Radare2: ood fails on paths with spaces

[Simerax]

Work environment

System: Linux duplex 3.16.0-4-amd64 #1 SMP Debian 3.16.39-1+deb8u2 (2017-03-07) x86_64 GNU/Linux

used File: test: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=0869297e5521c0e929550da0bf64e8bd398e98d8, not stripped

r2 -v: commit: 8b1e0bb16e738d9e805297bca21adcac49a6b0a9 build: 2018-02-03__18:47:38
r2 -V:
2.2.0-361-g8b1e0bb r2
2.2.0-361-g8b1e0bb r_anal
2.2.0-361-g8b1e0bb r_lib
2.2.0-361-g8b1e0bb r_egg
2.2.0-361-g8b1e0bb r_asm
2.2.0-361-g8b1e0bb r_bin
2.2.0-361-g8b1e0bb r_cons
2.2.0-361-g8b1e0bb r_flag
2.2.0-361-g8b1e0bb r_core
2.2.0-361-g8b1e0bb r_crypto
2.2.0-361-g8b1e0bb r_bp
2.2.0-361-g8b1e0bb r_debug
2.2.0-361-g8b1e0bb r_hash
2.2.0-361-g8b1e0bb r_fs
2.2.0-361-g8b1e0bb r_io
2.2.0-361-g8b1e0bb r_magic
2.2.0-361-g8b1e0bb r_parse
2.2.0-361-g8b1e0bb r_reg
2.2.0-361-g8b1e0bb r_sign
2.2.0-361-g8b1e0bb r_search
2.2.0-361-g8b1e0bb r_syscall
2.2.0-361-g8b1e0bb r_util

Expected behavior

created a path where one directory included a space ( escaped with \ )
opened the file "test" with r2 -d test
did ood to reopen
i expected it to just reopen the file in debug mode

Actual behavior

the ood command failed with following error message:
Wait event received by different pid 27814
Could not execvp: No such file or directory
r_core_file_reopen: Cannot reopen file: dbg:///home/simplex/_prog/re/test 2/test with perms 0x0007, attempting to open read-only.
27814

Steps to reproduce the behavior

1. Create a Path which contains a directory with a space in it's name
2. Create Binary File which can be fed to r2 ( Info about the file I used described further up)
3. Start r2 in the directory where your binary is with r2 -d filename
4. Reopen the file with the command "ood"

short side note from me

I get it that r2 might not be capable of handling paths with spaces but what I think is that the error message doesn't really describe the actual problem.

[leberus]

I tried what you said and it works for me.
I might be overlooking something but...

`
leberus@localhost:~> mkdir "test 4"

leberus@localhost:~> cd test\ 4/

leberus@localhost:~/test 4> cp ../test .

leberus@localhost:~/test 4> r2 -d test
Process with PID 19388 started...
= attach 19388 19388
bin.baddr 0x00400000
Using 0x400000
Unknown DW_FORM 0x06
asm.bits 64
-- When in doubt, try 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa; pd;'
[0x7fa1f8f00ea0]> ood
Wait event received by different pid 19388
Process with PID 19389 started...
File dbg:///home/leberus/test 4/test reopened in read-write mode
= attach 19389 19389
Unknown DW_FORM 0x06
19389
[0x7fb304feaea0]>`

Maybe you could paste what you're doing and share the binary?

[Simerax]

Hey leberus,
look at the two pictures. in the first i show how the error occurs and in the second one how i fixed it (by removing the space in the directory name)

[hayekr]

Your issue happens on my machine I tested paths with and without spaces, ood only fails when loading a file with a path that has spaces

[leberus]

Ok, now I could reproduce it.
I'll take a look.

[leberus]

The problem is that when calling fork_and_ptraceme, we try to get program's argvs with r_str_argv, but this function skips whitespaces, so if we have

/home/blabla/test 5/program

we end up calling execvp with

/home/blabla/test

I think we would be better off reading /proc/[pid]/cmdline.
I'll try to implement it.

[giuscri]

@leberus does r_str_arg_escape() comes in handy? at a first glance, r_str_argv seems aware of the escaping produced by the first function.

[leberus]

@giuscri yes, it came in handy. I did not see it. thanks for that ;-)!

diff --git a/libr/io/p/io_debug.c b/libr/io/p/io_debug.c
index eafa87987..bae5a4015 100644
--- a/libr/io/p/io_debug.c
+++ b/libr/io/p/io_debug.c
@@ -449,10 +449,14 @@ static int fork_and_ptraceme(RIO *io, int bits, const char *cmd) {
                        char *_cmd = io->args ?
                                r_str_appendf (strdup (cmd), " %s", io->args) :
                                strdup (cmd);
-
+                       char *tmp = r_str_arg_escape (_cmd);
+                       if (tmp[strlen (tmp) - 2] == '\\')
+                               tmp[strlen (tmp) - 2] = '\0';
+       
                        trace_me ();
-                       argv = r_str_argv (_cmd, NULL);
+                       argv = r_str_argv (tmp, NULL);
                        if (!argv) {
+                               free (tmp);
                                free (_cmd);
                                return -1;
                        }
@@ -469,6 +473,7 @@ static int fork_and_ptraceme(RIO *io, int bits, const char *cmd) {
                                eprintf ("Invalid execvp\n");
                        }
                        r_str_argv_free (argv);
+                       free (tmp);
                        free (_cmd);
                }
                perror ("fork_and_attach: execv");
diff --git a/libr/util/str.c b/libr/util/str.c
index 939a15c3a..3bc4d5e12 100644
--- a/libr/util/str.c
+++ b/libr/util/str.c
@@ -1708,7 +1708,6 @@ R_API char **r_str_argv(const char *cmdline, int *_argc) {
                                case '"':
                                case ' ':
                                case '\\':
-                                       args[args_current++] = '\\';
                                        args[args_current++] = c;
                                        break;
                                case '\0':
@@ -1782,6 +1781,7 @@ R_API char **r_str_argv(const char *cmdline, int *_argc) {
                *_argc = argc;
        }
        free (args);
+
        return argv;
 }

Now it works:

osalvador@d104:~/lab/r2/test1 2> r2 -d $(pwd)/test
Process with PID 31320 started...
= attach 31320 31320
bin.baddr 0x00400000
Using 0x400000
Unknown DW_FORM 0x06
asm.bits 64
 -- Change the registers of the child process in this way: 'dr eax=0x333'
[0x7f71ae89d1f0]> ood
Wait event received by different pid 31320
Process with PID 31328 started...
File dbg:///home/osalvador/lab/r2/test1 2/test  reopened in read-write mode
= attach 31328 31328
Unknown DW_FORM 0x06
31328
[0x7fdfeeece1f0]> quit

I will do a couple more tests and if I do not see anything wrong I will do a PR.

[radare]

missing braces in oneliner, are arguments passed to the executable working with this patch?

On 8 Feb 2018, at 10:14, Oscar Salvador [e-mail] wrote:

@giuscri https://github.com/giuscri yes, it came in handy. I did not see it. thanks for that ;-)!

diff --git a/libr/io/p/io_debug.c b/libr/io/p/io_debug.c
index eafa87987..bae5a4015 100644
--- a/libr/io/p/io_debug.c
+++ b/libr/io/p/io_debug.c
@@ -449,10 +449,14 @@ static int fork_and_ptraceme(RIO *io, int bits, const char *cmd) {
char *_cmd = io->args ?
r_str_appendf (strdup (cmd), " %s", io->args) :
strdup (cmd);
-

• char *tmp = r_str_arg_escape (_cmd);
• if (tmp[strlen (tmp) - 2] == '\')
• tmp[strlen (tmp) - 2] = '0';
• 
  trace_me ();
• argv = r_str_argv (_cmd, NULL);
• argv = r_str_argv (tmp, NULL);
  if (!argv) {
• free (tmp);
  free (_cmd);
  return -1;
  }
  @@ -469,6 +473,7 @@ static int fork_and_ptraceme(RIO *io, int bits, const char *cmd) {
  eprintf ("Invalid execvp\n");
  }
  r_str_argv_free (argv);
• free (tmp);
  free (_cmd);
  }
  perror ("fork_and_attach: execv");
  diff --git a/libr/util/str.c b/libr/util/str.c
  index 939a15c3a..3bc4d5e12 100644
  --- a/libr/util/str.c
  +++ b/libr/util/str.c
  @@ -1708,7 +1708,6 @@ R_API char **r_str_argv(const char *cmdline, int *_argc) {
  case '"':
  case ' ':
  case '\':
• args[args_current++] = '\';
  args[args_current++] = c;
  break;
  case '0':
  @@ -1782,6 +1781,7 @@ R_API char **r_str_argv(const char *cmdline, int *_argc) {
  *_argc = argc;
  }
  free (args);
  +
  return argv;
  }
  Now it works:

osalvador@d104:~/lab/r2/test1 2> r2 -d $(pwd)/test
Process with PID 31320 started...
= attach 31320 31320
bin.baddr 0x00400000
Using 0x400000
Unknown DW_FORM 0x06
asm.bits 64
-- Change the registers of the child process in this way: 'dr eax=0x333'
[0x7f71ae89d1f0]> ood
Wait event received by different pid 31320
Process with PID 31328 started...
File dbg:///home/osalvador/lab/r2/test1 2/test reopened in read-write mode
= attach 31328 31328
Unknown DW_FORM 0x06
31328
[0x7fdfeeece1f0]> quit
I will do a couple more tests and if I do not see anything wrong I will do a PR.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub https://github.com/radare/radare2/issues/9302#issuecomment-364048896, or mute the thread https://github.com/notifications/unsubscribe-auth/AA3-luFcg0Qia2lb5MVT1lLESVLpiAuYks5tSrrrgaJpZM4R4Q0q.

[leberus]

not with the patch above, but i'm reworking it to make it work

[leberus]

Ok, I was busy as hell but I came up with something that works with arguments as well.
I'll send the PR in a while.