hugsy / gef

GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux
https://hugsy.github.io/gef
MIT License
6.87k stars 726 forks source link

any possible to add vmmap to show kernel memory in qemu? #1038

Closed bb33bb closed 7 months ago

bb33bb commented 9 months ago

Type of feature request

Additional API

Misc

No response

Summary Description

when using gef to debug linux /android kernel in qemu vmmap can not show kernel memory as list ,just like pwndbg did

Implementation idea/suggestion

add new feature

Existing alternatives?

No response

Additional information

No response

ValekoZ commented 9 months ago

Maybe it would be nice to check how Qemu-system cooperation is implemented in bata's fork ? It adds a lot of improvements for kernel debugging, but it is annoying to have to change gef's version when doing userland or kernel land

We could just add basic features to gef's core and then add plugins to gef extra for more specific features ?

bb33bb commented 9 months ago

Ok And it's true that pwndbg is really heavy

hugsy commented 9 months ago

We could just add basic features to gef's core and then add plugins to gef extra for more specific features ?

Absolutely, bata's gef fork is now very different from vanilla gef as it relies on a much much older version. Over the last few years, gef has been refactored and simplified to be used as a lib, so many of bata's new commands can be added quite trivially to gef-extras and I'm convinced feature-parity could be reached quickly. Improving kernel debugging has been long standing in the wishlist, but it's hard to find time 😔

hugsy commented 9 months ago

And it's true that pwndbg is really heavy

It's very hard to maintain a balance 🙂 GEF itself (not extra) will always be one single file, no dependency with a strong support for usermode bins of any arch supported by gdb. pwndbg is more of a framework. There's pros and cons to both.

hugsy commented 9 months ago

FWIW I've now updated and publicly opened the project for improving kernel debugging support in GEF.

No timeline on this, and contributions are (as always) welcome 🥰

stale[bot] commented 7 months ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. You can reopen it by adding a comment to this issue.