Pwndbg: Feature: piebase as vars (ie. $piebase, $rva)

Created on 29 Jan 2019  路  4Comments  路  Source: pwndbg/pwndbg

Would be nice to have this in feature lists. I always do this manually by using

set $rva = some_offset

Then accessing .bss or other relative offset, with

x/8gx  $rva+some_other_offset
feature good first issue help wanted

All 4 comments

I'm kind of new to this project. Is there any part of this to look at first? There are some implementations I have been thinking,

  1. by executing set $rva = some_offset every piebase command executed, this can't be foolproof though. What will happen when ASLR activated and program restarted?
    ref: https://github.com/scwuaptx/Pwngdb/blob/master/pwndbg/pwngdb.py#L72
  2. by executing set $rva = some_offset every some "events", like when restart executable or first run.

Hey, although we have this kind of feature as a gdb function (e.g. p/x $rebase(0x1234) and also breakrva 0x1234 as for setting a breakpoint), I still find it useful (and it should probably make the $rebase function obsolete/deprecated).

This should be set within a program start event, so you must write a function and decorate it with pwndbg.events.start as in https://github.com/pwndbg/pwndbg/blob/71d29df0498e4584db99015964f1722664e62824/pwndbg/argv.py#L28-L34.

The base address itself can be retrieved the same as in https://github.com/pwndbg/pwndbg/blob/dev/pwndbg/gdbutils/functions.py#L53

PS: Sorry for the late reply, I have been on vacation ;).

@zeroload Hey, are you going to work on this?

@zeroload Hey, are you going to work on this?

Uh.. yeah. I totally forgot about this. Sorry, I don't think I could work on this.

Was this page helpful?
0 / 5 - 0 ratings

Related issues

plusls picture plusls  路  5Comments

thinkycx picture thinkycx  路  6Comments

disconnect3d picture disconnect3d  路  9Comments

danielnehrig picture danielnehrig  路  4Comments

sudhackar picture sudhackar  路  6Comments