riptracer

README

riptracer

Execution tracer written in go. Think strace/ltrace for arbitrary code locations. Set breakpoints, manipulate memory/registers, etc...

Why?

Do you know how implement a software breakpoint, or a how to set a hardware breakpoint? I had used both in gdb for years without understanding exactly how these are implemented. I wanted to change that, and so what better way than implementing a debugger yourself?

I've been a longtime fan of usercorn. I even have a repo of example script usercorn_examples. But there are some drawbacks to having to emulate everything. Not all the system calls are implemented, and if the binary does threading, we're probably in for a rough time. I wanted to debug a threaded binary without emulating, and have custom debug functionality.

Why not just use gdb?

With the power of gdb and some gdb scripts we'd be able to do similar functionality, but we'd need gdb on our target system, along with python for the scripting etc... All of which is fine, and totally possible, but a nicely compiled go binary can be deployed without having to worry about the dependencies needed. I want to spend time learning and debugging, not cross-compiling and in dependency hell.

Disclaimer

This is a toy project, I'll update it for as long as I find it useful and interesting. My aim here is not to rewrite strace/strace/dtrace/gdb/rr etc... You should totally use those for anything serious.

Documentation

Index

• Constants
• Variables
• func CBFunctionArgs(pid int, bp BreakPoint)
• func CBPrintRegisters(pid int, bp BreakPoint)
• func CBPrintStack(pid int, bp BreakPoint)
• func Dump(buff []byte)
• type BreakPoint
• type CallBackFunction
• type ELF32_Rela
• type ELF32_Rela_Info
• type ELF64_Rela
• type ELF64_Rela_Info
• type SymbolResolver
  • func NewSymbolResolver(filepath string) (*SymbolResolver, error)
  • func (s *SymbolResolver) GetPLTOffsetBySymName(symName string) (uintptr, error)
  • func (s *SymbolResolver) GetPLTSymNameByOffset(offset uint64) (string, error)
• type Tracer
  • func NewTracerFromPid(pid int) (*Tracer, error)
  • func NewTracerStartCommand(cmd_str string) (*Tracer, error)
  • func (t *Tracer) ConvertOffsetToAddress(breakAddress uintptr) uintptr
  • func (t *Tracer) EnableVerbose()
  • func (t *Tracer) GetBaseAddress() (uintptr, error)
  • func (t *Tracer) GetMemMaps() ([]*procfs.ProcMap, error)
  • func (t *Tracer) SetBreakpointAbsolute(breakAddress uintptr, cb CallBackFunction)
  • func (t *Tracer) SetBreakpointRelative(breakAddress uintptr, cb CallBackFunction)
  • func (t *Tracer) SetExeComparisonLength(length int)
  • func (t *Tracer) SetFollowForks(enable bool)
  • func (t *Tracer) SetHWBreakpointAbsolute(breakAddress uintptr, cb CallBackFunction)
  • func (t *Tracer) SetHWBreakpointRelative(breakAddress uintptr, cb CallBackFunction)
  • func (t *Tracer) Start()
  • func (t *Tracer) Stop()

Constants

const DEFAULTEXECMPLENGTH = 32

How many bytes we want to use to compare mem to executable

const DR_OFFSET = 0x350

https://en.wikipedia.org/wiki/X86_debug_register

const REG_SIZE = 0x8

Variables

var Blue = "\033[34m"

var Cyan = "\033[36m"

var Gray = "\033[37m"

var Green = "\033[32m"

var Purple = "\033[35m"

var Red = "\033[31m"

var Reset = "\033[0m"

var White = "\033[97m"

var Yellow = "\033[33m"

Functions

func CBFunctionArgs

func CBFunctionArgs(pid int, bp BreakPoint)

func CBPrintRegisters

func CBPrintRegisters(pid int, bp BreakPoint)

func CBPrintStack

func CBPrintStack(pid int, bp BreakPoint)

func Dump

func Dump(buff []byte)

Types

type BreakPoint

type BreakPoint struct {
	Address      uintptr
	OriginalCode *[]byte
	Hits         int
	Callbacks    []CallBackFunction
}

type CallBackFunction

type CallBackFunction func(int, BreakPoint) // CallBack Function Pointer

type ELF32_Rela

type ELF32_Rela struct {
	R_offset uint32
	R_info   ELF32_Rela_Info
	R_addend int32
}

type ELF32_Rela_Info

type ELF32_Rela_Info struct {
	Type uint32
	Sym  uint32
}

type ELF64_Rela

type ELF64_Rela struct {
	R_offset uint64
	R_info   ELF64_Rela_Info
	R_addend int64
}

type ELF64_Rela_Info

type ELF64_Rela_Info struct {
	Type uint32
	Sym  uint32
}

type SymbolResolver

type SymbolResolver struct {
	PLT []elf.Symbol
	// contains filtered or unexported fields
}

func NewSymbolResolver

func NewSymbolResolver(filepath string) (*SymbolResolver, error)

func (*SymbolResolver) GetPLTOffsetBySymName

func (s *SymbolResolver) GetPLTOffsetBySymName(symName string) (uintptr, error)

func (*SymbolResolver) GetPLTSymNameByOffset

func (s *SymbolResolver) GetPLTSymNameByOffset(offset uint64) (string, error)

type Tracer

type Tracer struct {
	Process *os.Process
	ProcFS  procfs.FS
	// contains filtered or unexported fields
}

func NewTracerFromPid

func NewTracerFromPid(pid int) (*Tracer, error)

func NewTracerStartCommand

func NewTracerStartCommand(cmd_str string) (*Tracer, error)

func (*Tracer) ConvertOffsetToAddress

func (t *Tracer) ConvertOffsetToAddress(breakAddress uintptr) uintptr

func (*Tracer) EnableVerbose

func (t *Tracer) EnableVerbose()

func (*Tracer) GetBaseAddress

func (t *Tracer) GetBaseAddress() (uintptr, error)

func (*Tracer) GetMemMaps

func (t *Tracer) GetMemMaps() ([]*procfs.ProcMap, error)

func (*Tracer) SetBreakpointAbsolute

func (t *Tracer) SetBreakpointAbsolute(breakAddress uintptr, cb CallBackFunction)

func (*Tracer) SetBreakpointRelative

func (t *Tracer) SetBreakpointRelative(breakAddress uintptr, cb CallBackFunction)

func (*Tracer) SetExeComparisonLength

func (t *Tracer) SetExeComparisonLength(length int)

func (*Tracer) SetFollowForks

func (t *Tracer) SetFollowForks(enable bool)

func (*Tracer) SetHWBreakpointAbsolute

func (t *Tracer) SetHWBreakpointAbsolute(breakAddress uintptr, cb CallBackFunction)

func (*Tracer) SetHWBreakpointRelative

func (t *Tracer) SetHWBreakpointRelative(breakAddress uintptr, cb CallBackFunction)

func (*Tracer) Start

func (t *Tracer) Start()

func (*Tracer) Stop

func (t *Tracer) Stop()