那些遇到过的问题

内存转储格式如gdb中的xxd

Fat*_*ror 44 python debugging gdb pretty-print

我正在尝试检查包含二进制格式化消息的缓冲区,但也包含字符串数据.举个例子,我正在使用这个C代码:

int main (void) {
    char buf[100] = "\x01\x02\x03\x04String Data\xAA\xBB\xCC";

    return 0;
}
Run Code Online (Sandbox Code Playgroud)

我想得到一个十六进制转储的内容buf,其格式类似于xxd(我不在乎它是否完全匹配,我真正想要的是与可打印字符并排的十六进制转储).

在GDB里面我可以使用类似的东西:

(gdb) x /100bx buf
0x7fffffffdf00: 0x01    0x02    0x03    0x04    0x53    0x74    0x72    0x69
0x7fffffffdf08: 0x6e    0x67    0x20    0x44    0x61    0x74    0x61    0xaa
0x7fffffffdf10: 0xbb    0xcc    0x00    0x00    0x00    0x00    0x00    0x00
0x7fffffffdf18: 0x00    0x00    0x00    0x00    0x00    0x00    0x00    0x00
0x7fffffffdf20: 0x00    0x00    0x00    0x00    0x00    0x00    0x00    0x00
0x7fffffffdf28: 0x00    0x00    0x00    0x00    0x00    0x00    0x00    0x00
0x7fffffffdf30: 0x00    0x00    0x00    0x00    0x00    0x00    0x00    0x00
0x7fffffffdf38: 0x00    0x00    0x00    0x00    0x00    0x00    0x00    0x00
0x7fffffffdf40: 0x00    0x00    0x00    0x00    0x00    0x00    0x00    0x00
0x7fffffffdf48: 0x00    0x00    0x00    0x00    0x00    0x00    0x00    0x00
0x7fffffffdf50: 0x00    0x00    0x00    0x00    0x00    0x00    0x00    0x00
0x7fffffffdf58: 0x00    0x00    0x00    0x00    0x00    0x00    0x00    0x00
Run Code Online (Sandbox Code Playgroud)

这很好,但是很难以那种方式挑出字符串...或者我可以使用

(gdb) x /100bs buf
0x7fffffffdf00:  "\001\002\003\004String Data\252\273\314"
0x7fffffffdf13:  ""
0x7fffffffdf14:  ""
0x7fffffffdf15:  ""
0x7fffffffdf16:  ""
0x7fffffffdf17:  ""
...
Run Code Online (Sandbox Code Playgroud)

这使得很难阅读二进制部分...我正在处理的实际消息中也有很多ascii nul,所以它真的看起来像一团糟.

我能想到的最好的就是这样做:

(gdb) dump binary memory dump.bin buf buf+100
Run Code Online (Sandbox Code Playgroud)

然后

$ xxd dump.bin
0000000: 0102 0304 5374 7269 6e67 2044 6174 61aa  ....String Data.
0000010: bbcc 0000 0000 0000 0000 0000 0000 0000  ................
0000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000040: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000050: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000060: 0000 0000                                ....
Run Code Online (Sandbox Code Playgroud)

但每次这样做都很痛苦.我认为之前有人想过这个,所以想知道是否有人在gdb中找到了办法.另外,你会以这种方式丢失原始内存中的地址.

我正在使用内置python支持的GDB 7.4,所以我愿意使用漂亮的打印机或类似的,但我不知道如何设置它.

Emp*_*ian 71 

(gdb) define xxd
>dump binary memory dump.bin $arg0 $arg0+$arg1
>shell xxd dump.bin
>end
(gdb) xxd &j 10 
0000000: 0000 0000 0000 0000 0000 0000 4d8c a7f7  ............M...
0000010: ff7f 0000 0000 0000 0000 0000 c8d7 ffff  ................
0000020: ff7f 0000 0000 0000
Run Code Online (Sandbox Code Playgroud)

似乎很容易;-)

你可能会写一个Python脚本(现代GDB版本有嵌入式Python解释器)来做同样的事情,并且摆脱了"shell out"的需要.

  • 请注意，如果“$arg0”是指向结构的指针，则“$arg1”将被视为对象计数，而不是字节数。如果这会成为问题，请使用“((void *)$arg0)+$arg1”而不是“$arg0+$arg1”。 (3认同)
  • 另请注意,较新版本的`xxd`支持`-o`标志,该标志会为显示的地址值添加偏移量. (2认同)

Fat*_*ror 25

所以,我最终玩了python界面并想出了这个:

import gdb
from curses.ascii import isgraph

def groups_of(iterable, size, first=0):
    first = first if first != 0 else size
    chunk, iterable = iterable[:first], iterable[first:]
    while chunk:
        yield chunk
        chunk, iterable = iterable[:size], iterable[size:]

class HexDump(gdb.Command):
    def __init__(self):
        super (HexDump, self).__init__ ('hex-dump', gdb.COMMAND_DATA)

    def invoke(self, arg, from_tty):
        argv = gdb.string_to_argv(arg)
        if len(argv) != 2:
            raise gdb.GdbError('hex-dump takes exactly 2 arguments.')
        addr = gdb.parse_and_eval(argv[0]).cast(
            gdb.lookup_type('void').pointer())
        try:
            bytes = int(gdb.parse_and_eval(argv[1]))
        except ValueError:
            raise gdb.GdbError('Byte count numst be an integer value.')

        inferior = gdb.selected_inferior()

        align = gdb.parameter('hex-dump-align')
        width = gdb.parameter('hex-dump-width')
        if width == 0:
            width = 16

        mem = inferior.read_memory(addr, bytes)
        pr_addr = int(str(addr), 16)
        pr_offset = width

        if align:
            pr_offset = width - (pr_addr % width)
            pr_addr -= pr_addr % width

        for group in groups_of(mem, width, pr_offset):
            print '0x%x: ' % (pr_addr,) + '   '*(width - pr_offset),
            print ' '.join(['%02X' % (ord(g),) for g in group]) + \
                '   ' * (width - len(group) if pr_offset == width else 0) + ' ',
            print ' '*(width - pr_offset) +  ''.join(
                [g if isgraph(g) or g == ' ' else '.' for g in group])
            pr_addr += width
            pr_offset = width

class HexDumpAlign(gdb.Parameter):
    def __init__(self):
        super (HexDumpAlign, self).__init__('hex-dump-align',
                                            gdb.COMMAND_DATA,
                                            gdb.PARAM_BOOLEAN)

    set_doc = 'Determines if hex-dump always starts at an "aligned" address (see hex-dump-width'
    show_doc = 'Hex dump alignment is currently'

class HexDumpWidth(gdb.Parameter):
    def __init__(self):
        super (HexDumpWidth, self).__init__('hex-dump-width',
                                            gdb.COMMAND_DATA,
                                            gdb.PARAM_INTEGER)

    set_doc = 'Set the number of bytes per line of hex-dump'

    show_doc = 'The number of bytes per line in hex-dump is'

HexDump()
HexDumpAlign()
HexDumpWidth()
Run Code Online (Sandbox Code Playgroud)

我意识到它可能不是最美丽和最优雅的解决方案,但它完成了工作,并作为初稿.它可以包含在~/.gdbinit:

python
sys.path.insert(0, '/path/to/module/dir')
import hexdump
end
Run Code Online (Sandbox Code Playgroud)

然后可以像上面的程序一样使用:

(gdb) hex-dump buf 100
0x7fffffffdf00:  01 02 03 04 53 74 72 69 6E 67 20 44 61 74 61 AA  ....String Data.
0x7fffffffdf10:  BB CC 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0x7fffffffdf20:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0x7fffffffdf30:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0x7fffffffdf40:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0x7fffffffdf50:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0x7fffffffdf60:  00 00 00 00                                      ....
Run Code Online (Sandbox Code Playgroud)

以及其他一些措施:

(gdb) set hex-dump-align on
Determines if hex-dump always starts at an "aligned" address (see hex-dump-width
(gdb) hex-dump &buf[5] 95
0x7fffffffdf00:                 74 72 69 6E 67 20 44 61 74 61 AA       tring Data.
0x7fffffffdf10:  BB CC 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0x7fffffffdf20:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0x7fffffffdf30:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0x7fffffffdf40:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0x7fffffffdf50:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0x7fffffffdf60:  00 00 00 00                                      ....

(gdb) set hex-dump-width 8
Set the number of bytes per line of hex-dump
(gdb) hex-dump &buf[5] 95
0x7fffffffdf00:                 74 72 69       tri
0x7fffffffdf08:  6E 67 20 44 61 74 61 AA  ng Data.
0x7fffffffdf10:  BB CC 00 00 00 00 00 00  ........
0x7fffffffdf18:  00 00 00 00 00 00 00 00  ........
0x7fffffffdf20:  00 00 00 00 00 00 00 00  ........
0x7fffffffdf28:  00 00 00 00 00 00 00 00  ........
0x7fffffffdf30:  00 00 00 00 00 00 00 00  ........
0x7fffffffdf38:  00 00 00 00 00 00 00 00  ........
0x7fffffffdf40:  00 00 00 00 00 00 00 00  ........
0x7fffffffdf48:  00 00 00 00 00 00 00 00  ........
0x7fffffffdf50:  00 00 00 00 00 00 00 00  ........
0x7fffffffdf58:  00 00 00 00 00 00 00 00  ........
0x7fffffffdf60:  00 00 00 00              ....
Run Code Online (Sandbox Code Playgroud)

没有承诺没有错误:).如果人们有兴趣,我可能会在github或其他东西中坚持下去.

我只用GDB 7.4测试过它.

  • +1，因为此解决方案保留了原始地址，非常方便！ (3认同)
  • 这太棒了。但是，我不得不更新这一行： pr_addr = int(str(addr), 16) 到 pr_addr = int(str(addr).split()[0], 16) (3认同)
  • 对于 python 3，您需要将所有 3 个打印调用加入到一个 print(...) 中，并使用 `g.decode('utf-8') if isgraph(ord(g)) or g == b' '` (2认同)

Ek1*_*noX 8

我自己的贡献来自“雇佣俄罗斯解决方案”和罗杰·利普斯科姆评论：

  • 使用xxd，
  • 保留地址 (xxd -o)
  • 大小参数是可选的
  • 包括小文档

脚本（使用 gdb 7.8.1 测试）：

define xxd
  if $argc < 2
    set $size = sizeof(*$arg0)
  else
    set $size = $arg1
  end
  dump binary memory dump.bin $arg0 ((void *)$arg0)+$size
  eval "shell xxd -o %d dump.bin; rm dump.bin", ((void *)$arg0)
end
document xxd
  Dump memory with xxd command (keep the address as offset)

  xxd addr [size]
    addr -- expression resolvable as an address
    size -- size (in byte) of memory to dump
            sizeof(*addr) is used by default
end
Run Code Online (Sandbox Code Playgroud)

例子：

(gdb) p &m_data
$1 = (data_t *) 0x200130dc <m_data>

(gdb) p sizeof(m_data)
$2 = 32

(gdb) xxd &m_data 32
200130dc: 0300 0000 e87c 0400 0000 0000 0100 0000  .....|..........
200130ec: 0c01 0000 b831 0020 0100 0000 0100 0000  .....1. ........

(gdb) xxd &m_data
200130dc: 0300 0000 e87c 0400 0000 0000 0100 0000  .....|..........
200130ec: 0c01 0000 b831 0020 0100 0000 0100 0000  .....1. ........

(gdb) help xxd
  Dump memory with xxd command (keep the address as offset)

  xxd addr [size]
    addr -- expression resolvable as an address
    size -- size (in byte) of memory to dump
            sizeof(*addr) is used by default
Run Code Online (Sandbox Code Playgroud)

gun*_*hor 5

User FatalError 解决方案的改编版本

  • 与 python 3 一起使用
  • 添加了十六进制标题
  • 长度参数可选
  • 重命名为高清

例子

高清0xbfffe4f1

高清 0xbfffe4f1 500

import gdb
from curses.ascii import isgraph

def groups_of(iterable, size, first=0):
    first = first if first != 0 else size
    chunk, iterable = iterable[:first], iterable[first:]
    while chunk:
        yield chunk
        chunk, iterable = iterable[:size], iterable[size:]

class HexDump(gdb.Command):
    def __init__(self):
        super (HexDump, self).__init__ ('hd', gdb.COMMAND_DATA)

    def invoke(self, arg, from_tty):
        argv = gdb.string_to_argv(arg)

        addr = gdb.parse_and_eval(argv[0]).cast(
            gdb.lookup_type('void').pointer())
        if len(argv) == 2:
             try:
                 bytes = int(gdb.parse_and_eval(argv[1]))
             except ValueError:
                 raise gdb.GdbError('Byte count numst be an integer value.')
        else:
             bytes = 500

        inferior = gdb.selected_inferior()

        align = gdb.parameter('hex-dump-align')
        width = gdb.parameter('hex-dump-width')
        if width == 0:
            width = 16

        mem = inferior.read_memory(addr, bytes)
        pr_addr = int(str(addr), 16)
        pr_offset = width

        if align:
            pr_offset = width - (pr_addr % width)
            pr_addr -= pr_addr % width
        start=(pr_addr) & 0xff;


        print ('            ' , end="")
        print ('  '.join(['%01X' % (i&0x0f,) for i in range(start,start+width)]) , end="")
        print ('  ' , end="")       
        print (' '.join(['%01X' % (i&0x0f,) for i in range(start,start+width)]) )

        for group in groups_of(mem, width, pr_offset):
            print ('0x%x: ' % (pr_addr,) + '   '*(width - pr_offset), end="")
            print (' '.join(['%02X' % (ord(g),) for g in group]) + \
                '   ' * (width - len(group) if pr_offset == width else 0) + ' ', end="")    
            print (' '*(width - pr_offset) +  ' '.join(
                [chr( int.from_bytes(g, byteorder='big')) if isgraph( int.from_bytes(g, byteorder='big')   ) or g == ' ' else '.' for g in group]))
            pr_addr += width
            pr_offset = width

class HexDumpAlign(gdb.Parameter):
    def __init__(self):
        super (HexDumpAlign, self).__init__('hex-dump-align',
                                            gdb.COMMAND_DATA,
                                            gdb.PARAM_BOOLEAN)

    set_doc = 'Determines if hex-dump always starts at an "aligned" address (see hex-dump-width'
    show_doc = 'Hex dump alignment is currently'

class HexDumpWidth(gdb.Parameter):
    def __init__(self):
        super (HexDumpWidth, self).__init__('hex-dump-width',
                                            gdb.COMMAND_DATA,
                                            gdb.PARAM_INTEGER)

    set_doc = 'Set the number of bytes per line of hex-dump'

    show_doc = 'The number of bytes per line in hex-dump is'

HexDump()
HexDumpAlign()
HexDumpWidth()
Run Code Online (Sandbox Code Playgroud)

归档时间：

查看次数：

30899 次

最近记录：

6 年，9 月 前
相关归档
如何查看我正在使用的NumPy版本？ 257
如何在Python中查找线程ID 159
如何从gmtime()的时间+日期输出中获取自纪元以来的秒数？ 150
在多个进程之间共享结果队列 77
如何使用多列中的值对pandas数据框进行排序？ 63
如何创建旋转命令行光标？ 61
Jupyter Notebook：由于Websocket连接失败，因此无法连接到服务器 46
MySQL查询随机挂起"发送数据"状态？ 8
如何调试使用regsvr32.exe进行的64位dll注册过程？ 4
iOS如何以编程方式读取设备的屏幕自动锁定超时时间？ 2
难疑归档
如何在Python中安全地创建嵌套目录？ 3909
在Python中查找包含它的列表的项目的索引 2887
如何以MS Word保留格式和语法高亮显示代码片段？ 1877
在JavaScript中生成特定范围内的随机整数？ 1836
将存储过程的结果插入临时表 1526
如何在所有浏览器中控制网页缓存？ 1474
JavaScript中是否有常量？ 1118
什么是在Vim中评论/取消注释行的快速方法？ 1081
如何在同一分支上的两个不同提交之间区分相同的文件？ 1077
Access-Control-Allow-Origin标头如何工作？ 1050