3

Let's suppose there is a memory region that is m'mapped in memory, we need to find its address (which randomly changes, because of ASLR) by following a pointer path, basically, I'm trying to find a possibly multilevel pointer that leads to any address in that memory region, and that starts from an address in a memory region I choose, is that possible to do with gdb? I've checked out the popular gdb extensions (peda, pwndbg), but didn't find such a feature, if there is no existing implementation, any tips on how to optimize the search? Kind of like the Pointer Scanner of Cheat Engine, pointers can also have offsets (for example : main_module+3170 -> 0x7fff42dc7220 ; 0x7fff42dc7220+10 -> 0x7ff464213460 ; 0x7ff464213460 -> address wanted).

This would be useful for example in a context where we have a write-what-where condition (we can write or read anywhere in memory), and we need to defeat ASLR to find interesting memory regions (for example, JIT buffers in browsers).

1 Answer 1

0

I know that this post is now more than 4 years old, but: We created a gdb extension that can do just that. It's available here: https://github.com/ChaChaNop-Slide/ptrfind

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.