search

hugsy / gef

GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux
https://hugsy.github.io/gef
MIT License
6.94k stars 730 forks source link

context failed NoneType object has no attribute sizeof #799

Closed hellow554 closed 2 years ago

hellow554 commented 2 years ago

Step 1: Describe your environment

Step 2: Describe your problem

When I try to debug my application remotely I'm seeing a lot of Command 'context' failed to execute proplery messages. Directly after reset I see registers and the stack, but as soon as I run to main, I don't see them anymore:

grafik

grafik

Steps to reproduce

  1. Get yourself a stm32 dev board
  2. With the help of https://github.com/rust-embedded/cortex-m-quickstart/ build a example for your board (with an empty main).
  3. use cargo build and afterwards gdb-multiarch to connect to your target

Minimalist test case

#![no_std]
#![no_main]

use cortex_m::asm;
use cortex_m_rt::entry;
use stm32l4 as _;

use panic_halt as _;

#[entry]
fn main() -> ! {
    asm::nop(); // To not have main optimize to abort in release mode, remove when you add code

    loop {
        // your code goes here
    }
}

Traces

Trace ``` Breakpoint 4, l4::__cortex_m_rt_main_trampoline () at src/main.rs:10 10 #[entry] [ Legend: Modified register | Code | Heap | Stack | String ] ───────────────────────────────────────────────────────────────────────────────────── registers ──── ─────────────────────────────── Exception raised ─────────────────────────────── AttributeError: 'NoneType' object has no attribute 'sizeof' ───────────────────────────── Detailed stacktrace ────────────────────────────── ↳ File "/home/marcel/.gef.py", line 3710, in _ptr_width() → return uintptr_t.sizeof ↳ File "/home/marcel/.gef.py", line 3724, in is_32bit() → return _ptr_width() == 4 ↳ File "/home/marcel/.gef.py", line 3812, in get_memory_alignment() → if is_32bit(): ↳ File "/home/marcel/.gef.py", line 1888, in ptrsize() → return get_memory_alignment() ↳ File "/home/marcel/.gef.py", line 7516, in do_invoke() → memsize = current_arch.ptrsize ↳ File "/home/marcel/.gef.py", line 2980, in wrapper() → return f(*args, **kwargs) ↳ File "/home/marcel/.gef.py", line 2852, in wrapper() → return f(*args, **kwargs) ↳ File "/home/marcel/.gef.py", line 240, in wrapper() → return f(*args, **kwargs) ↳ File "/home/marcel/.gef.py", line 4616, in invoke() → bufferize(self.do_invoke)(argv) ─────────────────────────────────── Version ──────────────────────────────────── GEF: (Standalone) Blob Hash(/home/marcel/.gef.py): 612300df463844ee76d5dcf244053fb75b0c8b78 SHA1(/home/marcel/.gef.py): 470e64dd79a138efe82ee0b59616e04a43742d72 GDB: 11.1 GDB-Python: 3.9 Loaded commands: $, aliases, aliases add, aliases ls, aliases rm, aslr, assemble, canary, capstone-disassemble, checksec, context, dereference, edit-flags, elf-info, entry-break, format-string-helper, functions, gef-remote, got, heap, heap arenas, heap bins, heap bins fast, heap bins large, heap bins small, heap bins tcache, heap bins unsorted, heap chunk, heap chunks, heap set-arena, heap-analysis-helper, hexdump, hexdump byte, hexdump dword, hexdump qword, hexdump word, highlight, highlight add, highlight clear, highlight list, highlight remove, hijack-fd, ida-interact, is-syscall, ksymaddr, memory, memory list, memory reset, memory unwatch, memory watch, name-break, nop, patch, patch byte, patch dword, patch qword, patch string, patch word, pattern, pattern create, pattern search, pcustom, pcustom edit, pcustom list, pcustom show, pie, pie attach, pie breakpoint, pie delete, pie info, pie remote, pie run, print-format, process-search, process-status, registers, reset-cache, scan, search-pattern, set-permission, shellcode, shellcode get, shellcode search, stub, syscall-args, theme, trace-run, unicorn-emulate, version, vmmap, xfiles, xinfo, xor-memory, xor-memory display, xor-memory patch ───────────────────────────── Last 10 GDB commands ───────────────────────────── 250 c 251 version 252 version 253 si 254 break main 255 c 256 !cat src/main.rs 257 gef config gef.debug 1 258 break main 259 c ───────────────────────────── Runtime environment ────────────────────────────── * GDB: 11.1 * Python: 3.9.7 - final * OS: Linux - 5.10.60.1-microsoft-standard-WSL2 (x86_64) No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 21.10 Release: 21.10 Codename: impish ──────────────────────────────────────────────────────────────────────────────── ───────────────────────────────────────────────────────────────────────────────────────── stack ──── ─────────────────────────────── Exception raised ─────────────────────────────── AttributeError: 'NoneType' object has no attribute 'sizeof' ───────────────────────────── Detailed stacktrace ────────────────────────────── ↳ File "/home/marcel/.gef.py", line 3710, in _ptr_width() → return uintptr_t.sizeof ↳ File "/home/marcel/.gef.py", line 3724, in is_32bit() → return _ptr_width() == 4 ↳ File "/home/marcel/.gef.py", line 3182, in download_file() → if is_32bit(): ↳ File "/home/marcel/.gef.py", line 3197, in open_file() → lpath = download_file(path, use_cache) ↳ File "/home/marcel/.gef.py", line 3215, in get_process_maps_linux() → with open_file(proc_map_file, use_cache=False) as f: ↳ File "/home/marcel/.gef.py", line 3274, in get_process_maps() → return list(get_process_maps_linux(fpath)) ↳ File "/home/marcel/.gef.py", line 3357, in process_lookup_address() → for sect in get_process_maps(): ↳ File "/home/marcel/.gef.py", line 9466, in do_invoke() → if process_lookup_address(target_addr) is None: ↳ File "/home/marcel/.gef.py", line 2980, in wrapper() → return f(*args, **kwargs) ↳ File "/home/marcel/.gef.py", line 2852, in wrapper() → return f(*args, **kwargs) ↳ File "/home/marcel/.gef.py", line 240, in wrapper() → return f(*args, **kwargs) ↳ File "/home/marcel/.gef.py", line 4616, in invoke() → bufferize(self.do_invoke)(argv) ─────────────────────────────────── Version ──────────────────────────────────── GEF: (Standalone) Blob Hash(/home/marcel/.gef.py): 612300df463844ee76d5dcf244053fb75b0c8b78 SHA1(/home/marcel/.gef.py): 470e64dd79a138efe82ee0b59616e04a43742d72 GDB: 11.1 GDB-Python: 3.9 Loaded commands: $, aliases, aliases add, aliases ls, aliases rm, aslr, assemble, canary, capstone-disassemble, checksec, context, dereference, edit-flags, elf-info, entry-break, format-string-helper, functions, gef-remote, got, heap, heap arenas, heap bins, heap bins fast, heap bins large, heap bins small, heap bins tcache, heap bins unsorted, heap chunk, heap chunks, heap set-arena, heap-analysis-helper, hexdump, hexdump byte, hexdump dword, hexdump qword, hexdump word, highlight, highlight add, highlight clear, highlight list, highlight remove, hijack-fd, ida-interact, is-syscall, ksymaddr, memory, memory list, memory reset, memory unwatch, memory watch, name-break, nop, patch, patch byte, patch dword, patch qword, patch string, patch word, pattern, pattern create, pattern search, pcustom, pcustom edit, pcustom list, pcustom show, pie, pie attach, pie breakpoint, pie delete, pie info, pie remote, pie run, print-format, process-search, process-status, registers, reset-cache, scan, search-pattern, set-permission, shellcode, shellcode get, shellcode search, stub, syscall-args, theme, trace-run, unicorn-emulate, version, vmmap, xfiles, xinfo, xor-memory, xor-memory display, xor-memory patch ───────────────────────────── Last 10 GDB commands ───────────────────────────── 250 c 251 version 252 version 253 si 254 break main 255 c 256 !cat src/main.rs 257 gef config gef.debug 1 258 break main 259 c ───────────────────────────── Runtime environment ────────────────────────────── * GDB: 11.1 * Python: 3.9.7 - final * OS: Linux - 5.10.60.1-microsoft-standard-WSL2 (x86_64) No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 21.10 Release: 21.10 Codename: impish ──────────────────────────────────────────────────────────────────────────────── ─────────────────────────────── Exception raised ─────────────────────────────── TypeError: unsupported operand type(s) for &: 'NoneType' and 'int' ───────────────────────────── Detailed stacktrace ────────────────────────────── ↳ File "/home/marcel/.gef.py", line 2030, in is_thumb() → return is_alive() and get_register(self.flag_register) & (1 << 5) ↳ File "/home/marcel/.gef.py", line 2035, in pc() → if self.is_thumb(): ↳ File "/home/marcel/.gef.py", line 8493, in context_code() → pc = current_arch.pc ↳ File "/home/marcel/.gef.py", line 8355, in do_invoke() → display_pane_function() ↳ File "/home/marcel/.gef.py", line 2852, in wrapper() → return f(*args, **kwargs) ↳ File "/home/marcel/.gef.py", line 244, in wrapper() → rv = f(*args, **kwargs) ↳ File "/home/marcel/.gef.py", line 4616, in invoke() → bufferize(self.do_invoke)(argv) ─────────────────────────────────── Version ──────────────────────────────────── GEF: (Standalone) Blob Hash(/home/marcel/.gef.py): 612300df463844ee76d5dcf244053fb75b0c8b78 SHA1(/home/marcel/.gef.py): 470e64dd79a138efe82ee0b59616e04a43742d72 GDB: 11.1 GDB-Python: 3.9 Loaded commands: $, aliases, aliases add, aliases ls, aliases rm, aslr, assemble, canary, capstone-disassemble, checksec, context, dereference, edit-flags, elf-info, entry-break, format-string-helper, functions, gef-remote, got, heap, heap arenas, heap bins, heap bins fast, heap bins large, heap bins small, heap bins tcache, heap bins unsorted, heap chunk, heap chunks, heap set-arena, heap-analysis-helper, hexdump, hexdump byte, hexdump dword, hexdump qword, hexdump word, highlight, highlight add, highlight clear, highlight list, highlight remove, hijack-fd, ida-interact, is-syscall, ksymaddr, memory, memory list, memory reset, memory unwatch, memory watch, name-break, nop, patch, patch byte, patch dword, patch qword, patch string, patch word, pattern, pattern create, pattern search, pcustom, pcustom edit, pcustom list, pcustom show, pie, pie attach, pie breakpoint, pie delete, pie info, pie remote, pie run, print-format, process-search, process-status, registers, reset-cache, scan, search-pattern, set-permission, shellcode, shellcode get, shellcode search, stub, syscall-args, theme, trace-run, unicorn-emulate, version, vmmap, xfiles, xinfo, xor-memory, xor-memory display, xor-memory patch ───────────────────────────── Last 10 GDB commands ───────────────────────────── 250 c 251 version 252 version 253 si 254 break main 255 c 256 !cat src/main.rs 257 gef config gef.debug 1 258 break main 259 c ───────────────────────────── Runtime environment ────────────────────────────── * GDB: 11.1 * Python: 3.9.7 - final * OS: Linux - 5.10.60.1-microsoft-standard-WSL2 (x86_64) No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 21.10 Release: 21.10 Codename: impish ──────────────────────────────────────────────────────────────────────────────── ```
theguy147 commented 2 years ago

thank you for the issue @hellow554 !

I can't find your GEF version anywhere in our git history, did you modify any files? for us to be able to help with this issue you have to use a clean, unmodified GEF version from dev branch.

Also have you tried if the issue also exists with a rust binary for x86/x86_64? that would greatly improve our possibilities to understand the issue. Because unfortunately I don't have any stm32 lying around so I cant follow along :/

hellow554 commented 2 years ago

I took the latest ~dev~ master. Maybe vim added a newline?

x86(_64) works fine, for Linux and for windows.

I'm more than willing to help you and resolve this issue. Maybe using qemu will have the same effect, let me try that real quick

theguy147 commented 2 years ago

I took the latest dev. Maybe vim added a newline?

are you sure? on the latest dev e.g. the version command should return a SHA256 instead of SHA1

yeah, a working qemu setup would be great. looking at your code snippet I guess you took it from the Embedded Rust Book? If so I can try the qemu setup they describe there...

hellow554 commented 2 years ago

fuzz.exe.zip

Here's the arm binary, the command line and another dump from gef:

qemu-system-arm -kernel  fuzz.exe --machine stm32vldiscovery -S -s
Trace ``` Remote debugging using :1234 Reset () at asm.S:44 44 in asm.S [ Legend: Modified register | Code | Heap | Stack | String ] ───────────────────────────────────────────────────────────────────────────────────── registers ──── ─────────────────────────────── Exception raised ─────────────────────────────── TypeError: unsupported operand type(s) for &: 'NoneType' and 'int' ───────────────────────────── Detailed stacktrace ────────────────────────────── ↳ File "/home/marcel/.gef.py", line 2365, in is_thumb() → return is_alive() and gef.arch.register(self.flag_register) & (1 << 5) ↳ File "/home/marcel/.gef.py", line 2385, in ptrsize() → return 2 if self.is_thumb() else 4 ↳ File "/home/marcel/.gef.py", line 7416, in do_invoke() → memsize = gef.arch.ptrsize ↳ File "/home/marcel/.gef.py", line 508, in wrapper() → return f(*args, **kwargs) ↳ File "/home/marcel/.gef.py", line 358, in wrapper() → return f(*args, **kwargs) ↳ File "/home/marcel/.gef.py", line 251, in wrapper() → return f(*args, **kwargs) ↳ File "/home/marcel/.gef.py", line 4518, in invoke() → bufferize(self.do_invoke)(argv) ─────────────────────────────────── Version ──────────────────────────────────── GEF: (Standalone) Blob Hash(/home/marcel/.gef.py): d146bead0373345349301b57d7940e96182d9793 SHA256(/home/marcel/.gef.py): 9c3886071c2ba2cb6459b15e3ca20e5bf7314665d0725f4f79ca8f9cc2f8861f GDB: 11.2 GDB-Python: 3.10 Loaded commands: $, aliases, aliases add, aliases ls, aliases rm, aslr, canary, capstone-disassemble, checksec, context, dereference, edit-flags, elf-info, entry-break, format-string-helper, functions, gef-remote, got, heap, heap arenas, heap bins, heap bins fast, heap bins large, heap bins small, heap bins tcache, heap bins unsorted, heap chunk, heap chunks, heap set-arena, heap-analysis-helper, hexdump, hexdump byte, hexdump dword, hexdump qword, hexdump word, highlight, highlight add, highlight clear, highlight list, highlight remove, hijack-fd, ida-interact, is-syscall, ksymaddr, memory, memory list, memory reset, memory unwatch, memory watch, name-break, nop, patch, patch byte, patch dword, patch qword, patch string, patch word, pattern, pattern create, pattern search, pcustom, pcustom edit, pcustom list, pcustom show, pie, pie attach, pie breakpoint, pie delete, pie info, pie remote, pie run, print-format, process-search, process-status, registers, reset-cache, ropper, scan, search-pattern, shellcode, shellcode get, shellcode search, stub, syscall-args, theme, trace-run, unicorn-emulate, version, vmmap, xfiles, xinfo, xor-memory, xor-memory display, xor-memory patch ───────────────────────────── Last 10 GDB commands ───────────────────────────── 129 target ext :3333 130 load 131 c 132 bt 133 target ext :1234 134 c 135 target ext :1234 136 gef config gef.debug 1 137 si 138 target ext :1234 ───────────────────────────── Runtime environment ────────────────────────────── * GDB: 11.2 * Python: 3.10.2 - final * OS: Linux - 5.16.1-arch1-1 (x86_64) LSB Version: 1.4 Distributor ID: Arch Description: Arch Linux Release: rolling Codename: n/a ──────────────────────────────────────────────────────────────────────────────── ───────────────────────────────────────────────────────────────────────────────────────── stack ──── ─────────────────────────────── Exception raised ─────────────────────────────── TypeError: unsupported operand type(s) for &: 'NoneType' and 'int' ───────────────────────────── Detailed stacktrace ────────────────────────────── ↳ File "/home/marcel/.gef.py", line 2365, in is_thumb() → return is_alive() and gef.arch.register(self.flag_register) & (1 << 5) ↳ File "/home/marcel/.gef.py", line 2385, in ptrsize() → return 2 if self.is_thumb() else 4 ↳ File "/home/marcel/.gef.py", line 3660, in is_32bit() → return gef.arch.ptrsize == 4 ↳ File "/home/marcel/.gef.py", line 3245, in download_file() → if is_32bit(): ↳ File "/home/marcel/.gef.py", line 11268, in open_file() → lpath = download_file(path, use_cache) ↳ File "/home/marcel/.gef.py", line 11275, in __parse_procfs_maps() → with open_file(__process_map_file, use_cache=False) as fd: ↳ File "/home/marcel/.gef.py", line 11258, in __parse_maps() → return list(self.__parse_procfs_maps()) ↳ File "/home/marcel/.gef.py", line 11252, in maps() → self.__maps = self.__parse_maps() ↳ File "/home/marcel/.gef.py", line 3303, in process_lookup_address() → for sect in gef.memory.maps: ↳ File "/home/marcel/.gef.py", line 9345, in do_invoke() → if process_lookup_address(target_addr) is None: ↳ File "/home/marcel/.gef.py", line 508, in wrapper() → return f(*args, **kwargs) ↳ File "/home/marcel/.gef.py", line 358, in wrapper() → return f(*args, **kwargs) ↳ File "/home/marcel/.gef.py", line 251, in wrapper() → return f(*args, **kwargs) ↳ File "/home/marcel/.gef.py", line 4518, in invoke() → bufferize(self.do_invoke)(argv) ─────────────────────────────────── Version ──────────────────────────────────── GEF: (Standalone) Blob Hash(/home/marcel/.gef.py): d146bead0373345349301b57d7940e96182d9793 SHA256(/home/marcel/.gef.py): 9c3886071c2ba2cb6459b15e3ca20e5bf7314665d0725f4f79ca8f9cc2f8861f GDB: 11.2 GDB-Python: 3.10 Loaded commands: $, aliases, aliases add, aliases ls, aliases rm, aslr, canary, capstone-disassemble, checksec, context, dereference, edit-flags, elf-info, entry-break, format-string-helper, functions, gef-remote, got, heap, heap arenas, heap bins, heap bins fast, heap bins large, heap bins small, heap bins tcache, heap bins unsorted, heap chunk, heap chunks, heap set-arena, heap-analysis-helper, hexdump, hexdump byte, hexdump dword, hexdump qword, hexdump word, highlight, highlight add, highlight clear, highlight list, highlight remove, hijack-fd, ida-interact, is-syscall, ksymaddr, memory, memory list, memory reset, memory unwatch, memory watch, name-break, nop, patch, patch byte, patch dword, patch qword, patch string, patch word, pattern, pattern create, pattern search, pcustom, pcustom edit, pcustom list, pcustom show, pie, pie attach, pie breakpoint, pie delete, pie info, pie remote, pie run, print-format, process-search, process-status, registers, reset-cache, ropper, scan, search-pattern, shellcode, shellcode get, shellcode search, stub, syscall-args, theme, trace-run, unicorn-emulate, version, vmmap, xfiles, xinfo, xor-memory, xor-memory display, xor-memory patch ───────────────────────────── Last 10 GDB commands ───────────────────────────── 129 target ext :3333 130 load 131 c 132 bt 133 target ext :1234 134 c 135 target ext :1234 136 gef config gef.debug 1 137 si 138 target ext :1234 ───────────────────────────── Runtime environment ────────────────────────────── * GDB: 11.2 * Python: 3.10.2 - final * OS: Linux - 5.16.1-arch1-1 (x86_64) LSB Version: 1.4 Distributor ID: Arch Description: Arch Linux Release: rolling Codename: n/a ──────────────────────────────────────────────────────────────────────────────── ─────────────────────────────── Exception raised ─────────────────────────────── TypeError: unsupported operand type(s) for &: 'NoneType' and 'int' ───────────────────────────── Detailed stacktrace ────────────────────────────── ↳ File "/home/marcel/.gef.py", line 2365, in is_thumb() → return is_alive() and gef.arch.register(self.flag_register) & (1 << 5) ↳ File "/home/marcel/.gef.py", line 2370, in pc() → if self.is_thumb(): ↳ File "/home/marcel/.gef.py", line 8387, in context_code() → pc = gef.arch.pc ↳ File "/home/marcel/.gef.py", line 8249, in do_invoke() → display_pane_function() ↳ File "/home/marcel/.gef.py", line 358, in wrapper() → return f(*args, **kwargs) ↳ File "/home/marcel/.gef.py", line 255, in wrapper() → rv = f(*args, **kwargs) ↳ File "/home/marcel/.gef.py", line 4518, in invoke() → bufferize(self.do_invoke)(argv) ─────────────────────────────────── Version ──────────────────────────────────── GEF: (Standalone) Blob Hash(/home/marcel/.gef.py): d146bead0373345349301b57d7940e96182d9793 SHA256(/home/marcel/.gef.py): 9c3886071c2ba2cb6459b15e3ca20e5bf7314665d0725f4f79ca8f9cc2f8861f GDB: 11.2 GDB-Python: 3.10 Loaded commands: $, aliases, aliases add, aliases ls, aliases rm, aslr, canary, capstone-disassemble, checksec, context, dereference, edit-flags, elf-info, entry-break, format-string-helper, functions, gef-remote, got, heap, heap arenas, heap bins, heap bins fast, heap bins large, heap bins small, heap bins tcache, heap bins unsorted, heap chunk, heap chunks, heap set-arena, heap-analysis-helper, hexdump, hexdump byte, hexdump dword, hexdump qword, hexdump word, highlight, highlight add, highlight clear, highlight list, highlight remove, hijack-fd, ida-interact, is-syscall, ksymaddr, memory, memory list, memory reset, memory unwatch, memory watch, name-break, nop, patch, patch byte, patch dword, patch qword, patch string, patch word, pattern, pattern create, pattern search, pcustom, pcustom edit, pcustom list, pcustom show, pie, pie attach, pie breakpoint, pie delete, pie info, pie remote, pie run, print-format, process-search, process-status, registers, reset-cache, ropper, scan, search-pattern, shellcode, shellcode get, shellcode search, stub, syscall-args, theme, trace-run, unicorn-emulate, version, vmmap, xfiles, xinfo, xor-memory, xor-memory display, xor-memory patch ───────────────────────────── Last 10 GDB commands ───────────────────────────── 129 target ext :3333 130 load 131 c 132 bt 133 target ext :1234 134 c 135 target ext :1234 136 gef config gef.debug 1 137 si 138 target ext :1234 ───────────────────────────── Runtime environment ────────────────────────────── * GDB: 11.2 * Python: 3.10.2 - final * OS: Linux - 5.16.1-arch1-1 (x86_64) LSB Version: 1.4 Distributor ID: Arch Description: Arch Linux Release: rolling Codename: n/a ──────────────────────────────────────────────────────────────────────────────── ```

Hope this helps!

hugsy commented 2 years ago

hugsy/gef-extras#45 was just merged, you can either try again with the version on the dev branch or wait for this weekend for the next relese that will include those changes. I think they should fix your issue:

image
hellow554 commented 2 years ago

1643132102_grim

@hugsy still no luck. Also I would like that this works out of the box without me running pi reset_architecture.... Is that possible? :/

hugsy commented 2 years ago

There are some things wrong in your screenshot, for example you need to use gef-remote which is a wrapper that collects more info than gdb's target command. Also you might want to retry by pulling the very latest commit (yesterday) in dev

However I'll take a further look at it after the next release is out.

Also I would like that this works out of the box without me running pi reset_architecture.... Is that possible? :/

It can be automatical if you add pi reset_architecture("ARM-M") to your gdbinit after gef.py is sourced.

stale[bot] commented 2 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. You can reopen it by adding a comment to this issue.

stale[bot] commented 2 years ago

This issue has been automatically closed because it has not had recent activity. If you are the owner of this issue, you can either re-open it and provide a more complete description; or create a new issue. Thank you for your contributions.