Skip to content

Instantly share code, notes, and snippets.

@tachibana51
Last active August 4, 2022 13:51
Show Gist options
  • Save tachibana51/a89a748eaebc8b080eb0b46c35233e0d to your computer and use it in GitHub Desktop.
Save tachibana51/a89a748eaebc8b080eb0b46c35233e0d to your computer and use it in GitHub Desktop.
#!/bin/bash
#
# for ctf
# 配られたlibcが手元に無くても無理やりバイナリを動かすことが出来るようにパッチを行う
#
#
if [ $# -eq 0 ]; then
echo "usage: $0 [ubuntu-version] [glibc-version] elf-file"
exit 1
fi
#get debug symbol and interpreter
sudo docker pull ubuntu:$1
sudo docker run --name tmp$1 -i -t ubuntu:$1 bash -c "apt update && apt install libc6-dbg"
sudo docker cp tmp$1:/lib/x86_64-linux-gnu/ld-$2.so .
sudo docker cp tmp$1:/lib/x86_64-linux-gnu/libc-$2.so "libc.so.6"
mkdir ".debug"
sudo docker cp tmp$1:/usr/lib/debug/lib/x86_64-linux-gnu/libc-$2.so ".debug/libc.so.6"
mkdir -p .debug/lib/x86_64-linux-gnu/
sudo docker cp tmp$1:/usr/lib/debug/lib/x86_64-linux-gnu/ld-$2.so ".debug/ld-$2.so"
sudo docker rm tmp$1
#patchelf
patchelf --set-interpreter `pwd`/ld-$2.so $3
patchelf --replace-needed libc.so.6 "`pwd`/libc.so.6" $3
patchelf --set-rpath `pwd` $3
import gdb
import subprocess
class loadsym(gdb.Command):
"""
load symbol file to glibc
Usage: loadsym {symbol file}
Example:
(gdb) loadsym '/path/to/usr/lib/debug/lib/x86_64-linux-gnu/libc-2.27.so'
"""
def __init__(self):
'''
register command in constructer function
'''
super(self.__class__, self).__init__("loadsym", gdb.COMMAND_USER)
def invoke(self, args, from_tty):
'''
in invoke method, we add command's features
'''
# using string_to_argv to convert args to list
argv = gdb.string_to_argv(args)
#if len(argv) != 1:
# raise gdb.GdbError(
# 'Fail to execute command, use "help loadsym" for help')
print('[*] symbol file path: {}'.format(".debug/libc.so.6"))
# traverse objfiles to find libc
#gdb.execute("set debug-file-directory "+subprocess.check_output(["pwd"]).decode()+"/.debug")
for i in gdb.objfiles():
if 'libc' in i.filename:
self.add_debug_file(i, ".debug/libc.so.6")
return
print('[-] fail to find libc!')
def add_debug_file(self, objfile, debugfile_path):
'''
add debug file and check debug file's status
'''
objfile.add_separate_debug_file(debugfile_path)
# check symbol file is loading
if gdb.lookup_symbol('main_arena') == None:
print('[-] load debug file fail!')
return False
else:
print('[+] load debug file success!')
return True
if __name__ == "__main__":
loadsym()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment