TR kizaki Tech Memo

Pwndbg by Dockerfile[result]

try to use docker image

└─(15:04:44 on main ✖ ✹ ✭)──> docker search pwndbg              ──(Mon,May22)─┘
NAME                               DESCRIPTION                                     STARS     OFFICIAL   AUTOMATED
pdxlabcoat/pwndbg                  Docker image of pwndbg for gdb debugger with…   0                    
disconnect3d/pwndbg                                                                0                    
shangkuei/pwndbg                                                                   0                    
johnee/pwndbg                                                                      0                    
equation314/pwndbg_qemu_emulate                                                    0                    
lxzmads/pwndbgenv                                                                  0                    
disconnect3d/pwndbg_and_pwntools                                                   0                    
1072709884/pwndbg3                                                                 0                    
learnreverseengineering/pwndbg     The base Ubuntu 20 image with GDB / pwndbg a…   0                    
1072709884/pwndbg                                                                  0                    
1072709884/pwndbg2                                                                 0                    
vv0lll/pwndbg-kali                                                                 0                    
beswing/ubuntu-17.10-for-pwn       CTF Pwn , Pwntools, pwndbg                      0                    
63um3um/pwn-ubuntu                 pwn-ubuntu with pwntools, seccomp-tools,  pw…   0                    
d0ublew/pwn-env                    Environment for pwn-ing CTF challenges with …   0                    
codefuck/pwntools_pwndbg           A Docker image with pwntools and pwndbg inst…   0                    
jmzr/pwnbuntu                      ubuntu pwntools pwndbg                          0

└─(15:05:06 on main ✖ ✹ ✭)──> docker pull pdxlabcoat/pwndbg
└─(15:13:31 on main ✖ ✹ ✭)──> docker run -it -d --name pwndbg pdxlabcoat/pwndbg                ──(Mon,May22)─┘
818dbb4ca21e3f0e86207872ccf92061e3a4a5874cb491702569e0b6dfd838fc
┌─(~)──────────────────────────────────────────────────────────┐
└─(15:14:49 on main ✖ ✹ ✭)──> docker ps                                                        ──(Mon,May22)─┘
CONTAINER ID   IMAGE               COMMAND       CREATED         STATUS         PORTS     NAMES
818dbb4ca21e   pdxlabcoat/pwndbg   "/bin/bash"   6 seconds ago   Up 5 seconds             pwndbg
5d7967093a35   ubuntu:latest       "/bin/bash"   3 hours ago     Up 2 hours               ubuntuforbdg
*********************************
********* TESTS SUMMARY *********
*********************************
Tests passed or skipped: 24
Tests failed: 2
  • ubuntu_docker環境をDockerfile baseでdevtool下に構築してみる
#Dockerfile
FROM ubuntu:22.04
RUN yes | unminimize
RUN apt-get update && \
        apt-get install -y locales vim tmux less
        WORKDIR $HOME/devtool/ubuntu_docker
#docker-compose.yml
version: '3.7'
services:
  app:
    build: .
    tty: true
    volumes:
      - .:/$HOME/devtool/linux_docker

コンテナの構築・起動

ターミナルに戻り、docker-compose.ymlファイルがあるディレクトリで下記のコマンドを入力し、コンテナをバックグラウンドで構築・起動します。

└─(16:39:42 on main ✖ ✹ ✭)──> docker compose up -d          1 ↵ ──(Mon,May22)─┘
[+] Building 73.2s (9/9) FINISHED                                               
 => [internal] load build definition from Dockerfile                       0.0s
 => => transferring dockerfile: 196B                                       0.0s
 => [internal] load .dockerignore                                          0.0s
 => => transferring context: 2B                                            0.0s
 => [internal] load metadata for docker.io/library/ubuntu:22.04            3.1s
 => [auth] library/ubuntu:pull token for registry-1.docker.io              0.0s
 => [1/4] FROM docker.io/library/ubuntu:22.04@sha256:dfd64a3b4296d8c9b62a  0.0s
 => [2/4] RUN yes | unminimize                                            47.3s
 => [3/4] RUN apt-get update &&         apt-get install -y locales vim t  20.3s
 => [4/4] WORKDIR /devtool/ubuntu_docker                                   0.1s 
 => exporting to image                                                     2.3s 
 => => exporting layers                                                    2.3s 
 => => writing image sha256:ef9eadc5aba46b2fec5570acb0e8abe82352a040b3a45  0.0s 
 => => naming to docker.io/library/ubuntu_docker-app                       0.0s 
[+] Running 2/2                                                                 
 ✔ Network ubuntu_docker_default  Creat...                                 0.3s 
 ✔ Container ubuntu_docker-app-1  Start...
└─(16:42:49 on main ✖ ✹ ✭)──> docker ps                         ──(Mon,May22)─┘
CONTAINER ID   IMAGE               COMMAND       CREATED              STATUS              PORTS     NAMES
57f922c75251   ubuntu_docker-app   "/bin/bash"   About a minute ago   Up About a minute             ubuntu_docker-app-1
┌─~/devtool/ubuntu_dock

下記のように、指定したディレクトリ名が行末に表示されていたら、Ubuntu22.04の環境の構築は完了です。

┌─(~/devtool/ubuntu_docker)─────┐
└─(16:46:18 on main ✖ ✹ ✭)──> docker compose exec app bash                               1 ↵ ──(Mon,May22)─┘
root@:/devtool/ubuntu_docker#

Docker上で作業をする際は、その都度、コンテナの構築・起動から行ってください。

作業したい時に構築して、終わったら破棄するの繰り返しです。

:/devtool/ubuntu_docker# exit
exit
┌─(~/devtool/ubuntu_docker)──────────────────────────────────┐
└─(16:54:18 on main ✖ ✹ ✭)──> docker compose down                                      127 ↵ ──(Mon,May22)─┘
[+] Running 2/2
 ✔ Container ubuntu_docker-app-1  Removed                                                              10.5s 
 ✔ Network ubuntu_docker_default  Removed
─(~/devtool/pwndbg)────────────┐
└─(20:51:00 on dev)──> docker compose run main ./tests.sh  17 ↵ ──(Mon,May22)─┘
[+] Running 1/1
 ✔ Network pwndbg_default  Created                                         0.1s 
[+] Building 438.9s (18/18) FINISHED                                            
 => [internal] load .dockerignore                                          0.0s
 => => transferring context: 2B                                            0.0s
 => [internal] load build definition from Dockerfile                       0.0s
 => => transferring dockerfile: 1.53kB                                     0.0s
 => [internal] load metadata for docker.io/library/ubuntu:20.04            2.6s
 => [auth] library/ubuntu:pull token for registry-1.docker.io              0.0s
 => [internal] load build context                                          0.2s
 => => transferring context: 46.95kB                                       0.1s
 => [ 1/12] FROM docker.io/library/ubuntu:20.04@sha256:db8bf6f4fb351aa7a2  0.0s
 => CACHED [ 2/12] WORKDIR /pwndbg                                         0.0s
 => [ 3/12] RUN ln -snf /usr/share/zoneinfo/America/New_York /etc/localt  44.9s
 => [ 4/12] ADD ./setup.sh /pwndbg/                                        0.1s
 => [ 5/12] ADD ./requirements.txt /pwndbg/                                0.1s 
 => [ 6/12] ADD ./dev-requirements.txt /pwndbg/                            0.1s 
 => [ 7/12] RUN sed -i "s/^git submodule/#git submodule/" ./setup.sh &&  165.0s 
 => [ 8/12] ADD ./setup-dev.sh /pwndbg/                                    0.2s 
 => [ 9/12] RUN ./setup-dev.sh                                           179.5s 
 => [10/12] RUN echo "source /pwndbg/gdbinit.py" >> ~/.gdbinit.py          1.0s 
 => [11/12] ADD . /pwndbg/                                                 0.9s 
 => [12/12] RUN git submodule update --init --recursive                    0.5s 
 => exporting to image                                                    43.1s 
 => => exporting layers                                                   43.1s 
 => => writing image sha256:6d2db06017e4db6f985963c18b757c07115fce64636f6  0.0s
 => => naming to docker.io/library/pwndbg-main                             0.0s
ZIGPATH set to /opt/zig
[+] Building tls.i386.c
/opt/zig/zig cc \
-Wall -DDEBUG=1 -ggdb -O0 -gdwarf-4 \
-target i386-linux-gnu \
-o tls.i386.out tls.i386.c
[+] Building heap_bugs.out
/opt/zig/zig cc \
-Wall -DDEBUG=1 -ggdb -O0 -gdwarf-4 \
-Wno-int-to-pointer-cast -Wno-int-conversion -Wno-unused-variable \
-target native-native-gnu.2.33 \
-Wl,-rpath=/pwndbg/tests/gdb-tests/tests/binaries/glibcs/2.33:\
-Wl,--dynamic-linker=/pwndbg/tests/gdb-tests/tests/binaries/glibcs/2.33/ld-linux-x86-64.so.2 \
-o heap_bugs.out heap_bugs.c
[+] Building 'initialized_heap.out'
[+] Building 'heap_bins.out'
[+] Building 'div_zero.out'
[+] Building multiple_threads.out
gcc -g -O0 -o multiple_threads.out multiple_threads.c -pthread -lpthread
[+] Building 'telescope_binary.out'
[+] Building 'tabstop.out'
[+] Building 'reference-binary-net.out'
[+] Building tls.x86-64.c
/opt/zig/zig cc \
-Wall -DDEBUG=1 -ggdb -O0 -gdwarf-4 \
-target x86_64-linux-gnu \
-o tls.x86-64.out tls.x86-64.c
[+] Building 'heap_find_fake_fast.out'
[+] Building 'reference-binary.out'
[+] Building heap_malloc_chunk.out
gcc -g -O0 -Wno-nonnull -Wno-unused-result -o heap_malloc_chunk.out heap_malloc_chunk.c -pthread -lpthread
[+] Building 'use-fds.out'
[+] Building issue_1565.out
gcc -g -O0 -o issue_1565.out issue_1565.c -pthread -lpthread
[+] Building heap_vis.out
gcc -g -O0 -Wno-nonnull -o heap_vis.out heap_vis.c -pthread -lpthread
[+] Building 'emulate_disasm.o'
[+] Linking 'emulate_disasm.out'
[+] Building 'emulate_disasm_loop.o'
[+] Linking 'emulate_disasm_loop.out'
[+] Building 'memory.o'
[+] Linking 'memory.out'
[+] Building 'syscalls-x64.o'
[+] Linking 'syscalls-x64.out'
[+] Building 'gosample.x86'
[+] Building 'gosample.x64'
[+] Building reference_bin_pie.out
/opt/zig/zig cc -fpie -o reference_bin_pie.out reference-binary.c
[+] Building reference_bin_nopie.out
/opt/zig/zig cc -fno-pie -o reference_bin_nopie.out reference-binary.c
g++ -O0 -ggdb -Wno-pmf-conversions symbol_1600_and_752.cpp -o symbol_1600_and_752.out
[+] Building initialized_heap_x64.out
/opt/zig/zig cc \
-Wall -DDEBUG=1 -ggdb -O0 -gdwarf-4 \
-target x86_64-linux-gnu \
-o initialized_heap_x64.out initialized_heap.c
[+] Building initialized_heap_i386_big.out
/opt/zig/zig cc \
-Wall -DDEBUG=1 -ggdb -O0 -gdwarf-4 \
-target i386-linux-gnu \
-o initialized_heap_i386_big.out initialized_heap.c
rm syscalls-x64.o emulate_disasm_loop.o emulate_disasm.o memory.o

Running tests in parallel and using a joblog in /tmp/tmp.I1snMuaAno (use --keep it to persist it)
test_attachp_command_nonexistent_procname                              PASSED
test_attachp_command_attaches_to_procname_too_many_pids                PASSED
test_attachp_command_attaches_to_procname                              PASSED
test_attachp_command_attaches_to_pid                                   PASSED
test_cache_single_value                                                PASSED
test_config                                                            PASSED
test_cache_args_kwargs_properly                                        PASSED
test_attachp_command_no_pids                                           PASSED
test_config_filtering                                                  PASSED
test_config_filtering_missing                                          PASSED
test_command_cyclic_value                                              PASSED
test_command_cyclic_register                                           PASSED
test_command_cyclic_address                                            PASSED
test_command_cyclic_wrong_alphabet                                     PASSED
test_command_cyclic_wrong_length                                       PASSED
test_command_distance                                                  PASSED
test_command_ignore_no_breakpoint_set                                  PASSED
test_command_errno                                                     PASSED
test_command_ignore_no_breakpoint_set_remove                           PASSED
test_command_ignore_no_breakpoint_found                                PASSED
test_command_ignore_breakpoint_last_found_two                          PASSED
test_command_ignore_breakpoint_last_negative                           PASSED
test_command_ignore_breakpoint_last_found_one                          PASSED
test_command_killthreads_before_binary_start                           PASSED
test_command_killthreads_kills_specific_thread                         PASSED
test_command_procinfo_before_binary_start                              PASSED
test_command_procinfo                                                  PASSED
test_command_telescope                                                 PASSED
test_command_telescope_reverse                                         PASSED
test_command_telescope_n_records                                       PASSED
test_telescope_command_with_address_as_count                           PASSED
test_telescope_command_with_address_as_count_and_reversed_flag         PASSED
test_tls_address_and_command[x86-64]                                   PASSED
test_command_vmmap_on_coredump_on_crash_simple_binary[False]           PASSED
test_tls_address_and_command[i386]                                     PASSED
test_command_vmmap_on_coredump_on_crash_simple_binary[True]            PASSED
test_vmmap_issue_1565                                                  PASSED
test_command_xor_with_gdb_execute                                      PASSED
test_command_xor_with_int                                              PASSED
test_command_xor_with_hex                                              PASSED
test_command_memfrob                                                   PASSED
test_commands[*]                                                       SKIPPED
test_commands_plt_gotplt_got_when_no_sections                          PASSED
test_command_plt[reference_bin_pie.out-True]                           PASSED
test_command_plt[reference_bin_nopie.out-False]                        PASSED
test_command_got[reference_bin_pie.out-True]                           PASSED
test_command_got[reference_bin_nopie.out-False]                        PASSED
test_command_nextproginstr_binary_not_running                          PASSED
test_next_command_doesnt_freeze_crashed_binary[nextcall]               PASSED
test_next_command_doesnt_freeze_crashed_binary[nextjump]               PASSED
test_command_killthreads_kills_all_threads_except_current              
test_next_command_doesnt_freeze_crashed_binary[nextproginstr]          PASSED
test_command_killthreads_produces_error_when_unknown_thread_passed     
test_next_command_doesnt_freeze_crashed_binary[nextret]                PASSED
test_next_command_doesnt_freeze_crashed_binary[stepret]                PASSED
test_next_command_doesnt_freeze_crashed_binary[nextsyscall]            PASSED
test_empty_context_sections['']                                        PASSED
test_context_disasm_show_fd_filepath                                   PASSED
test_next_command_doesnt_freeze_crashed_binary[stepsyscall]            PASSED
test_empty_context_sections[""]                                        PASSED
test_empty_context_sections[none]                                      PASSED
test_empty_context_sections[-]                                         PASSED
test_empty_context_sections[]                                          PASSED
test_source_code_tabstop                                               PASSED
test_context_disasm_syscalls_args_display                              PASSED
test_context_disasm_works_properly_with_disasm_flavor_switch           PASSED
test_context_backtrace_show_proper_symbol_names                        PASSED
test_cymbol                                                            PASSED
test_emulate_disasm                                                    PASSED
test_emulate_disasm_loop                                               PASSED
test_gdb_parameter_default_value_works[params0]                        PASSED
test_gdb_parameter_default_value_works[params1]                        PASSED
test_gdb_parameter_default_value_works[params2]                        PASSED
test_gdb_parameter_default_value_works[params3]                        PASSED
test_gdb_parameter_default_value_works[params4]                        PASSED
test_gdb_parameter_default_value_works[params5]                        PASSED
test_gdb_parameter_default_value_works[params6]                        PASSED
test_gdb_parameter_default_value_works[params7]                        PASSED
test_gdb_parameter_default_value_works[params8]                        PASSED
test_gdb_parameter_default_value_works[params9]                        PASSED
test_parsing_info_sharedlibrary_to_find_libc_filename[have-(*)]        PASSED
test_typeinfo_go_x64                                                   PASSED
test_parsing_info_sharedlibrary_to_find_libc_filename[does-not-have-(*)] PASSED
test_typeinfo_go_x86                                                   PASSED
test_hexdump                                                           PASSED
test_hexdump_collapse_lines                                            PASSED
test_loads_pure_gdb_without_crashing                                   PASSED
test_loads_binary_without_crashing                                     PASSED
test_loads_binary_with_core_without_crashing                           PASSED
test_entry_no_file_loaded                                              PASSED
test_loads_core_without_crashing                                       PASSED
test_memory_read_write                                                 PASSED
test_list_and_filter_commands_filter                                   PASSED
test_list_and_filter_commands_full_list[True-True]                     PASSED
test_list_and_filter_commands_full_list[False-True]                    PASSED
test_list_and_filter_commands_full_list[True-False]                    PASSED
test_mprotect_executes_properly                                        PASSED
test_cannot_run_mprotect_when_not_running                              PASSED
test_nearpc_opcode_bytes[1]                                            PASSED
test_nearpc_opcode_bytes[2]                                            PASSED
test_nearpc_opcode_bytes[3]                                            PASSED
test_nearpc_opcode_bytes[4]                                            PASSED
test_nearpc_opcode_bytes[5]                                            PASSED
test_nearpc_opcode_seperator[0]                                        PASSED
test_nearpc_opcode_seperator[1]                                        PASSED
test_nearpc_opcode_seperator[2]                                        PASSED
test_nearpc_opcode_invalid_config                                      PASSED
test_symbol_duplicated_symbols_issue_1610                              PASSED
test_symbol_get                                                        PASSED
test_triggers                                                          PASSED
test_windbg_dX_commands                                                PASSED
test_windbg_eX_commands                                                PASSED
test_windbg_commands_x86                                               PASSED
test_find_fake_fast_command                                            PASSED
test_malloc_chunk_command                                              PASSED
test_malloc_chunk_command_heuristic                                    PASSED
test_main_arena_heuristic                                              PASSED
test_mp_heuristic                                                      PASSED
test_thread_cache_heuristic[single-threaded]                           PASSED
test_thread_arena_heuristic[single-threaded]                           PASSED
test_thread_cache_heuristic[multi-threaded]                            PASSED
test_thread_arena_heuristic[multi-threaded]                            PASSED
test_global_max_fast_heuristic                                         PASSED
test_heuristic_fail_gracefully[single-threaded]                        PASSED
test_heuristic_fail_gracefully[multi-threaded]                         PASSED
test_largebins_size_range_64bit                                        PASSED
test_heap_bins                                                         PASSED
test_largebins_size_range_32bit_big                                    PASSED
test_smallbins_sizes_64bit                                             PASSED
test_smallbins_sizes_32bit_big                                         PASSED
test_try_free_invalid_overflow                                         PASSED
test_try_free_invalid_misaligned                                       PASSED
test_try_free_invalid_size_minsize                                     PASSED
test_try_free_invalid_size_misaligned                                  PASSED
test_try_free_double_free_tcache                                       PASSED
test_try_free_invalid_next_size_fast                                   PASSED
test_try_free_double_free                                              PASSED
test_try_free_invalid_fastbin_entry                                    PASSED
test_try_free_double_free_or_corruption_top                            PASSED
test_try_free_double_free_or_corruption_out                            PASSED
test_try_free_double_free_or_corruption_prev                           PASSED
test_try_free_invalid_next_size_normal                                 PASSED
test_try_free_corrupted_consolidate_backward                           PASSED
test_try_free_corrupted_unsorted_chunks                                SKIPPED
test_vis_heap_chunk_command                                            PASSED
test_command_nextproginstr                                             PASSED
Tests completed in 490 seconds

*********************************
********* TESTS SUMMARY *********
*********************************
Tests passed or skipped: 146
Tests failed: 0