GDB와 pwndbg를 사용한 동적 분석

동적 분석이란 무엇인가

GDB 기초

gdb ./vuln              # load binary
gdb -p 1234             # attach to running process
run [args]              # start execution
break main              # set breakpoint at main
continue (c)            # continue execution
next (n)                # step over
step (s)                # step into

pwndbg 기능 확장

git clone https://github.com/pwndbg/pwndbg && ./setup.sh

중단점 및 감시점

# Break at address:
break *0x401234
# Break at function:
break strncpy
# Watch memory address:
watch *0x7ffd1234     # break when value changes
# Conditional break:
break *0x401234 if $rax == 0
# List and delete:
info break
delete 1

메모리 및 레지스터 검사

info registers         # show all registers
print $rax             # print register value
x/10xg $rsp            # examine 10 qwords at RSP
x/s 0x402000           # examine as string
x/20i $rip             # disassemble 20 instructions at RIP
pwndbg: telescope $rsp 20  # smart stack display

코드를 단계별로 실행하기

ni (nexti)             # step over (instruction level)
si (stepi)             # step into (instruction level)
finish                 # run until function returns
until 0x401234         # run until address

GDB 스크립팅하기

# GDB Python script:
gdb ./vuln << EOF
python
for i in range(10):
    gdb.execute("continue")
    gdb.execute("x/4xg $rsp")
end
EOF

pwndbg로 힙 분석하기

heap                   # show all heap chunks
heap -a                # show all allocations
bin                    # show free list bins
tcachebins             # show tcache entries
vis_heap_chunks        # visual heap map

시스템 호출 추적하기

strace ./vuln          # trace all syscalls
strace -e trace=open,read,write ./vuln  # filter syscalls
strace -f ./vuln       # follow forks
# ltrace for library calls:
ltrace ./vuln

디버깅 환경 설정하기

# Disable ASLR for testing:
echo 0 | sudo tee /proc/sys/kernel/randomize_va_space
# Or per-process:
setarch $(uname -m) -R gdb ./vuln
# Verify with:
ldd ./vuln  # check libc base

디버그 심볼이 제거된 바이너리 디버깅

빠른 확인: GDB

강의 요약