Show code at target of jump

hugsy / gef

GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux

https://hugsy.github.io/gef

MIT License

6.82k stars 721 forks source link

Show code at target of jump #61

Closed Grazfather closed 7 years ago

Grazfather commented 8 years ago

If a jump is to be taken, it would be nice if the code context view could disassemble at the jump target.

Grazfather commented 8 years ago

Hacked it in a bit:

hugsy commented 8 years ago

Looking forward to see your PR for that :smile:

hugsy commented 8 years ago

Just don't forget to test all supported architectures (ARM, MIPS, PowerPC and SPARC).

Grazfather commented 8 years ago

That's what will take the most time. Right now it's x86 and only when it isn't something like jmp eax Do you know if that's something capstone can resolve?

hugsy commented 8 years ago

You can use gdb.parse_and_eval for that (see docs). Capstone is a disassembler, it cannot evaluate the operand values.

Grazfather commented 8 years ago

Sweet that'll probably be easiest. TY.

hugsy commented 8 years ago

No worries. The Python API for GDB documentation is actually quite complete, so you should be able to find all you need in there. It's just not that easy to search into it in a useful manner, but Google FTW

Grazfather commented 8 years ago

Finally got to look at this more, but it's going to be tricky. parse_and_eval can help me evaluate a target, but I'll have to recognize registers and use the correct syntax. I haven't used unicorn but if it's super lightweight maybe we could simulate the next instruction once we know its the jump and read the target pc?

Also we'll need a is_branch since we want this to work for all jumps, not just conditionals.

hugsy commented 7 years ago

parse_and_eval can evaluate registers as well. I can have a look at you already did, did you push it to Github ?

Grazfather commented 7 years ago

Just pushed. I swear I normally wouldn't push code this ugly! https://github.com/hugsy/gef/compare/master...Grazfather:show_target

hugsy commented 7 years ago

Ok I get your idea. I'll branch it, but it will take bit of effort to have it work on all architectures.

As always mate, thanks for the feedbacks!

hugsy commented 7 years ago

Current state:

[x] x86-32 / x86-64 (introduced by a669961)
[x] arm (introduced by a669961)
[x] mips (introduced by a669961)
[x] powerpc (introduced by a669961)
[x] sparcv9 ( introduced by 5cff50f)
[x] aarch64 (introduced by ee9422d)

hugsy commented 7 years ago

Pushed to master.