Dynamische Analyse mit GDB und pwndbg

Was ist dynamische Analyse

GDB-Grundlagen

gdb ./vuln              # load binary
gdb -p 1234             # attach to running process
run [args]              # start execution
break main              # set breakpoint at main
continue (c)            # continue execution
next (n)                # step over
step (s)                # step into

pwndbg-Erweiterung

git clone https://github.com/pwndbg/pwndbg && ./setup.sh

Breakpoints und Watchpoints

# Break at address:
break *0x401234
# Break at function:
break strncpy
# Watch memory address:
watch *0x7ffd1234     # break when value changes
# Conditional break:
break *0x401234 if $rax == 0
# List and delete:
info break
delete 1

Speicher und Register untersuchen

info registers         # show all registers
print $rax             # print register value
x/10xg $rsp            # examine 10 qwords at RSP
x/s 0x402000           # examine as string
x/20i $rip             # disassemble 20 instructions at RIP
pwndbg: telescope $rsp 20  # smart stack display

Schrittweise durch den Code gehen

ni (nexti)             # step over (instruction level)
si (stepi)             # step into (instruction level)
finish                 # run until function returns
until 0x401234         # run until address

GDB skripten

# GDB Python script:
gdb ./vuln << EOF
python
for i in range(10):
    gdb.execute("continue")
    gdb.execute("x/4xg $rsp")
end
EOF

Heap mit pwndbg analysieren

heap                   # show all heap chunks
heap -a                # show all allocations
bin                    # show free list bins
tcachebins             # show tcache entries
vis_heap_chunks        # visual heap map

Systemaufrufe verfolgen

strace ./vuln          # trace all syscalls
strace -e trace=open,read,write ./vuln  # filter syscalls
strace -f ./vuln       # follow forks
# ltrace for library calls:
ltrace ./vuln

Debugging-Umgebung einrichten

# Disable ASLR for testing:
echo 0 | sudo tee /proc/sys/kernel/randomize_va_space
# Or per-process:
setarch $(uname -m) -R gdb ./vuln
# Verify with:
ldd ./vuln  # check libc base

Stripped Binaries debuggen

Schnelltest: GDB

Zusammenfassung der Lektion