README
¶
riptracer
Execution tracer written in go. Think strace/ltrace for arbitrary code locations. Set breakpoints, manipulate memory/registers, etc...
Why?
Do you know how implement a software breakpoint, or a how to set a hardware breakpoint? I had used both in gdb for years without understanding exactly how these are implemented. I wanted to change that, and so what better way than implementing a debugger yourself?
I've been a longtime fan of usercorn. I even have a repo of example script usercorn_examples. But there are some drawbacks to having to emulate everything. Not all the system calls are implemented, and if the binary does threading, we're probably in for a rough time. I wanted to debug a threaded binary without emulating, and have custom debug functionality.
Why not just use gdb?
With the power of gdb and some gdb scripts we'd be able to do similar functionality, but we'd need gdb on our target system, along with python for the scripting etc... All of which is fine, and totally possible, but a nicely compiled go binary can be deployed without having to worry about the dependencies needed. I want to spend time learning and debugging, not cross-compiling and in dependency hell.
Disclaimer
This is a toy project, I'll update it for as long as I find it useful and interesting. My aim here is not to rewrite strace/strace/dtrace/gdb/rr etc... You should totally use those for anything serious.
Documentation
¶
Index ¶
- Constants
- Variables
- func CBFunctionArgs(pid int, bp BreakPoint)
- func CBPrintRegisters(pid int, bp BreakPoint)
- func CBPrintStack(pid int, bp BreakPoint)
- func Dump(buff []byte)
- type BreakPoint
- type CallBackFunction
- type ELF32_Rela
- type ELF32_Rela_Info
- type ELF64_Rela
- type ELF64_Rela_Info
- type SymbolResolver
- type Tracer
- func (t *Tracer) ConvertOffsetToAddress(breakAddress uintptr) uintptr
- func (t *Tracer) EnableVerbose()
- func (t *Tracer) GetBaseAddress() (uintptr, error)
- func (t *Tracer) GetMemMaps() ([]*procfs.ProcMap, error)
- func (t *Tracer) SetBreakpointAbsolute(breakAddress uintptr, cb CallBackFunction)
- func (t *Tracer) SetBreakpointRelative(breakAddress uintptr, cb CallBackFunction)
- func (t *Tracer) SetExeComparisonLength(length int)
- func (t *Tracer) SetFollowForks(enable bool)
- func (t *Tracer) SetHWBreakpointAbsolute(breakAddress uintptr, cb CallBackFunction)
- func (t *Tracer) SetHWBreakpointRelative(breakAddress uintptr, cb CallBackFunction)
- func (t *Tracer) Start()
- func (t *Tracer) Stop()
Constants ¶
const DEFAULTEXECMPLENGTH = 32
How many bytes we want to use to compare mem to executable
const DR_OFFSET = 0x350
https://en.wikipedia.org/wiki/X86_debug_register
const REG_SIZE = 0x8
Variables ¶
var Blue = "\033[34m"
var Cyan = "\033[36m"
var Gray = "\033[37m"
var Green = "\033[32m"
var Purple = "\033[35m"
var Red = "\033[31m"
var Reset = "\033[0m"
var White = "\033[97m"
var Yellow = "\033[33m"
Functions ¶
func CBFunctionArgs ¶
func CBFunctionArgs(pid int, bp BreakPoint)
func CBPrintRegisters ¶
func CBPrintRegisters(pid int, bp BreakPoint)
func CBPrintStack ¶
func CBPrintStack(pid int, bp BreakPoint)
Types ¶
type BreakPoint ¶
type BreakPoint struct {
Address uintptr
OriginalCode *[]byte
Hits int
Callbacks []CallBackFunction
}
type CallBackFunction ¶
type CallBackFunction func(int, BreakPoint) // CallBack Function Pointer
type ELF32_Rela ¶ added in v0.0.6
type ELF32_Rela struct {
R_offset uint32
R_info ELF32_Rela_Info
R_addend int32
}
type ELF32_Rela_Info ¶ added in v0.0.6
type ELF64_Rela ¶ added in v0.0.6
type ELF64_Rela struct {
R_offset uint64
R_info ELF64_Rela_Info
R_addend int64
}
type ELF64_Rela_Info ¶ added in v0.0.6
type SymbolResolver ¶ added in v0.0.6
func NewSymbolResolver ¶ added in v0.0.6
func NewSymbolResolver(filepath string) (*SymbolResolver, error)
func (*SymbolResolver) GetPLTOffsetBySymName ¶ added in v0.0.6
func (s *SymbolResolver) GetPLTOffsetBySymName(symName string) (uintptr, error)
func (*SymbolResolver) GetPLTSymNameByOffset ¶ added in v0.0.7
func (s *SymbolResolver) GetPLTSymNameByOffset(offset uint64) (string, error)
type Tracer ¶
type Tracer struct {
Process *os.Process
ProcFS procfs.FS
// contains filtered or unexported fields
}
func NewTracerFromPid ¶
func NewTracerStartCommand ¶
func (*Tracer) ConvertOffsetToAddress ¶
func (*Tracer) EnableVerbose ¶
func (t *Tracer) EnableVerbose()
func (*Tracer) GetBaseAddress ¶
func (*Tracer) SetBreakpointAbsolute ¶
func (t *Tracer) SetBreakpointAbsolute(breakAddress uintptr, cb CallBackFunction)
func (*Tracer) SetBreakpointRelative ¶
func (t *Tracer) SetBreakpointRelative(breakAddress uintptr, cb CallBackFunction)
func (*Tracer) SetExeComparisonLength ¶
func (*Tracer) SetFollowForks ¶
func (*Tracer) SetHWBreakpointAbsolute ¶ added in v0.0.10
func (t *Tracer) SetHWBreakpointAbsolute(breakAddress uintptr, cb CallBackFunction)
func (*Tracer) SetHWBreakpointRelative ¶ added in v0.0.10
func (t *Tracer) SetHWBreakpointRelative(breakAddress uintptr, cb CallBackFunction)
Source Files
Directories