前言
好幾天沒熬夜了…爲了搞幾個gdb工具，我太難了。
pwngdb
pwngdb的功能特別廣泛，主要如下
libc : Print the base address of libc
ld : Print the base address of ld
codebase : Print the base of code segment
heap : Print the base of heap
got : Print the Global Offset Table infomation
dyn : Print the Dynamic section infomation
findcall : Find some function call
bcall : Set the breakpoint at some function call
tls : Print the thread local storage address
at : Attach by process name
findsyscall : Find the syscall
fmtarg : Calculate the index of format string
You need to stop on printf which has vulnerability.
force : Calculate the nb in the house of force.
heapinfo : Print some infomation of heap
heapinfo (Address of arena)
default is the arena of current thread
If tcache is enable, it would show infomation of tcache entry
heapinfoall : Print some infomation of heap (all threads)
arenainfo : Print some infomation of all arena
chunkinfo: Print the infomation of chunk
chunkinfo (Address of victim)
chunkptr : Print the infomation of chunk
chunkptr (Address of user ptr)
mergeinfo : Print the infomation of merge
mergeinfo (Address of victim)
printfastbin : Print some infomation of fastbin
tracemalloc on : Trace the malloc and free and detect some error .
You need to run the process first than tracemalloc on, it will record all of the malloc and free.
You can set the DEBUG in pwngdb.py , than it will print all of the malloc and free infomation such as the screeshot.
parseheap : Parse heap layout
magic : Print useful variable and function in glibc
fp : show FILE structure
fp (Address of FILE)
fpchain: show linked list of FILE
orange : Test house of orange condition in the _IO_flush_lockp
orange (Address of FILE)
glibc version <= 2.23
安裝教程：
cd ~/
git clone https://github.com/scwuaptx/Pwngdb.git
cp ~/Pwngdb/.gdbinit ~/
pwndbg
安裝教程：
git clone https://github.com/pwndbg/pwndbg
cd pwndbg
./setup.sh
這個和上面的可不一樣…區別還是挺大的。pwndbg是我一直以來使用的比較順手的gdb工具，界面好看，而且命令實用。做格式化字符串題目的時候使用到了pwntools裏面的 fmtstr_payload()，其中要傳一個參數就是格式化字符串的offset，而在pwngdb裏面有個fmtarg工具可以直接算出這個offset！所以要pwndbg配合pwngdb使用！
pwngdb+pwndbg聯合使用
我也是第一次知道pwngdb還能附加到pwndbg上面使用…調試花了我好幾個小時。
坑1：
在home目錄下的.gdbinit文件裏面是沒有pwndbg信息的(如果安裝的時候沒寫進去的話)
vim ~/.gdbinit
然後寫入
source ~/pwndbg/gdbinit.py
附：
fmtarg運用實例