1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
|
diff --git a/docs/commands/got-audit.md b/docs/commands/got-audit.md
new file mode 100644
index 0000000..e14a834
--- /dev/null
+++ b/docs/commands/got-audit.md
@@ -0,0 +1,36 @@
+## Command `got-audit`
+
+Display the current state of GOT table of the running process.
+
+The `got-audit` command optionally takes function names and filters the output displaying only the
+matching functions.
+
+The command output will list symbols in the GOT along with the file providing the mapped memory
+where the symbol's value points.
+
+If the file providing the mapped memory doesn't export the symbol, `got-audit` will print an
+error. If multiple files export the named symbol, `got-audit` will print an error.
+
+```text
+gef➤ got-audit
+```
+
+
+
+The applied filter partially matches the name of the functions, so you can do something like this.
+
+```text
+gef➤ got-audit str
+gef➤ got-audit print
+gef➤ got-audit read
+```
+
+
+
+Example of multiple partial filters:
+
+```text
+gef➤ got-audit str get
+```
+
+
diff --git a/tests/commands/got_audit.py b/tests/commands/got_audit.py
new file mode 100644
index 0000000..ae2470b
--- /dev/null
+++ b/tests/commands/got_audit.py
@@ -0,0 +1,42 @@
+"""
+`got-audit` command test module
+"""
+
+import pytest
+
+from tests.base import RemoteGefUnitTestGeneric
+
+from tests.utils import (
+ ARCH,
+ ERROR_INACTIVE_SESSION_MESSAGE,
+ debug_target,
+)
+
+
+@pytest.mark.skipif(ARCH in ("ppc64le",), reason=f"Skipped for {ARCH}")
+class GotAuditCommand(RemoteGefUnitTestGeneric):
+ """`got-audit` command test module"""
+
+ def setUp(self) -> None:
+ self._target = debug_target("format-string-helper")
+ return super().setUp()
+
+
+ def test_cmd_got_audit(self):
+ gdb = self._gdb
+
+ self.assertEqual(ERROR_INACTIVE_SESSION_MESSAGE,gdb.execute("got-audit", to_string=True))
+
+ # Advance the program until after GOT symbols have been resolved
+ gdb.execute("start")
+ gdb.execute("break greetz")
+ gdb.execute("run beep")
+ gdb.execute("step 4")
+ res = gdb.execute("got-audit", to_string=True)
+ self.assertIn("printf", res)
+ self.assertIn("strcpy", res)
+ self.assertIn("/libc.so.6", res)
+
+ res = gdb.execute("got-audit printf", to_string=True)
+ self.assertIn("printf", res)
+ self.assertNotIn("strcpy", res)
diff --git a/gef.py b/gef.py
index 804dbae..2093b9c 100644
--- a/gef.py
+++ b/gef.py
@@ -9382,6 +9382,63 @@ class GotCommand(GenericCommand):
return
+@register
+class GotAuditCommand(GotCommand, GenericCommand):
+ """Display current status of the got inside the process with paths providing functions."""
+
+ _cmdline_ = "got-audit"
+ _syntax_ = f"{_cmdline_} [FUNCTION_NAME ...] "
+ _example_ = "got-audit read printf exit"
+ _symbols_: Dict[str, List[str]] = collections.defaultdict(list)
+ _paths_: Dict[str, List[str]] = collections.defaultdict(list)
+ _expected_dups_ = ['__cxa_finalize']
+
+ def get_symbols_from_path(self, elf_file):
+ nm = gef.session.constants["nm"]
+ # retrieve symbols using nm
+ lines = gef_execute_external([nm, "-D", elf_file], as_list=True)
+ for line in lines:
+ words = line.split()
+ # Record the symbol if it is in the text section or
+ # an indirect function or weak symbol
+ if len(words) == 3 and words[-2] in ('T', 'i', 'I', 'v', 'V', 'w', 'W'):
+ sym = words[-1].split('@')[0]
+ if elf_file not in self._symbols_[sym]:
+ self._symbols_[sym].append(elf_file)
+ self._paths_[elf_file].append(sym)
+
+ @only_if_gdb_running
+ def do_invoke(self, argv: List[str]) -> None:
+ # Build a list of the symbols provided by each path, and
+ # a list of paths that provide each symbol.
+ for section in gef.memory.maps:
+ if (section.path not in self._paths_
+ and pathlib.Path(section.path).is_file()
+ and section.permission & Permission.EXECUTE):
+ self.get_symbols_from_path(section.path)
+ return super().do_invoke(argv)
+
+ def build_line(self, name: str, color: str, address_val: int, got_address: int):
+ line = Color.colorify(f"{name}", color)
+ found = 0
+ for section in gef.memory.maps:
+ if not got_address in range(section.page_start, section.page_end):
+ continue
+ line += f" : {section.path}"
+ found = 1
+ short_name = name.split('@')[0]
+ if (len(self._symbols_[short_name]) > 1
+ and short_name not in self._expected_dups_):
+ line += f" :: ERROR {short_name} found in multiple paths ({str(self._symbols_[short_name])})"
+ if (section.path != "[vdso]"
+ and short_name not in self._paths_[section.path]):
+ line += f" :: ERROR {short_name} not exported by {section.path}"
+ break
+ if not found:
+ line += " : no mapping found"
+ return line
+
+
@register
class HighlightCommand(GenericCommand):
"""Highlight user-defined text matches in GEF output universally."""
|
