Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

deref: added option to use reference address for offset calculation #676

Merged
merged 12 commits into from
Jul 22, 2021

Conversation

theguy147
Copy link
Collaborator

@theguy147 theguy147 commented Jul 20, 2021

Added Option for custom offset calculations for deref command

Description/Motivation/Screenshots

This patch allows to set a different base address for offset calculation for the dereference command while not breaking previous usage. This allows quicker identification of relevant memory addresses in some cases. A common use case is using ebp/rbp as a reference on the stack in x86 architecture (see e.g the very old issue #67): That way gefs dereference command output can e.g. be compared easier to most, if not all, disassembler and decompiler outputs for stack variables.

This is how the new usage looks like:

gef> dereference $rsp l7 r$rbp
0x00007ffe6ddaa3e0│-0x0030: 0x0000000000000000    ← $rsp
0x00007ffe6ddaa3e8│-0x0028: 0x0000000000400970  →  <__libc_csu_init+0> push r15
0x00007ffe6ddaa3f0│-0x0020: 0x0000000000000000
0x00007ffe6ddaa3f8│-0x0018: 0x00000000004006e0  →  <_start+0> xor ebp, ebp
0x00007ffe6ddaa400│-0x0010: 0x00007ffe6ddaa500  →  0x0000000000000001
0x00007ffe6ddaa408│-0x0008: 0xa42456b3ee465800
0x00007ffe6ddaa410│+0x0000: 0x0000000000000000    ← $rbp

The new offset reference starts with a r-prefix followed by a LOCATION.

Technically the patch just adds an reference argument to the dereference command that is used to calculate the difference to the start_address and this difference is added/subtracted to the outputted offset.

How Has This Been Tested?

Architecture Yes/No Comments
x86-32 ✖️
x86-64 ✔️ manual testing of the new feature
ARM ✖️
AARCH64 ✖️
MIPS ✖️
POWERPC ✖️
SPARC ✖️
RISC-V ✖️
make tests ✖️

No testing has been done because no other features of gef have been touched and also the new base address is an optional argument to pprint_dereferenced().

Checklist

  • My PR was done against the dev branch, not master.
  • My code follows the code style of this project.
  • My change includes a change to the documentation, if required.
  • My change adds tests as appropriate. (IMO no additional tests necessary but I can still do that if needed?)
  • I have read and agree to the CONTRIBUTING document.

EDIT:
An important change to the earlier version in terms of having offsets on the stack reference rbp/ebp is that now also negative offsets are possible as usual with disassemblers/decompilers as well. Also the command can be used in other places than the stack and is not tied to the architecture (as it would be in the solution suggested in the above linked issue)

@theguy147
Copy link
Collaborator Author

sorry for all the tiny commits! :/ i'm done now (unless you want me to change other stuff)

@Grazfather
Copy link
Collaborator

No problem, we will squash, I just have to test this out.

@daniellimws
Copy link
Collaborator

I did a simple test, works well, nice stuff 👍

@hugsy
Copy link
Owner

hugsy commented Jul 22, 2021

Happy to merge when squashed, it looks like a good command (couldn't test yet).

@Grazfather Grazfather merged commit 57d8450 into hugsy:dev Jul 22, 2021
@theguy147 theguy147 deleted the deref branch July 31, 2021 00:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants