search

Gallopsled / pwntools

CTF framework and exploit development library
http://pwntools.com
Other
12.04k stars 1.71k forks source link

`ELF` may load debuginfo to get more symbols #2489

Open RocketMaDev opened 6 days ago

RocketMaDev commented 6 days ago

Now the class ELF could load executables perfectly, but some symbols could not be found in libc.so.6 for optimization. However, these debug symbols are included in its debuginfo which could be downloaded via debuginfod on multiple distros. When I try to load the debuginfo so that I have more symbols to access, it failed, as it was detecting relro.

---> 19 libc = ELF('./lib/libc.debuginfo')
File /usr/lib/python3.12/site-packages/pwnlib/elf/elf.py:362, in ELF.__init__(self, path, checksec)
File /usr/lib/python3.12/site-packages/pwnlib/elf/elf.py:457, in ELF._describe(self, *a, **kw)
File /usr/lib/python3.12/site-packages/pwnlib/elf/elf.py:2069, in ELF.checksec(self, banner, color)
File /usr/lib/python3.12/site-packages/pwnlib/elf/elf.py:1702, in ELF.relro(self)
File /usr/lib/python3.12/site-packages/pwnlib/elf/elf.py:1604, in ELF.dynamic_by_tag(self, tag)
AttributeError: 'Section' object has no attribute 'iter_tags'

If the ELF class could pass these checks for debuginfo, more symbols could be grabbed.

peace-maker commented 6 days ago

We should be able to open such ELF files, yes. In the meantime you can use libcdb.unstrip_libc to grab the debuginfo and merge the debuginfo back into the libc via eu-unstrip. Then you can use all symbols on the original libc.so.6.

RocketMaDev commented 6 days ago

But it just failed to load the debuginfo directly. Do you mean that I can only load it after unstrip_libc?

peace-maker commented 6 days ago

We should fix loading external debuginfo files with the ELF class.