search

korcankaraokcu / PINCE

Reverse engineering tool for linux games
Other
2.05k stars 148 forks source link

EOFError when trying to attach #21

Closed tbillington closed 7 years ago

tbillington commented 7 years ago

When trying to attach to a process, command line says

0.0014507770538330078
Last command: pince-get-stack-trace-info

&"source /tmp/PINCE-connection/10995/gdb_command.txt\n"
&"Python Exception <class 'gdb.MemoryError'> Cannot access memory at address 0x850fb148: \n"
&"/tmp/PINCE-connection/10995/gdb_command.txt:1: Error in sourced command file:\n"
&"Error occurred in Python command: Cannot access memory at address 0x850fb148\n"
^error,msg="/tmp/PINCE-connection/10995/gdb_command.txt:1: Error in sourced command file:\nError occurred in Python command: Cannot access memory at address 0x850fb148"

Traceback (most recent call last):
  File "PINCE.py", line 1590, in on_process_stop
    self.update_stacktrace()
  File "PINCE.py", line 1680, in update_stacktrace
    stack_trace_info = GDB_Engine.get_stacktrace_info()
  File "/home/trent/PINCE-master/libPINCE/GDB_Engine.py", line 927, in get_stacktrace_info
    contents_recv = send_command("pince-get-stack-trace-info", recv_with_file=True)
  File "/home/trent/PINCE-master/libPINCE/GDB_Engine.py", line 121, in send_command
    output = pickle.load(open(recv_file, "rb"))
EOFError: Ran out of input

Then when I try to scan for a value It says

Exception test
Traceback (most recent call last):
  File "PINCE.py", line 450, in newfirstscan_onclick
    x = 0 / 0
ZeroDivisionError: division by zero
korcankaraokcu commented 7 years ago

Check the latest patch by executing git pull in terminal. Latest commit ought to solve your problem. If the stacktrace looks completely empty, follow these steps and report me the output: 1-)Open the GDB Console from the top right of main window 2-)Execute "p/x $esp" if your system is x86, "p/x $rsp" if it's x64

Which game are you trying to attach to? I'd like to reproduce the exact situation by myself. Also, by looking at the given address, I'm assuming that you are using x86, is that correct?

As for memory scanning, it isn't implemented yet, so buttons related to memory scanning feature won't work for now. For memory scanning, I recommend you using GameConqueror. I'll fully implement the debugger-related features first, then memory scanning. Because you already have memory scanning tools such as GC and you can use them with PINCE already by using GDB Console. Open the GDB Console and execute phase-out. This detaches PINCE from the process and lets you work with GC. After you are done with GC, you can reattach by executing phase-in and use PINCE's debugging utilities.

korcankaraokcu commented 7 years ago

Misclicked the close button haha :smile: My bad

tbillington commented 7 years ago

It attached successfully :) I was attaching to KOTOR 2.

korcankaraokcu commented 7 years ago

Glad to hear it. Is stacktrace widget empty or has some elements in it?(bottom right part of MemoryViewer window)

tbillington commented 7 years ago

Looks like it's not empty.

I used gameconquerer like you suggested and it worked perfectly for what I was trying to do, just change some values ;)

screenshot from 2017-01-29 11-39-41

korcankaraokcu commented 7 years ago

Thanks for reporting back. Looks like it works without any error. I'm closing this issue then

AlexOxorn commented 3 years ago

I'm having the exact same issue. I'm trying to attach Sonic Adventure 2 (running on Steam Proton) I ran p/x $rsp and got 0x0 as the result. If I close PINCE, the game continues normally

AlexOxorn commented 3 years ago 
Last command: c
^running
*running,thread-id="all"
0.0007817745208740234
~"\nThread "
~"15 \"Launcher.exe\" received signal SIGUSR1, User defined signal 1.\n"
~"0xf7fb0549 in __kernel_vsyscall ()\n"
*stopped,reason="signal-received",signal-name="SIGUSR1",signal-meaning="User defined signal 1",frame={addr="0xf7fb0549",func="__kernel_vsyscall",args=[],arch="i386"},thread-id="15",stopped-threads="all",core="15"
execute condition: False
Last command: info threads
~"  Id   Target Id                 Frame \n"
~"  1    LWP 240009 \"Launcher.exe\" 0x0077ef4d in ?? ()\n"
~"  2    LWP 240014 \"Launcher.exe\" 0xf7fb0549 in __kernel_vsyscall ()\n"
~"  3    LWP 240015 \"Launcher.exe\" 0xf7fb0549 in __kernel_vsyscall ()\n"
~"  4    LWP 240016 \"Launcher.exe\" 0xf7fb0549 in __kernel_vsyscall ()\n"
~"  5    LWP 240017 \"Launcher.exe\" 0xf7fb0549 in __kernel_vsyscall ()\n"
~"  6    LWP 240018 \"Launcher.exe\" 0xf7fb0549 in __kernel_vsyscall ()\n"
~"  7    LWP 240020 \"Launcher.exe\" 0xf7fb0549 in __kernel_vsyscall ()\n"
~"  8    LWP 240021 \"Launcher.exe\" 0xf7fb0549 in __kernel_vsyscall ()\n"
~"  9    LWP 240022 \"Launcher.exe\" 0xf7fb0549 in __kernel_vsyscall ()\n"
~"  10   LWP 240023 \"Launcher.exe\" 0xf7fb0549 in __kernel_vsyscall ()\n"
~"  11   LWP 240024 \"Launcher.exe\" 0xf7fb0549 in __kernel_vsyscall ()\n"
~"  12   LWP 240025 \"Launcher.exe\" 0xf7fb0549 in __kernel_vsyscall ()\n"
~"  13   LWP 240026 \"Launcher.exe\" 0xf7fb0549 in __kernel_vsyscall ()\n"
~"  14   LWP 240027 \"Launcher.exe\" 0xf7fb0549 in __kernel_vsyscall ()\n"
~"* 15   LWP 240028 \"Launcher.exe\" 0xf7fb0549 in __kernel_vsyscall ()\n"
~"  16   LWP 240029 \"Launcher.exe\" 0xf7fb0549 in __kernel_vsyscall ()\n"
~"  17   LWP 240030 \"Launcher.exe\" 0xf7fb0549 in __kernel_vsyscall ()\n"
~"  18   LWP 240031 \"Launcher.exe\" 0xf7fb0549 in __kernel_vsyscall ()\n"
~"  19   LWP 240032 \"Launcher.exe\" 0xf7fb0549 in __kernel_vsyscall ()\n"
~"  20   LWP 240033 \"Launcher.exe\" 0xf7fb0549 in __kernel_vsyscall ()\n"
~"  21   LWP 240034 \"Launcher.exe\" 0xf7fb0549 in __kernel_vsyscall ()\n"
~"  22   LWP 240035 \"Launcher.exe\" 0xf7fb0549 in __kernel_vsyscall ()\n"
~"  23   LWP 240036 \"Launcher.exe\" 0xf7fb0549 in __kernel_vsyscall ()\n"
~"  24   LWP 240038 \"CPMMListener\" 0xf7fb0549 in __kernel_vsyscall ()\n"
^done
0.0015740394592285156
Last command: disas /r $pc,+200
~"Dump of assembler code from 0xf7fb0549 to 0xf7fb0611:\n"
~"=> 0xf7fb0549 <__kernel_vsyscall+9>:\t5d\tpop    ebp\n"
~"   0xf7fb054a <__kernel_vsyscall+10>:\t5a\tpop    edx\n"
~"   0xf7fb054b <__kernel_vsyscall+11>:\t59\tpop    ecx\n"
~"   0xf7fb054c <__kernel_vsyscall+12>:\tc3\tret    \n"
~"   0xf7fb054d:\t90\tnop\n"
~"   0xf7fb054e:\t90\tnop\n"
~"   0xf7fb054f:\t90\tnop\n"
~"   0xf7fb0550:\t90\tnop\n"
~"   0xf7fb0551:\t8d b4 26 00 00 00 00\tlea    esi,[esi+eiz*1+0x0]\n"
~"   0xf7fb0558:\t8d b4 26 00 00 00 00\tlea    esi,[esi+eiz*1+0x0]\n"
~"   0xf7fb055f:\t90\tnop\n"
~"   0xf7fb0560 <__kernel_sigreturn+0>:\t58\tpop    eax\n"
~"   0xf7fb0561 <__kernel_sigreturn+1>:\tb8 77 00 00 00\tmov    eax,0x77\n"
~"   0xf7fb0566 <__kernel_sigreturn+6>:\tcd 80\tint    0x80\n"
~"   0xf7fb0568 <__kernel_sigreturn+8>:\t90\tnop\n"
~"   0xf7fb0569:\t8d b4 26 00 00 00 00\tlea    esi,[esi+eiz*1+0x0]\n"
~"   0xf7fb0570 <__kernel_rt_sigreturn+0>:\tb8 ad 00 00 00\tmov    eax,0xad\n"
~"   0xf7fb0575 <__kernel_rt_sigreturn+5>:\tcd 80\tint    0x80\n"
~"   0xf7fb0577 <__kernel_rt_sigreturn+7>:\t90\tnop\n"
~"   0xf7fb0578:\t90\tnop\n"
~"   0xf7fb0579:\t90\tnop\n"
~"   0xf7fb057a:\t90\tnop\n"
~"   0xf7fb057b:\t90\tnop\n"
~"   0xf7fb057c:\t90\tnop\n"
~"   0xf7fb057d:\t90\tnop\n"
~"   0xf7fb057e:\t90\tnop\n"
~"   0xf7fb057f:\t90\tnop\n"
~"   0xf7fb0580:\te8 4f 0f 00 00\tcall   0xf7fb14d4\n"
~"   0xf7fb0585:\t81 c1 27 fe ff ff\tadd    ecx,0xfffffe27\n"
~"   0xf7fb058b:\t55\tpush   ebp\n"
~"   0xf7fb058c:\t83 c0 02\tadd    eax,0x2\n"
~"   0xf7fb058f:\tc1 e0 04\tshl    eax,0x4\n"
~"   0xf7fb0592:\t89 e5\tmov    ebp,esp\n"
~"   0xf7fb0594:\t57\tpush   edi\n"
~"   0xf7fb0595:\t89 d7\tmov    edi,edx\n"
~"   0xf7fb0597:\t56\tpush   esi\n"
~"   0xf7fb0598:\t53\tpush   ebx\n"
~"   0xf7fb0599:\t8d 1d d4 ec ff ff\tlea    ebx,ds:0xffffecd4\n"
~"   0xf7fb059f:\t8d b4 01 d4 ec ff ff\tlea    esi,[ecx+eax*1-0x132c]\n"
~"   0xf7fb05a6:\t83 ec 24\tsub    esp,0x24\n"
~"   0xf7fb05a9:\t89 45 e4\tmov    DWORD PTR [ebp-0x1c],eax\n"
~"   0xf7fb05ac:\t8b 04 0b\tmov    eax,DWORD PTR [ebx+ecx*1]\n"
~"   0xf7fb05af:\t89 45 e8\tmov    DWORD PTR [ebp-0x18],eax\n"
~"   0xf7fb05b2:\ta8 01\ttest   al,0x1\n"
~"   0xf7fb05b4:\t0f 85 9f 00 00 00\tjne    0xf7fb0659\n"
~"   0xf7fb05ba:\t8b 06\tmov    eax,DWORD PTR [esi]\n"
~"   0xf7fb05bc:\t8b 56 04\tmov    edx,DWORD PTR [esi+0x4]\n"
~"   0xf7fb05bf:\t89 45 d8\tmov    DWORD PTR [ebp-0x28],eax\n"
~"   0xf7fb05c2:\t8b 46 08\tmov    eax,DWORD PTR [esi+0x8]\n"
~"   0xf7fb05c5:\t89 55 dc\tmov    DWORD PTR [ebp-0x24],edx\n"
~"   0xf7fb05c8:\t8b 56 0c\tmov    edx,DWORD PTR [esi+0xc]\n"
~"   0xf7fb05cb:\t89 45 d0\tmov    DWORD PTR [ebp-0x30],eax\n"
~"   0xf7fb05ce:\t89 55 d4\tmov    DWORD PTR [ebp-0x2c],edx\n"
~"   0xf7fb05d1:\t8b 14 0b\tmov    edx,DWORD PTR [ebx+ecx*1]\n"
~"   0xf7fb05d4:\t39 55 e8\tcmp    DWORD PTR [ebp-0x18],edx\n"
~"   0xf7fb05d7:\t75 d3\tjne    0xf7fb05ac\n"
~"   0xf7fb05d9:\t8b 45 e4\tmov    eax,DWORD PTR [ebp-0x1c]\n"
~"   0xf7fb05dc:\t8b 55 d8\tmov    edx,DWORD PTR [ebp-0x28]\n"
~"   0xf7fb05df:\t8d 84 01 d4 bc ff ff\tlea    eax,[ecx+eax*1-0x432c]\n"
~"   0xf7fb05e6:\t8b 4d dc\tmov    ecx,DWORD PTR [ebp-0x24]\n"
~"   0xf7fb05e9:\t03 10\tadd    edx,DWORD PTR [eax]\n"
~"   0xf7fb05eb:\t13 48 04\tadc    ecx,DWORD PTR [eax+0x4]\n"
~"   0xf7fb05ee:\t89 55 e8\tmov    DWORD PTR [ebp-0x18],edx\n"
~"   0xf7fb05f1:\t8b 55 d0\tmov    edx,DWORD PTR [ebp-0x30]\n"
~"   0xf7fb05f4:\t89 4d ec\tmov    DWORD PTR [ebp-0x14],ecx\n"
~"   0xf7fb05f7:\t03 50 08\tadd    edx,DWORD PTR [eax+0x8]\n"
~"   0xf7fb05fa:\t8b 4d d4\tmov    ecx,DWORD PTR [ebp-0x2c]\n"
~"   0xf7fb05fd:\t13 48 0c\tadc    ecx,DWORD PTR [eax+0xc]\n"
~"   0xf7fb0600:\t89 d0\tmov    eax,edx\n"
~"   0xf7fb0602:\t89 ca\tmov    edx,ecx\n"
~"   0xf7fb0604:\tb9 ff c9 9a 3b\tmov    ecx,0x3b9ac9ff\n"
~"   0xf7fb0609:\t39 c1\tcmp    ecx,eax\n"
~"   0xf7fb060b:\tb9 00 00 00 00\tmov    ecx,0x0\n"
~"   0xf7fb0610:\t19 d1\tsbb    ecx,edx\n"
~"End of assembler dump.\n"
^done
0.0015132427215576172
Last command: pince-examine-expressions
^done
0.0006694793701171875
Last command: interpreter-exec mi "-break-list"
^done,BreakpointTable={nr_rows="0",nr_cols="6",hdr=[{width="7",alignment="-1",col_name="number",colhdr="Num"},{width="14",alignment="-1",col_name="type",colhdr="Type"},{width="4",alignment="-1",col_name="disp",colhdr="Disp"},{width="3",alignment="-1",col_name="enabled",colhdr="Enb"},{width="10",alignment="-1",col_name="addr",colhdr="Address"},{width="40",alignment="2",col_name="what",colhdr="What"}],body=[]}
^done
0.0005173683166503906
Last command: pince-read-registers
^done
0.00074005126953125
Last command: pince-get-stack-trace-info
&"Python Exception <class 'gdb.MemoryError'> Cannot access memory at address 0x8b55ff8b: \n"
&"/dev/shm/PINCE-connection/240009/gdb_command.txt:1: Error in sourced command file:\n"
&"Error occurred in Python: Cannot access memory at address 0x8b55ff8b\n"
^error,msg="/dev/shm/PINCE-connection/240009/gdb_command.txt:1: Error in sourced command file:\nError occurred in Python: Cannot access memory at address 0x8b55ff8b"
Traceback (most recent call last):
  File "PINCE.py", line 2667, in on_process_stop
    self.update_stacktrace()
  File "PINCE.py", line 2759, in update_stacktrace
    stack_trace_info = GDB_Engine.get_stacktrace_info()
  File "/home/alexoxorn/Documents/projects/cpp/cheat_engine/PINCE/libPINCE/GDB_Engine.py", line 1231, in get_stacktrace_info
    return send_command("pince-get-stack-trace-info", recv_with_file=True)
  File "/home/alexoxorn/Documents/projects/cpp/cheat_engine/PINCE/libPINCE/GDB_Engine.py", line 238, in send_command
    output = pickle.load(open(recv_file, "rb"))
EOFError: Ran out of input
AlexOxorn commented 3 years ago

It might be because whenever SA2 isn't in focus, the game pauses, and PINCE is keeping it paused even when I go back into focus?

korcankaraokcu commented 3 years ago

Does this only happen once when you attach? Can you refresh the stacktrace without any problems?

AlexOxorn commented 3 years ago

So I don't know if this answers your question, if I detach GDB, then it works without issue. Also when it is attached, every time I try to resume (press F3) it advances a single frame before stopping again.

korcankaraokcu commented 3 years ago

~"15 \"Launcher.exe\" received signal SIGUSR1, User defined signal 1.\n"

You might want to check this wiki page

AlexOxorn commented 3 years ago

Thank you for that. It is now better, but still weird. It'll run for about 2ish seconds before pausing again with this message

Last command: interpreter-exec mi "-break-list"
^done,BreakpointTable={nr_rows="0",nr_cols="6",hdr=[{width="7",alignment="-1",col_name="number",colhdr="Num"},{width="14",alignment="-1",col_name="type",colhdr="Type"},{width="4",alignment="-1",col_name="disp",colhdr="Disp"},{width="3",alignment="-1",col_name="enabled",colhdr="Enb"},{width="10",alignment="-1",col_name="addr",colhdr="Address"},{width="40",alignment="2",col_name="what",colhdr="What"}],body=[]}
korcankaraokcu commented 3 years ago

Enable GDB logging from the settings and post the full gdb log when it stops for the first time. GDB log can be accessed from the memory viewer window