Pwndbg: "Cannot execute this command while the target is running."

[thinkycx]

env

arm64 binary
pwndbg latest

problem

When I set a breakpoint and set a command with it, the pwndbg will raise an error. It seems like the info file command is executed. Do you know why? Thank you.

gdb settings:

break *$rebase(0x0000000000018ED0) if $x2 > 0
commands 1
x/20s $x1
c
end

root cause

pwndbg> break *$rebase(0x0000000000018ED0) if $x2 > 0
Breakpoint 1 at 0x557421fed0
pwndbg> commands 1
Type commands for breakpoint(s) 1, one per line.
End with a line saying just "end".
>x/20s $x1
>c
>end
pwndbg> c
Continuing.
[Switching to Thread 9784.9843]

Thread 59 "civetweb-worker" hit Breakpoint 1, 0x000000557421fed0 in ?? ()
0x7ec4004d80:   ""
0x7ec4004d81:   ""
0x7ec4004d82:   ""
0x7ec4004d83:   ""
0x7ec4004d84:   ""
0x7ec4004d85:   ""
0x7ec4004d86:   ""
0x7ec4004d87:   ""
0x7ec4004d88:   ""
0x7ec4004d89:   ""
0x7ec4004d8a:   ""
0x7ec4004d8b:   ""
0x7ec4004d8c:   ""
0x7ec4004d8d:   ""
0x7ec4004d8e:   ""
0x7ec4004d8f:   ""
0x7ec4004d90:   ""
0x7ec4004d91:   ""
0x7ec4004d92:   ""
0x7ec4004d93:   ""
Traceback (most recent call last):
  File "/root/Pwn/Tools/pwndbg/pwndbg/events.py", line 169, in caller
    func()
  File "/root/Pwn/Tools/pwndbg/pwndbg/vmmap.py", line 121, in explore_registers
    find(pwndbg.regs[regname])
  File "/root/Pwn/Tools/pwndbg/pwndbg/memoize.py", line 48, in __call__
    value = self.func(*args, **kwargs)
  File "/root/Pwn/Tools/pwndbg/pwndbg/vmmap.py", line 75, in find
    for page in get():
  File "/root/Pwn/Tools/pwndbg/pwndbg/memoize.py", line 48, in __call__
    value = self.func(*args, **kwargs)
  File "/root/Pwn/Tools/pwndbg/pwndbg/vmmap.py", line 48, in get
    pages.extend(proc_pid_maps())
  File "/root/Pwn/Tools/pwndbg/pwndbg/memoize.py", line 48, in __call__
    value = self.func(*args, **kwargs)
  File "/root/Pwn/Tools/pwndbg/pwndbg/vmmap.py", line 160, in proc_pid_maps
    if pwndbg.qemu.is_qemu():
  File "/root/Pwn/Tools/pwndbg/pwndbg/memoize.py", line 48, in __call__
    value = self.func(*args, **kwargs)
  File "/root/Pwn/Tools/pwndbg/pwndbg/qemu.py", line 31, in is_qemu
    from_tty=False)
error: Cannot execute this command while the target is running.
Use the "interrupt" command to stop the target
and then try again.

If that is an issue, you can report it on https://github.com/pwndbg/pwndbg/issues
(Please don't forget to search if it hasn't been reported before)
To generate the report and open a browser, you may run `bugreport --run-browser`
PS: Pull requests are welcome
Traceback (most recent call last):
  File "/root/Pwn/Tools/pwndbg/pwndbg/events.py", line 173, in caller
    raise e
gdb.error: Cannot execute this command while the target is running.
Use the "interrupt" command to stop the target
and then try again.
Traceback (most recent call last):
  File "/root/Pwn/Tools/pwndbg/pwndbg/events.py", line 169, in caller
    func()
  File "/root/Pwn/Tools/pwndbg/pwndbg/memoize.py", line 48, in __call__
    value = self.func(*args, **kwargs)
  File "/root/Pwn/Tools/pwndbg/pwndbg/symbol.py", line 239, in add_main_exe_to_symbols
    if not pwndbg.remote.is_remote():
  File "/root/Pwn/Tools/pwndbg/pwndbg/remote.py", line 20, in is_remote
    info_file = gdb.execute('info file',to_string=True,from_tty=False)
error: Cannot execute this command while the target is running.
Use the "interrupt" command to stop the target
and then try again.

If that is an issue, you can report it on https://github.com/pwndbg/pwndbg/issues
(Please don't forget to search if it hasn't been reported before)
To generate the report and open a browser, you may run `bugreport --run-browser`
PS: Pull requests are welcome
Traceback (most recent call last):
  File "/root/Pwn/Tools/pwndbg/pwndbg/events.py", line 173, in caller
    raise e
gdb.error: Cannot execute this command while the target is running.
Use the "interrupt" command to stop the target
and then try again.

[stnevans]

We recently changed the way the is_remote check is done. Can you see if this still occurs on the latest commit of pwndbg?

[thinkycx]

We recently changed the way the is_remote check is done. Can you see if this still occurs on the latest commit of pwndbg?

Yes. I have tried again, the pwndbg commit id :

commit 7f5d8e785326691537b2f37f4e2397e6adc85a5d
Author: Bet4 <[email protected]>
Date:   Sun Aug 11 06:27:45 2019 +0800

    Change the way to check is_remote (#663)

log

pwndbg> break *$rebase(0x0000000000018ED0) if $x2 > 0
Breakpoint 1 at 0x5564869ed0
pwndbg> commands 1
Type commands for breakpoint(s) 1, one per line.
End with a line saying just "end".
>x/20s $x1
>c
>end
pwndbg> c
Continuing.
[Switching to Thread 24377.24434]

Thread 57 "civetweb-worker" hit Breakpoint 1, 0x0000005564869ed0 in ?? ()
0x7eec004d80:   ""
0x7eec004d81:   ""
0x7eec004d82:   ""
0x7eec004d83:   ""
0x7eec004d84:   ""
0x7eec004d85:   ""
0x7eec004d86:   ""
0x7eec004d87:   ""
0x7eec004d88:   ""
0x7eec004d89:   ""
0x7eec004d8a:   ""
0x7eec004d8b:   ""
0x7eec004d8c:   ""
0x7eec004d8d:   ""
0x7eec004d8e:   ""
0x7eec004d8f:   ""
0x7eec004d90:   ""
0x7eec004d91:   ""
0x7eec004d92:   ""
0x7eec004d93:   ""
Traceback (most recent call last):
  File "/root/Pwn/Tools/pwndbg/pwndbg/events.py", line 169, in caller
    func()
  File "/root/Pwn/Tools/pwndbg/pwndbg/vmmap.py", line 121, in explore_registers
    find(pwndbg.regs[regname])
  File "/root/Pwn/Tools/pwndbg/pwndbg/memoize.py", line 48, in __call__
    value = self.func(*args, **kwargs)
  File "/root/Pwn/Tools/pwndbg/pwndbg/vmmap.py", line 75, in find
    for page in get():
  File "/root/Pwn/Tools/pwndbg/pwndbg/memoize.py", line 48, in __call__
    value = self.func(*args, **kwargs)
  File "/root/Pwn/Tools/pwndbg/pwndbg/vmmap.py", line 56, in get
    pages.extend(info_auxv())
  File "/root/Pwn/Tools/pwndbg/pwndbg/memoize.py", line 48, in __call__
    value = self.func(*args, **kwargs)
  File "/root/Pwn/Tools/pwndbg/pwndbg/vmmap.py", line 358, in info_auxv
    pages.extend(pwndbg.elf.map(entry or phdr, exe_name))
  File "/root/Pwn/Tools/pwndbg/pwndbg/elf.py", line 354, in map
    ei_class, ehdr         = get_ehdr(pointer)
  File "/root/Pwn/Tools/pwndbg/pwndbg/elf.py", line 283, in get_ehdr
    base = find_elf_magic(pointer, search_down=True)
  File "/root/Pwn/Tools/pwndbg/pwndbg/abi.py", line 165, in caller
    return func(*args, **kwargs)
  File "/root/Pwn/Tools/pwndbg/pwndbg/elf.py", line 261, in find_elf_magic
    data = pwndbg.memory.read(addr, 4)
  File "/root/Pwn/Tools/pwndbg/pwndbg/memory.py", line 44, in read
    result = gdb.selected_inferior().read_memory(addr, count)
error: Cannot execute this command while the target is running.
Use the "interrupt" command to stop the target
and then try again.

If that is an issue, you can report it on https://github.com/pwndbg/pwndbg/issues
(Please don't forget to search if it hasn't been reported before)
To generate the report and open a browser, you may run `bugreport --run-browser`
PS: Pull requests are welcome
Traceback (most recent call last):
  File "/root/Pwn/Tools/pwndbg/pwndbg/events.py", line 173, in caller
    raise e
gdb.error: Cannot execute this command while the target is running.
Use the "interrupt" command to stop the target
and then try again.
Traceback (most recent call last):
  File "/root/Pwn/Tools/pwndbg/pwndbg/events.py", line 169, in caller
    func()
  File "/root/Pwn/Tools/pwndbg/pwndbg/memoize.py", line 48, in __call__
    value = self.func(*args, **kwargs)
  File "/root/Pwn/Tools/pwndbg/pwndbg/symbol.py", line 245, in add_main_exe_to_symbols
    exe  = pwndbg.elf.exe()
  File "/root/Pwn/Tools/pwndbg/pwndbg/proc.py", line 75, in wrapper
    return func(*a, **kw)
  File "/root/Pwn/Tools/pwndbg/pwndbg/memoize.py", line 48, in __call__
    value = self.func(*args, **kwargs)
  File "/root/Pwn/Tools/pwndbg/pwndbg/elf.py", line 185, in exe
    return load(e)
  File "/root/Pwn/Tools/pwndbg/pwndbg/elf.py", line 223, in load
    return get_ehdr(pointer)[1]
  File "/root/Pwn/Tools/pwndbg/pwndbg/elf.py", line 283, in get_ehdr
    base = find_elf_magic(pointer, search_down=True)
  File "/root/Pwn/Tools/pwndbg/pwndbg/abi.py", line 165, in caller
    return func(*args, **kwargs)
  File "/root/Pwn/Tools/pwndbg/pwndbg/elf.py", line 261, in find_elf_magic
    data = pwndbg.memory.read(addr, 4)
  File "/root/Pwn/Tools/pwndbg/pwndbg/memory.py", line 44, in read
    result = gdb.selected_inferior().read_memory(addr, count)
error: Cannot execute this command while the target is running.
Use the "interrupt" command to stop the target
and then try again.

If that is an issue, you can report it on https://github.com/pwndbg/pwndbg/issues
(Please don't forget to search if it hasn't been reported before)
To generate the report and open a browser, you may run `bugreport --run-browser`
PS: Pull requests are welcome
Traceback (most recent call last):
  File "/root/Pwn/Tools/pwndbg/pwndbg/events.py", line 173, in caller
    raise e
gdb.error: Cannot execute this command while the target is running.
Use the "interrupt" command to stop the target
and then try again.

[disconnect3d]

Just to be sure, can you check if this happens on a previous commit, that doesn't include the is_remote change? :D

[thinkycx]

Just to be sure, can you check if this happens on a previous commit, that doesn't include the is_remote change? :D

Yes. Now the commit ID is

commit 88723a8c0a88369fa2dd267d1fb5c63464db55cb
Author: NyaMisty <[email protected]>
Date:   Thu Jul 4 23:01:30 2019 +0800

    Add support for decompile_context on IDA 7.0 (#655)

    * Add support for decompile_context on IDA 7.0

    * Make the line finding logic a separated function

However, the command "info file " exists.
log

pwndbg> set exception-verbose on
Set whether to print a full stacktracefor exceptions raised in Pwndbg commands to True
pwndbg> break *$rebase(0x0000000000018ED0) if $x2 > 0
Breakpoint 1 at 0x5559de7ed0
pwndbg> commands 1
Type commands for breakpoint(s) 1, one per line.
End with a line saying just "end".
>x/20s $x1
>c
>end
pwndbg> c
Continuing.
[Switching to Thread 28968.29025]

Thread 57 "civetweb-worker" hit Breakpoint 1, 0x0000005559de7ed0 in ?? ()
0x7ecc004d80:   ""
0x7ecc004d81:   ""
0x7ecc004d82:   ""
0x7ecc004d83:   ""
0x7ecc004d84:   ""
0x7ecc004d85:   ""
0x7ecc004d86:   ""
0x7ecc004d87:   ""
0x7ecc004d88:   ""
0x7ecc004d89:   ""
0x7ecc004d8a:   ""
0x7ecc004d8b:   ""
0x7ecc004d8c:   ""
0x7ecc004d8d:   ""
0x7ecc004d8e:   ""
0x7ecc004d8f:   ""
0x7ecc004d90:   ""
0x7ecc004d91:   ""
0x7ecc004d92:   ""
0x7ecc004d93:   ""
Traceback (most recent call last):
  File "/root/Pwn/Tools/pwndbg/pwndbg/events.py", line 169, in caller
    func()
  File "/root/Pwn/Tools/pwndbg/pwndbg/vmmap.py", line 121, in explore_registers
    find(pwndbg.regs[regname])
  File "/root/Pwn/Tools/pwndbg/pwndbg/memoize.py", line 48, in __call__
    value = self.func(*args, **kwargs)
  File "/root/Pwn/Tools/pwndbg/pwndbg/vmmap.py", line 75, in find
    for page in get():
  File "/root/Pwn/Tools/pwndbg/pwndbg/memoize.py", line 48, in __call__
    value = self.func(*args, **kwargs)
  File "/root/Pwn/Tools/pwndbg/pwndbg/vmmap.py", line 48, in get
    pages.extend(proc_pid_maps())
  File "/root/Pwn/Tools/pwndbg/pwndbg/memoize.py", line 48, in __call__
    value = self.func(*args, **kwargs)
  File "/root/Pwn/Tools/pwndbg/pwndbg/vmmap.py", line 160, in proc_pid_maps
    if pwndbg.qemu.is_qemu():
  File "/root/Pwn/Tools/pwndbg/pwndbg/memoize.py", line 48, in __call__
    value = self.func(*args, **kwargs)
  File "/root/Pwn/Tools/pwndbg/pwndbg/qemu.py", line 31, in is_qemu
    from_tty=False)
error: Cannot execute this command while the target is running.
Use the "interrupt" command to stop the target
and then try again.

If that is an issue, you can report it on https://github.com/pwndbg/pwndbg/issues
(Please don't forget to search if it hasn't been reported before)
To generate the report and open a browser, you may run `bugreport --run-browser`
PS: Pull requests are welcome
Traceback (most recent call last):
  File "/root/Pwn/Tools/pwndbg/pwndbg/events.py", line 173, in caller
    raise e
gdb.error: Cannot execute this command while the target is running.
Use the "interrupt" command to stop the target
and then try again.
Traceback (most recent call last):
  File "/root/Pwn/Tools/pwndbg/pwndbg/events.py", line 169, in caller
    func()
  File "/root/Pwn/Tools/pwndbg/pwndbg/memoize.py", line 48, in __call__
    value = self.func(*args, **kwargs)
  File "/root/Pwn/Tools/pwndbg/pwndbg/symbol.py", line 239, in add_main_exe_to_symbols
    if not pwndbg.remote.is_remote():
  File "/root/Pwn/Tools/pwndbg/pwndbg/remote.py", line 20, in is_remote
    info_file = gdb.execute('info file',to_string=True,from_tty=False)
error: Cannot execute this command while the target is running.
Use the "interrupt" command to stop the target
and then try again.

If that is an issue, you can report it on https://github.com/pwndbg/pwndbg/issues
(Please don't forget to search if it hasn't been reported before)
To generate the report and open a browser, you may run `bugreport --run-browser`
PS: Pull requests are welcome
Traceback (most recent call last):
  File "/root/Pwn/Tools/pwndbg/pwndbg/events.py", line 173, in caller
    raise e
gdb.error: Cannot execute this command while the target is running.
Use the "interrupt" command to stop the target
and then try again.

[stnevans]

This seems like the same sort of thing that happened in #425.

My guess would be the following is occurring:

gdb hits the breakpoint, then queues the following commands to be run {x/20s $x1, continue}.
pwndbg then receives a stop event, runs gdb.execute("arbitrary-command"), which results in the queue being {x/20s $x1, continue, arbitrary-command}.
arbitrary-command then executes after the target is running.

I haven't had time to look at this yet so I am just speculating.
If that is the case, maybe we could figure out some sort of way to tell if gdb is executing a script and not run pwndbg analysis during the execution of that? I don't remember seeing any clear way to do that in the gdb api.

[thinkycx]

This seems like the same sort of thing that happened in #425.

My guess would be the following is occurring:

gdb hits the breakpoint, then queues the following commands to be run {x/20s $x1, continue}.
pwndbg then receives a stop event, runs gdb.execute("arbitrary-command"), which results in the queue being {x/20s $x1, continue, arbitrary-command}.
arbitrary-command then executes after the target is running.

I haven't had time to look at this yet so I am just speculating.
If that is the case, maybe we could figure out some sort of way to tell if gdb is executing a script and not run pwndbg analysis during the execution of that? I don't remember seeing any clear way to do that in the gdb api.

Thanks for your reply. Although I don't know which commands pwndbg need to run, wish the bug will be fixed in future although it is not emergency.

For anyone who have to do the same things like me, you can just run the following commands:

gdb> def aaa
> x/20s $x1
> continue
> end
gdb> aaa (input a lot of aaa in the gdb commands and they will be sent into gdb one by one after the breakpoints is hitted)
aaa
aaa
aaa
aaa
aaa