Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

How to use gdb to debug plugins in Sabre #91

Open
songxpu opened this issue Aug 25, 2023 · 1 comment
Open

How to use gdb to debug plugins in Sabre #91

songxpu opened this issue Aug 25, 2023 · 1 comment

Comments

@songxpu
Copy link

songxpu commented Aug 25, 2023

For example
/sabre ./plugins/sbr-trace/libsbr-trace.so -- test_sbrtrace_hello.

What should we do to debug libsbr-trace.so intercept and replace system calls in gdb? For example, the program executes the write system call, and the plugin prints out some log messages before executing write.

image

Even though I used gdb to debug sabre, gdb was never able to intercept and view the code function in the dynamic link library libsbr-trace.so that rewrites the system call.

Understanding this process is very important for writing new plugins, can you answer and explain this process, thanks.

@songxpu
Copy link
Author

songxpu commented Aug 25, 2023

More specifically:
Program

#include <stdio.h>

int main(int argc, char *argv[]) {
  printf("Hello World!\n");
  return 0;
}

libsbr-trace.so: we write the handle_syscall_real to implement rewriting, and the function iwrite shows how we rewrite write.

I am familiar with debugging the code of the target binary program launched by SaBRe, but I'm uncertain about how to effectively observe the implementation code of the plugin's system call rewrite for the target, specifically referring to the iwrite function, during the execution of the binary program.

This code is just a demo, but I'm actually debugging the two plugins now, i.e., https://github.com/andronat/SaBRe/blob/snapfuzz/plugins/sbr-afl/main.c and https://raw.githubusercontent.com/srg-imperial/SaBRe/master/plugins/sbr-trace/strace.c

long handle_syscall_real(long s...) {
  ...
  if (sc_no == SYS_write) {
    return iwrite(arg1, (const void *)arg2, arg3);  
}

ssize_t iwrite(int fd, const void *buf, size_t count) {
    // do something firstly  **Q: how to debug this code**
    long rc = real_syscall(SYS_write, fd, (long)buf, count, 0, 0, 0);
   ...
  }
  return real_syscall(SYS_write, fd, (long)buf, count, 0, 0, 0);
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant