0x44fb6c))
try:
gdb.execute("continue")
except gdb.error as e:
print("CONTINUE_ERR %s" % e)
print("STOPPED")
try:
rip = int(gdb.parse_and_eval("$rip")) & 0xffffffffffffffff
print("RIP=0x%x off=0x%x" % (rip, rip - base))
rdi = int(gdb.parse_and_eval("$rdi")) & 0xffffffffffffffff
rsi = int(gdb.parse_and_eval("$rsi")) & 0xffffffff
rbp = int(gdb.parse_and_eval("$rbp")) & 0xffffffffffffffff
print("rdi=0x%x rsi(force)=%d rbp=0x%x" % (rdi, rsi, rbp))
print(gdb.execute("x/5wx 0x%x" % (rbp - 0x40), to_string=True))
print(gdb.execute("x/2hx 0x%x" % (rbp - 0x34), to_string=True))
except Exception as e:
print("locals_fail %s" % e)
try:
print(gdb.execute("bt 14", to_string=True))
except Exception as e:
print("bt_fail %s" % e)
def rd64(a):
try:
return int(gdb.parse_and_eval("*(unsigned long *)0x%x" % a)) & 0xffffffffffffffff
except Exception:
return None
def rd32(a):
try:
return int(gdb.parse_and_eval("*(unsigned int *)0x%x" % a)) & 0xffffffff
except Exception:
return None
try:
pl = rd64(rdi)
n = 0
while pl and n < 64:
mgr = rd64(pl + 0x9488)
print("ctx[%d]=0x%x mgr=0x%x" % (n, pl, mgr or 0))
if mgr:
reg = rd64(mgr + 0x10)
if reg:
rec = rd64(reg + 0x10)
print(" reg=0x%x rec=0x%x" % (reg, rec or 0))
if rec:
for i in range(0, 0x28, 4):
print(" rec[+0x%02x]=0x%08x" % (i, rd32(rec + i) or 0))
pl = rd64(pl + 0x9470)
n += 1
except Exception as e:
print("record_dump_fail %s" % e)
try:
gdb.execute("detach")
except Exception:
pass
|
