Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Issue finding string literal in readonly memory for userland core #291

Open
sdimitro opened this issue Mar 15, 2023 · 2 comments
Open

Issue finding string literal in readonly memory for userland core #291

sdimitro opened this issue Mar 15, 2023 · 2 comments
Labels
bug Something isn't working

Comments

@sdimitro
Copy link
Contributor

Example test file:

$ cat test.c # compiled with gcc -O0 -g
// C program to demonstrate segmentation fault/core dump
// by modifying a string literal
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

char* str;

int main()
{
	str = "Hello, World!\n";
	// Problem: trying to modify read only memory //
	*(str + 1) = 'n';
	return 0;
}

gdb equivalent pointers:

$ sudo gdb a.out /var/crash/core.a.out.229185.1678905166
GNU gdb (Ubuntu 9.2-0ubuntu1~20.04.1) 9.2
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from b.out...
[New LWP 229185]
Core was generated by `./a.out'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  main () at test.c:13
13		*(str + 1) = 'n';
(gdb) p str
$1 = 0x55e1cb33b004 "Hello, World!\n"
(gdb) p str[0]
$2 = 72 'H'

drgn:

$ drgn -c /var/crash/core.a.out.229185.1678905166
drgn 0.0.22 (using Python 3.8.10, elfutils 0.188, with libkdumpfile)
For help, type help(drgn).
>>> import drgn
>>> from drgn import NULL, Object, cast, container_of, execscript, offsetof, reinterpret, sizeof
>>> from drgn.helpers.common import *
>>> prog['str']
(char *)0x55e1cb33b004
>>> prog['str'][0]
Traceback (most recent call last):
  File "/usr/lib/python3.8/code.py", line 90, in runcode
    exec(code, self.locals)
  File "<console>", line 1, in <module>
  File "/usr/local/lib/python3.8/dist-packages/drgn/internal/cli.py", line 56, in displayhook
    text = value.format_(columns=shutil.get_terminal_size((0, 0)).columns)
_drgn.FaultError: memory not saved in core dump: 0x55e1cb33b004
>>> ^C


$ drgn -c /var/crash/core.a.out.229185.1678905166 -s a.out
drgn 0.0.22 (using Python 3.8.10, elfutils 0.188, with libkdumpfile)
For help, type help(drgn).
>>> import drgn
>>> from drgn import NULL, Object, cast, container_of, execscript, offsetof, reinterpret, sizeof
>>> from drgn.helpers.common import *
>>> prog['str']
Traceback (most recent call last):
  File "/usr/lib/python3.8/code.py", line 90, in runcode
    exec(code, self.locals)
  File "<console>", line 1, in <module>
  File "/usr/local/lib/python3.8/dist-packages/drgn/internal/cli.py", line 56, in displayhook
    text = value.format_(columns=shutil.get_terminal_size((0, 0)).columns)
_drgn.FaultError: could not find memory segment: 0x4018
>>>
@sdimitro
Copy link
Contributor Author

cc @pcd1193182

@osandov
Copy link
Owner

osandov commented Mar 15, 2023

This is a known TODO:

drgn/libdrgn/debug_info.c

Lines 2041 to 2045 in 1133b2f

/*
* TODO: for core dumps, we need to add memory reader segments for
* read-only segments of the loaded binaries since those aren't saved in
* the core dump.
*/

@osandov osandov added the bug Something isn't working label Jul 3, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants