Skip to content

pwntools compatibility issue due to gdb related problems #3736

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
astro-angelfish opened this issue Apr 28, 2024 · 1 comment
Closed

pwntools compatibility issue due to gdb related problems #3736

astro-angelfish opened this issue Apr 28, 2024 · 1 comment

Comments

@astro-angelfish
Copy link

astro-angelfish commented Apr 28, 2024

Description of bug / unexpected behavior

I was making a video about computer science by manim, and trying to combine manim with pwntools so i can just simplify my job on data copying and processing. But manim seems to be unhappy with other libraries that uses gdb.

Everything works fine until I invoked pwntools, which involves gdb.

Expected behavior

manim and pwntools do their own duties and help me to generate a video for me.

How to reproduce the issue

Try generating the video by the code below, with an 96x96 processor image in png format named icons8-processor-96.png.

Also pwntools can be obtained by pip install pwntools

Code for reproducing the problem
import manim
import pwn
import numpy

class CpuStructure(manim.Scene):
    def construct(self):
        self.cpu_icon = manim.ImageMobject("icons8-processor-96.png")
        self.cpu_icon.move_to(numpy.array([0, 3, 0]))
        self.play(manim.FadeIn(self.cpu_icon))
        cpu_label = manim.Text("x86_64 processor")
        cpu_label.scale(0.5)
        cpu_label.next_to(self.cpu_icon, manim.RIGHT)
        self.play(manim.Write(cpu_label))
        self.wait()
        self.play(manim.Unwrite(cpu_label))
        self.wait()

        self.register_animations()

    def register_animations(self):
        user_mode_registers = manim.Rectangle(color=manim.WHITE, height=3, width=5, grid_xstep=5 / 6, grid_ystep=0.5)
        cpu_point = manim.Dot(point=numpy.array([0, 3, 0]), fill_opacity=0, stroke_opacity=0, background_stroke_opacity=0)

        reg_label = manim.Text("register")
        reg_label.next_to(user_mode_registers, manim.UP)
        reg_label.scale(0.5)

        self.play(manim.Transform(cpu_point, user_mode_registers, replace_mobject_with_target_in_scene=True),
                  manim.Write(reg_label))
        self.wait()

        register_labels = []
        registers = ["RAX", "RBX", "RCX", "RDX", "RDI", "RSI", "R8", "R9", "R10", "R11", "R12", "R13", "R14", "R15",
                     "RSP", "RBP", "RIP", "..."]
        for i in range(len(registers)):
            label = manim.Text(registers[i])
            label.scale(0.35)
            label.move_to(numpy.array([-2.1+(i%3/3*5), 1.25-int(i/3)*0.5, 0]))
            register_labels.append(label)
        self.play(*(manim.Write(label) for label in register_labels))

        self.wait()

        self.play(manim.Indicate(register_labels[16]))
        self.wait()

        self.play(manim.Indicate(register_labels[14]))
        self.wait()

        self.play(manim.Indicate(register_labels[15]))
        self.wait()

        self.play(manim.Indicate(register_labels[1]))
        self.wait()

        pwn.context.arch="amd64"
        process = pwn.process(["./example"])
        gdb_pid, gdb_inst = pwn.gdb.attach(process, api=True)
        process.sendline(pwn.asm("""
        push rax
        push rbx
        push rcx
        push rdx
        push rdi
        push rsi
        push r8
        push r9
        push r10
        push r11
        push r12
        push r13
        push r14
        push r15
        
        mov rax, 1
        mov rbx, 2
        mov rcx, 3
        mov rdx, 4
        mov rdi, 5
        mov rsi, 6
        mov r8, 7
        mov r9, 8
        mov r10, 9
        mov r11, 10
        mov r12, 11
        mov r13, 12
        mov r14, 13
        mov r15, 14
        
        pop r15
        pop r14
        pop r13
        pop r12
        pop r11
        pop r10
        pop r9
        pop r8
        pop rsi
        pop rdi
        pop rdx
        pop rcx
        pop rbx
        pop rax
        ret
        """))

        for i in range(5):
            gdb_inst.execute("fin")
            gdb_inst.wait()

        for i in range(2):
            gdb_inst.execute("ni")
            gdb_inst.wait()

        gdb_inst.execute("si")
        gdb_inst.wait()

        reg_value_table = []
        for i in range(len(registers) - 1):
            label = manim.Integer(0)
            label.scale(0.35)
            label.move_to(numpy.array([-2 + (i % 3 / 3 * 5), 1.25 - int(i / 3) * 0.5, 0]))
            reg_value_table.append(label)

        self.play(*(manim.Write(i) for i in reg_value_table))
        self.wait()

        for line in range(44):
            frame = gdb_inst.selected_frame()

            for i in range(len(registers) - 1):
                print(registers[i].lower())
                print(frame.read_register(registers[i].lower()))
                reg_value_table[i].set_value(frame.read_register(registers[i].lower()))
                gdb_inst.wait()
            self.wait(duration=0.1)

            gdb_inst.execute("ni")
            gdb_inst.wait()

        gdb_inst.quit()
        process.close()

        self.wait()
Compile these code to `example` ELF
#include <sys/mman.h>
#include <stdio.h>
#include <unistd.h>

int main()
{
    void* a = mmap(NULL, getpagesize(), PROT_EXEC | PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, 0, 0);
    fgets(a, getpagesize(), stdin);
    (*(void(*)())a)();
    return 0;
}

Additional media files

Images/GIFs

Logs

Terminal output

Log file

System specifications

System Details
  • OS (with version, e.g., Windows 10 v2004 or macOS 10.15 (Catalina)): Linux AL-1S 6.8.7-arch1-1 #1 SMP PREEMPT_DYNAMIC Wed, 17 Apr 2024 15:20:28 +0000 x86_64 GNU/Linux
  • RAM: 16G
  • Python version (python/py/python3 --version): Python 3.11.8
  • Installed modules (provide output from pip list): venv this time
LaTeX details
  • LaTeX distribution (e.g. TeX Live 2020): texlive-basic 2024.2-1
  • Installed LaTeX packages:

tlmgrlist.txt

FFMPEG

Output of ffmpeg -version:

ffmpeg version n6.1.1 Copyright (c) 2000-2023 the FFmpeg developers
built with gcc 13.2.1 (GCC) 20230801
configuration: --prefix=/usr --disable-debug --disable-static --disable-stripping --enable-amf --enable-avisynth --enable-cuda-llvm --enable-lto --enable-fontconfig --enable-frei0r --enable-gmp --enable-gnutls --enable-gpl --enable-ladspa --enable-libaom --enable-libass --enable-libbluray --enable-libbs2b --enable-libdav1d --enable-libdrm --enable-libfreetype --enable-libfribidi --enable-libgsm --enable-libharfbuzz --enable-libiec61883 --enable-libjack --enable-libjxl --enable-libmodplug --enable-libmp3lame --enable-libopencore_amrnb --enable-libopencore_amrwb --enable-libopenjpeg --enable-libopenmpt --enable-libopus --enable-libplacebo --enable-libpulse --enable-librav1e --enable-librsvg --enable-librubberband --enable-libsnappy --enable-libsoxr --enable-libspeex --enable-libsrt --enable-libssh --enable-libsvtav1 --enable-libtheora --enable-libv4l2 --enable-libvidstab --enable-libvmaf --enable-libvorbis --enable-libvpl --enable-libvpx --enable-libwebp --enable-libx264 --enable-libx265 --enable-libxcb --enable-libxml2 --enable-libxvid --enable-libzimg --enable-nvdec --enable-nvenc --enable-opencl --enable-opengl --enable-shared --enable-vapoursynth --enable-version3 --enable-vulkan
libavutil      58. 29.100 / 58. 29.100
libavcodec     60. 31.102 / 60. 31.102
libavformat    60. 16.100 / 60. 16.100
libavdevice    60.  3.100 / 60.  3.100
libavfilter     9. 12.100 /  9. 12.100
libswscale      7.  5.100 /  7.  5.100
libswresample   4. 12.100 /  4. 12.100
libpostproc    57.  3.100 / 57.  3.100

Additional comments

I was trying to use remote-debugging feature on pwntools. I wonder if it is the same issue with #3713 I reported last time because they are all gdb-related issues.

pwntools was working fine on its end until the manim got unhappy, causing the whole python process to exit.

@astro-angelfish
Copy link
Author

I've realized that I've misused the api. Closing it now. Sorry for disturbing.

@astro-angelfish astro-angelfish closed this as not planned Won't fix, can't repro, duplicate, stale Apr 30, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: 🆕 New
Development

No branches or pull requests

1 participant