peda
peda copied to clipboard
added the got command to show fastly the state of the GOT table
Added the command "got" used to retrieve fastly the state of the GOT table. It works for 32 and 64 binaries and also for PIE programs.
Example 64 bit - PIE OFF :
Example 64 bit - PIE ON:
Example 32 bit:
This looks awesome, I did some tests and looks cool... just noticed a small detail: under certain binaries i don't get any symbols printed for the GOT entries. for example with my version of nmap i don't get any symbols explaining the pointers:
gdb-peda$ got
[...]
0x768570: 0x0042c386 0x00000000
however when i run readelf:
> readelf -r /usr/bin/nmap|grep 768570
000000768570 00a600000007 R_X86_64_JUMP_SLO 0000000000000000 sleep@GLIBC_2.2.5 + 0
What do you think about not just relying on gdb and therefor purely relying on the x/wx command issued in line 4521: https://github.com/longld/peda/pull/79/commits/ea2d69558e0449f9be53752b4a8b725f5f4b6f01#diff-c1c917467ee788f52846b75c797b9eb0R4521 or 4516: https://github.com/longld/peda/pull/79/commits/ea2d69558e0449f9be53752b4a8b725f5f4b6f01#diff-c1c917467ee788f52846b75c797b9eb0R4516 but also propagate the readelf value contained in the f_line variable from line 4512: https://github.com/longld/peda/pull/79/commits/ea2d69558e0449f9be53752b4a8b725f5f4b6f01#diff-c1c917467ee788f52846b75c797b9eb0R4512. This way we could always output some useful information about the got/plt entry even when gdb does not provide anything for the x/wx command.
This would always be rock solid when we don't get useful additions by GDB and could look somewhat like:
gdb-peda$ got
[...]
0x768570: 0x0042c386 0x00000000 sleep@GLIBC_2.2.5
It would be cool if you can apply this patch in addition to yours to achieve the previous mentioned printing of the name: https://github.com/anthraxx/peda/commit/aa63d4fa076036e8e735079a6bc8bb89cbd6ae06
Additionally there is a warning_msg function from the utils file to print warnings, please also update the pull request by changing those two warnings like:
https://github.com/anthraxx/peda/commit/7fb48563826724c0a896db34b72bf14ecaea31e5
Ok, I've got time to improve a little bit the output of the commands following your advice @anthraxx.
The situation now is the following:
I've re-used the information inside the f_line for the name and filtered a little bit the output from x/wx for both 32 and 64 bits to extract the addresses.