#!/usr/bin/python3
# This is a GDB plugin.
# Usage:
# gdb --batch -ex 'python exec(open("THIS_FILE").read())' -ex run -ex abrt-exploitable PROG
# or
# gdb --batch -ex 'python exec(open("THIS_FILE").read())' -ex 'core COREDUMP' -ex abrt-exploitable
import sys
import os
import signal
import re
import gettext
import locale
import gdb
GETTEXT_PROGNAME = "abrt"
_ = gettext.gettext
def init_gettext():
try:
locale.setlocale(locale.LC_ALL, "")
except locale.Error:
os.environ['LC_ALL'] = 'C'
locale.setlocale(locale.LC_ALL, "")
# Defeat "AttributeError: 'module' object has no attribute 'nl_langinfo'"
try:
gettext.bind_textdomain_codeset(GETTEXT_PROGNAME, locale.nl_langinfo(locale.CODESET))
except AttributeError:
pass
gettext.bindtextdomain(GETTEXT_PROGNAME, '/usr/share/locale')
gettext.textdomain(GETTEXT_PROGNAME)
_WRITES_ALWAYS = -1
_WRITES_IF_MEMREF = -2
_x86_writing_instr = {
# insn:N, where N:
# -1: this insn always writes to memory
# -2: writes to memory if any operand is a memory operand
# 2: writes to memory if 2nd (or later) operand is a memory operand
#
# Two-operand insns
"add": 2,
"adc": 2,
"sub": 2,
"sbb": 2,
"and": 2,
"xor": 2,
"or": 2,
"xadd": 2,
"cmpxchg": 2,
# One-operand insns. Can use 1 or _WRITES_IF_MEMREF
"inc": _WRITES_IF_MEMREF,
"dec": _WRITES_IF_MEMREF,
"neg": _WRITES_IF_MEMREF,
"not": _WRITES_IF_MEMREF,
"pop": _WRITES_IF_MEMREF,
# "Set byte on condition". One-operand insns.
"seta": _WRITES_IF_MEMREF,
"setae": _WRITES_IF_MEMREF,
"setb": _WRITES_IF_MEMREF,
"setbe": _WRITES_IF_MEMREF,
"setc": _WRITES_IF_MEMREF,
"sete": _WRITES_IF_MEMREF,
"setg": _WRITES_IF_MEMREF,
"setge": _WRITES_IF_MEMREF,
"setl": _WRITES_IF_MEMREF,
"setle": _WRITES_IF_MEMREF,
"setna": _WRITES_IF_MEMREF,
"setnae": _WRITES_IF_MEMREF,
"setnb": _WRITES_IF_MEMREF,
"setnbe": _WRITES_IF_MEMREF,
"setnc": _WRITES_IF_MEMREF,
"setne": _WRITES_IF_MEMREF,
"setng": _WRITES_IF_MEMREF,
"setnge": _WRITES_IF_MEMREF,
"setnl": _WRITES_IF_MEMREF,
"setnle": _WRITES_IF_MEMREF,
"setno": _WRITES_IF_MEMREF,
"setnp": _WRITES_IF_MEMREF,
"setns": _WRITES_IF_MEMREF,
"setnz": _WRITES_IF_MEMREF,
"seto": _WRITES_IF_MEMREF,
"setp": _WRITES_IF_MEMREF,
"setpe": _WRITES_IF_MEMREF,
"setpo": _WRITES_IF_MEMREF,
"sets": _WRITES_IF_MEMREF,
"setz": _WRITES_IF_MEMREF,
# Shifts.
# sarl $2,(%rcx)
# sarl (%rax) - *implicit* operand (shift count) 1.
# shld 11,%ecx,(%rdi) - *third* operand is r/m.
# Luckily, any memory operand is a destination, can use _WRITES_IF_MEMREF.
"shl": _WRITES_IF_MEMREF,
"shr": _WRITES_IF_MEMREF,
"sal": _WRITES_IF_MEMREF,
"sar": _WRITES_IF_MEMREF,
"rol": _WRITES_IF_MEMREF,
"ror": _WRITES_IF_MEMREF,
"rcl": _WRITES_IF_MEMREF,
"rcr": _WRITES_IF_MEMREF,
"shld": _WRITES_IF_MEMREF,
"shrd": _WRITES_IF_MEMREF,
# Bit tests. Any memory operand is a destination, can use _WRITES_IF_MEMREF.
"bts": _WRITES_IF_MEMREF,
"btr": _WRITES_IF_MEMREF,
"btc": _WRITES_IF_MEMREF,
# One-operand (register pair is another, implicit operand).
"cmpxchg8b": _WRITES_IF_MEMREF,
"cmpxchg16b": _WRITES_IF_MEMREF,
# Either mem operand indicates write to mem.
"xchg": _WRITES_IF_MEMREF,
# String store insns.
# Look similar to widening signed move "movs[bwl][wlq]",
# but aliasing doesn't happen since widening move has two siffixes
"movs": _WRITES_ALWAYS,
"stos": _WRITES_ALWAYS,
# Widening moves never store to mem.
# May look like we need to list them because otherwise they get caught
# by "movXXX", but thankfully their 2nd operand is never a memory reference,
# which "movXXX" wildcard checks.
#"mov[sz][bwl][wlq]":0,
# One-operand insn.
# These are system insns, but they do NOT cause exception in userspace.
"smsw": _WRITES_IF_MEMREF,
"sgdt": _WRITES_IF_MEMREF,
"sidt": _WRITES_IF_MEMREF,
"sldt": _WRITES_IF_MEMREF,
"str": _WRITES_IF_MEMREF,
# FPU/SIMD madness follows.
# FPU store insns. One-operand.
"fsts": _WRITES_IF_MEMREF,
"fstl": _WRITES_IF_MEMREF,
#"fstt" doesn't exist
"fstps": _WRITES_IF_MEMREF,
"fstpl": _WRITES_IF_MEMREF,
"fstpt": _WRITES_IF_MEMREF,
# Saving state. One-operand insns.
"fstcw": _WRITES_IF_MEMREF,
"fnstcw": _WRITES_IF_MEMREF,
"fstsw": _WRITES_IF_MEMREF,
"fnstsw": _WRITES_IF_MEMREF,
"fstenv": _WRITES_IF_MEMREF,
"fnstenv": _WRITES_IF_MEMREF,
"fsave": _WRITES_IF_MEMREF,
"fnsave": _WRITES_IF_MEMREF,
"fxsave": _WRITES_IF_MEMREF,
"xsave": _WRITES_IF_MEMREF,
"xsaveopt": _WRITES_IF_MEMREF,
"fsave64": _WRITES_IF_MEMREF,
"fnsave64": _WRITES_IF_MEMREF,
"fxsave64": _WRITES_IF_MEMREF,
"xsave64": _WRITES_IF_MEMREF,
"xsaveopt64": _WRITES_IF_MEMREF,
"stmxcsr": _WRITES_IF_MEMREF,
"vstmxcsr": _WRITES_IF_MEMREF,
# SIMD store insns.
# Three-operand insns. Any memory operand is a destination.
"vcvtps2ph": _WRITES_IF_MEMREF,
"extractps": _WRITES_IF_MEMREF,
"vextractps": _WRITES_IF_MEMREF,
#[v]extractpd does not exist
"vextractf128": _WRITES_IF_MEMREF,
"vextracti128": _WRITES_IF_MEMREF,
"pextr": _WRITES_IF_MEMREF, # covers pextr[bwq]
"pextrd": _WRITES_IF_MEMREF,
"vpextr": _WRITES_IF_MEMREF,
"vpextrd": _WRITES_IF_MEMREF,
"vmaskmovpd": _WRITES_IF_MEMREF,
"vmaskmovps": _WRITES_IF_MEMREF,
"vpmaskmovd": _WRITES_IF_MEMREF,
"vpmaskmovq": _WRITES_IF_MEMREF,
# These insns have implicit (%edi) dest operand:
"maskmovq": _WRITES_ALWAYS, # mmx version
"maskmovdqu": _WRITES_ALWAYS,
"vmaskmovdqu": _WRITES_ALWAYS,
# check binutils/gas/testsuite/gas/i386/* for more weird insns
# Instruction Set Reference, A-M and N-Z:
# http://download.intel.com/products/processor/manual/253666.pdf
# http://download.intel.com/products/processor/manual/253667.pdf
# SSE4:
# http://software.intel.com/sites/default/files/m/0/3/c/d/4/18187-d9156103.pdf
# Instruction Set Extensions:
# http://download-software.intel.com/sites/default/files/319433-014.pdf
# Xeon Phi:
# http://download-software.intel.com/sites/default/files/forum/278102/327364001en.pdf
#"[v]movXXX" - special-cased in the code
"mov": 2
# Note: stack-writing instructions are omitted
}
_x86_pushing_instr = (
"push",
"pusha",
"pushf",
"enter",
"call",
"lcall"
)
_x86_intdiv_instr = ("div", "idiv")
_x86_jumping_instr = (
"jmp", # indirect jumps/calls with garbage data
"call", # call: also possible that stack is exhausted (infinite recursion)
"ljmp",
"lcall",
# Yes, lret/iret isn't used in normal userspace code,
# but it does work (compile with "gcc -nostartfiles -nostdlib -m32"):
#
#_start: .globl _start
# pushf
# push %cs
# push $next
# iret # lret or ret would work too
#next:
# movl $42, %ebx
# movl $1, %eax
# int $0x80 # exit(42)
#
"iret",
"lret",
"ret"
)
# stack was smashed if we crash on one of these
_x86_return_instr = ("iret", "lret", "ret")
_x86_mem_op1_regex = re.compile("^((-?0x)|[(])")
_x86_mem_op2_regex = re.compile("[,:]((-?0x)|[(])")
def _x86_fetch_insn_from_table(ins, table):
if not ins:
return None
if ins in table:
if type(table) == dict:
return table[ins]
return ins
# Drop common byte/word/long/quad suffix and try again
if ins[-1] in ("b", "w", "l", "q"):
ins = ins[:-1]
if ins in table:
if type(table) == dict:
return table[ins]
return ins
return None
class SignalAndInsn:
def x86_instruction_is_store(self):
operand = _x86_fetch_insn_from_table(self.mnemonic, _x86_writing_instr)
if not operand:
if not self.mnemonic:
return False
# There are far too many SSE store instructions,
# don't want to pollute the table with them.
# Special-case the check for MOVxxx
# and its SIMD cousins VMOVxxx:
if self.mnemonic[:3] != "mov" and self.mnemonic[:4] != "vmov":
return False
operand = 2
if operand == _WRITES_ALWAYS: # no need to check operands, it's a write
return True
# Memory operands look like this: [%seg:][[-]0xHEXNUM][(%reg[,...])]
# Careful with immediate operands which are $0xHEXNUM
# and FPU register references which are st(N).
if _x86_mem_op1_regex.search(self.operands):
mem_op_pos = 0
else:
match = _x86_mem_op2_regex.search(self.operands)
if not match:
return False # no memory operands
mem_op_pos = match.start() + 1
if operand == _WRITES_IF_MEMREF: # any mem operand indicates write
return True
comma = self.operands.find(",")
if mem_op_pos < comma:
# "%cs:0x0(%rax,%rax,1),foo" - 1st operand is memory
# "%cs:0x0(%rax),foo" - 1st operand is memory
memory_operand = 1
elif comma < 0:
# "%cs:0x0(%rax)" - 1st operand is memory
memory_operand = 1
else:
# mem_op_pos is after comma
# "foo,%cs:0x0(%rax,%rax,1)" - 2nd operand is memory
# (It also can be a third, fourth etc operand)
memory_operand = 2
if operand == memory_operand:
return True
return False
def x86_get_instruction(self):
try:
# just "disassemble $pc" won't work if $pc doesn't point
# inside a known function
raw_instructions = gdb.execute("disassemble $pc,$pc+32", to_string=True)
except gdb.error:
# For example, if tracee already exited normally.
# Another observed case is if $pc points to unmapped area.
# We get "Python Exception <class 'gdb.error'> No registers"
return
instructions = []
current = None
for line in raw_instructions.split("\n"):
# line can be:
# "Dump of assembler code from 0xAAAA to 0xBBBB:"
# "[=>] 0x00000000004004dc[ <+0>]: push %rbp"
# (" <+0>" part is present when we run on a live process,
# on coredump it is absent)
# "End of assembler dump."
# "" (empty line)
if line.startswith("=>"):
line = line[2:]
current = len(instructions)
line = line.split(":", 1)
if len(line) < 2: # no ":"?
continue
line = line[1] # drop "foo:"
line = line.strip() # drop leading/trailing whitespace
if line:
instructions.append(line)
if current == None:
# we determined that $pc points to a bad address,
# which is an interesting fact.
return
# There can be a disasm comment: "insn op,op,op # comment";
# strip it, and whitespace on both ends:
t = instructions[current].split("#", 1)[0].strip()
self.current_instruction = t
# Strip prefixes:
while True:
t = t.split(None, 1)
self.mnemonic = t[0]
if len(t) < 2:
break
if self.mnemonic.startswith("rex."):
t = t[1]
continue
if self.mnemonic in (
"data32", "data16", "addr32", "addr16", "rex",
"cs", "ds", "es", "ss", "fs", "gs",
"lock", "rep", "repz", "repnz", "xacquire", "xrelease"
):
t = t[1]
continue
# First word isn't a prefix -> we found the insn word
self.operands = t[1]
break
self.instruction_is_pushing = (_x86_fetch_insn_from_table(self.mnemonic, _x86_pushing_instr) is not None)
self.instruction_is_division = (_x86_fetch_insn_from_table(self.mnemonic, _x86_intdiv_instr) is not None)
self.instruction_is_branch = (_x86_fetch_insn_from_table(self.mnemonic, _x86_jumping_instr) is not None)
self.instruction_is_return = (_x86_fetch_insn_from_table(self.mnemonic, _x86_return_instr) is not None)
self.instruction_is_store = self.x86_instruction_is_store()
def ppc_get_instruction(self):
try:
# just "disassemble $pc" won't work if $pc doesn't point
# inside a known function
raw_instructions = gdb.execute("disassemble $pc,$pc+32", to_string=True)
except gdb.error:
# For example, if tracee already exited normally.
# Another observed case is if $pc points to unmapped area.
# We get "Python Exception <class 'gdb.error'> No registers"
return
instructions = []
current = None
for line in raw_instructions.split("\n"):
# line can be:
# "Dump of assembler code from 0xAAAA to 0xBBBB:"
# "[=>] 0x00000000004004dc[ <+0>]: push %rbp"
# (" <+0>" part is present when we run on a live process,
# on coredump it is absent)
# "End of assembler dump."
# "" (empty line)
if line.startswith("=>"):
line = line[2:]
current = len(instructions)
line = line.split(":", 1)
if len(line) < 2: # no ":"?
continue
line = line[1] # drop "foo:"
line = line.strip() # drop leading/trailing whitespace
if line:
instructions.append(line)
if current is None:
# we determined that $pc points to a bad address,
# which is an interesting fact.
return
# There can be a disasm comment: "insn op,op,op # comment";
# strip it, and whitespace on both ends:
t = instructions[current].split("#", 1)[0].strip()
self.current_instruction = t
# Split it into mnemonic and operands
t = t.split(None, 1)
self.mnemonic = t[0]
if len(t) > 1:
self.operands = t[1]
self.instruction_is_store = self.mnemonic.startswith("st")
self.instruction_is_branch = self.mnemonic.startswith("b")
self.instruction_is_pushing = (self.instruction_is_store and "(r1)" in self.operands)
# Looks like div[o] insns on ppc don't cause exceptions
# (need to check whether, and how, FPE is generated)
#self.instruction_is_division =
# On ppc, return insn is b[cond]lr. TODO: is cond form ever used by gcc?
self.instruction_is_return = (self.mnemonic == "blr")
def get_instruction(self):
self.current_instruction = None
self.mnemonic = None
self.operands = ""
self.instruction_is_division = None
self.instruction_is_store = None
self.instruction_is_pushing = None
self.instruction_is_return = None
self.instruction_is_branch = None
try:
arch = gdb.execute("show architecture", to_string=True)
# Examples of the string we get:
# The target architecture is set automatically (currently i386)
# The target architecture is set automatically (currently i386:x86-64)
# The target architecture is set automatically (currently powerpc:common64)
if " i386" in arch:
return self.x86_get_instruction()
if " powerpc" in arch:
return self.ppc_get_instruction()
except gdb.error:
return
def get_signal(self):
self.signo = None
self.si_code = None
try:
# Requires new kernels which record complete siginfo
# in coredumps (Linux 3.9 still don't have it),
# and new gdb:
sig = gdb.parse_and_eval("$_siginfo.si_signo")
code = gdb.parse_and_eval("$_siginfo.si_code")
# Requires patched gdb:
#sig = gdb.parse_and_eval("$_signo")
#
# type(sig) = <type 'gdb.Value'>, convert to plain int:
self.signo = int(sig)
self.si_code = int(code)
except gdb.error:
# "Python Exception <class 'gdb.error'>
# Attempt to extract a component of a value that is not a structure"
# Possible reasons why $_siginfo doesn't exist:
# program is still running, program exited normally,
# we work with a coredump from an old kernel.
#
# Lets see whether we are running from the abrt and it
# provided us with signal number. Horrible hack :(
#
try:
self.signo = int(os.environ["SIGNO_OF_THE_COREDUMP"])
except KeyError:
return False
return True
#Our initial set of testing will use the list Apple included in their
#CrashWrangler announcement:
#
#Exploitable if:
# Crash on write instruction
# Crash executing invalid address
# Crash calling an invalid address
# Crash accessing an uninitialized or freed pointer as indicated by
# using the MallocScribble environment variable
# Illegal instruction exception
# Abort due to -fstack-protector, _FORTIFY_SOURCE, heap corruption
# detected
# Stack trace of crashing thread contains certain functions such as
# malloc, free, szone_error, objc_MsgSend, etc.
def is_exploitable(self):
self.exploitable_rating = 3
self.exploitable_desc = ""
# siginfo.si_code:
# If <= 0, then it's not a crash:
# SI_ASYNCNL = -60 /* asynch name lookup completion */
# SI_TKILL = -6 /* tkill (and tgkill?) */
# SI_SIGIO = -5 /* queued SIGIO */
# SI_ASYNCIO = -4 /* AIO completion */
# SI_MESGQ = -3 /* real time mesq state change */
# SI_TIMER = -2 /* timer expiration (timer_create() with SIGEV_SIGNAL) */
# SI_QUEUE = -1 /* sigqueue */
# SI_USER = 0 /* kill, sigsend */
# Crashes have si_code > 0:
# testDivideByZero: SIGFPE si_code=FPE_INTDIV(1), si_addr=0x40054a
# x86-64 opcode 0x62: SIGILL si_code=ILL_ILLOPN(2), si_addr=0x40053f
# x86-64 priv.insn.: SIGSEGV si_code=SI_KERNEL(128), si_addr=0
# testExecuteInvalid: SIGSEGV si_code=SEGV_MAPERR(1), si_addr=0x1c2404000
# testStackBufferOverflow ("ret" to bad address):
# SIGSEGV si_code=SI_KERNEL(128), si_addr=0
# testStackRecursion: SIGSEGV si_code=SEGV_MAPERR(1), si_addr=0x7fff4c216d28
# testWriteRandom: SIGSEGV si_code=SEGV_MAPERR(1), si_addr=0x1eb004004
# However:
# Keyboard signals (^C INT, ^\ QUIT, ^Z TSTP) also have si_code=SI_KERNEL.
# SIGWINCH has si_code=SI_KERNEL.
# SIGALRM from alarm(N) has si_code=SI_KERNEL.
# Surprisingly, SIGPIPE has si_code=SI_USER!
if self.si_code is not None:
# Filter out user-generated signals:
if self.si_code == -6 or self.si_code == -1: # SI_TKILL/SI_QUEUE
self.exploitable_rating = 0
self.exploitable_desc = _("Signal sent by userspace code")
return
if self.si_code < 0:
self.exploitable_rating = 0
self.exploitable_desc = _("Signal sent by timer/IO/async event")
return
# Unfortunately, this isn't reliable to flag user-sent signals:
# not only SIGPIPE, but some other kernel signals have SI_USER
# (grep kernel sources for "send_sig(sig, ..., 0)").
# At least we know it's not a crash.
if self.si_code == 0: # SI_USER
self.exploitable_rating = 0
self.exploitable_desc = _("Signal has siginfo.si_code = SI_USER")
# Special case (a kernel buglet?)
if self.signo == signal.SIGPIPE:
self.exploitable_desc = _("Signal due to write to closed pipe")
return
# And kernel-generated ones:
if self.si_code == 0x80: # SI_KERNEL
if self.signo in (signal.SIGINT, signal.SIGQUIT, signal.SIGTSTP):
self.exploitable_rating = 0
self.exploitable_desc = _("Signal sent by keyboard")
return
if self.signo in (signal.SIGTTIN, signal.SIGTTOU, signal.SIGHUP):
self.exploitable_rating = 0
self.exploitable_desc = _("Job control signal sent by kernel")
return
if self.signo == signal.SIGWINCH:
self.exploitable_rating = 0
self.exploitable_desc = _("Signal sent by window resize")
return
if self.signo == signal.SIGALRM:
self.exploitable_rating = 0
self.exploitable_desc = _("Signal sent by alarm(N) expiration")
return
# else: Can't rule out "crash" signal: may be FPE/ILL/BUS/SEGV.
# Fall through into signo/insn analysis.
# else: We are here if signal was not from user and not SI_KERNEL.
# Fall through into signo/insn analysis.
# else: We are here if si_code isn't known.
# Fall through into signo/insn analysis.
# Guessing here... it might be kill(2) as well.
# Should I add "Likely ..." to the descriptions?
if self.signo in (signal.SIGINT, signal.SIGQUIT, signal.SIGTSTP):
self.exploitable_rating = 0
self.exploitable_desc = _("Signal sent by keyboard")
return
if self.signo in (signal.SIGTTIN, signal.SIGTTOU, signal.SIGHUP):
self.exploitable_rating = 0
self.exploitable_desc = _("Job control signal sent by kernel")
return
if self.signo == signal.SIGPIPE:
self.exploitable_rating = 0
self.exploitable_desc = _("Signal due to write to broken pipe")
return
if self.signo == signal.SIGWINCH:
self.exploitable_rating = 0
self.exploitable_desc = _("Signal sent by window resize")
return
if self.signo == signal.SIGALRM:
self.exploitable_rating = 0
self.exploitable_desc = _("Signal sent by alarm(N) expiration")
return
# Which signals can coredump?
# SIGABRT Abort signal from abort(3)
# SIGQUIT Quit from keyboard
# SIGXCPU CPU time limit exceeded
# SIGXFSZ File size limit exceeded
# SIGTRAP Trace/breakpoint trap
# SIGSYS Bad argument to routine (SVr4)
# SIGFPE Floating point exception
# SIGILL Illegal Instruction
# SIGSEGV Invalid memory reference
# SIGBUS Bus error (bad memory access)
if self.signo == signal.SIGABRT:
self.exploitable_rating = 0
self.exploitable_desc = _("ABRT signal (abort() was called?)")
return
# Already handled above:
#if self.signo == signal.SIGQUIT:
# self.exploitable_rating = 0
# self.exploitable_desc = _("QUIT signal (Ctrl-\\ pressed?)")
# return
if self.signo == signal.SIGXCPU:
self.exploitable_rating = 0
self.exploitable_desc = _("XCPU signal (over CPU time limit)")
return
if self.signo == signal.SIGXFSZ:
self.exploitable_rating = 0
self.exploitable_desc = _("XFSZ signal (over file size limit)")
return
if self.signo == signal.SIGTRAP:
self.exploitable_rating = 0
self.exploitable_desc = _("TRAP signal (can be a bug in a debugger/tracer)")
return
if self.signo == signal.SIGSYS:
self.exploitable_rating = 1
self.exploitable_desc = _("SYS signal (unknown syscall was called?)")
return
if self.signo == signal.SIGFPE:
self.exploitable_rating = 1
self.exploitable_desc = _("Arithmetic exception")
# 1 is FPE_INTDIV
if self.si_code == 1 or self.instruction_is_division:
self.exploitable_rating = 0
self.exploitable_desc = _("Division by zero")
return
if self.signo == signal.SIGILL:
self.exploitable_rating = 5
self.exploitable_desc = _("Illegal instruction (jump to a random address?)")
return
if self.signo != signal.SIGSEGV and self.signo != signal.SIGBUS:
self.exploitable_rating = 2
# Pity that we can't give a more descriptive explanation
self.exploitable_desc = _("Non-crash related signal")
return
if self.instruction_is_pushing:
self.exploitable_rating = 4
self.exploitable_desc = _("Stack overflow")
return
if self.instruction_is_store:
self.exploitable_rating = 6
self.exploitable_desc = _("Write to an invalid address")
return
if self.instruction_is_return:
self.exploitable_rating = 7
self.exploitable_desc = _("Subroutine return to an invalid address (corrupted stack?)")
return
# Note: we check "ret" first, _then_ jumps.
# Corrupted stack is different from corrupted data.
if self.instruction_is_branch:
self.exploitable_rating = 6
self.exploitable_desc = _("Jump to an invalid address")
return
if not self.current_instruction:
self.exploitable_rating = 6
self.exploitable_desc = _("Jump to an invalid address")
return
if self.signo == signal.SIGBUS:
self.exploitable_rating = 5
self.exploitable_desc = _("Access past the end of mapped file, invalid address, unaligned access, etc")
return
# default values remain (e.g. description is "")
class AbrtExploitable(gdb.Command):
"Analyze a crash to determine exploitability"
def __init__(self):
super(AbrtExploitable, self).__init__(
"abrt-exploitable",
gdb.COMMAND_SUPPORT, # command class
gdb.COMPLETE_NONE, # completion method
False # => it's not a prefix command
)
init_gettext()
# Called when the command is invoked from GDB
def invoke(self, args, from_tty):
si = SignalAndInsn()
if not si.get_signal():
sys.stderr.write(_("Can't get signal no and do exploitability analysis\n"))
return
si.get_instruction()
min_rating = 0
if args:
args = args.split(None, 1)
min_rating = int(args[0])
si.is_exploitable()
if si.exploitable_desc:
if si.exploitable_rating >= min_rating:
f = sys.stdout
if args and len(args) > 1:
f = open(args[1], 'w')
f.write(_("Likely crash reason: ") + si.exploitable_desc + "\n")
f.write(_("Exploitable rating (0-9 scale): ") + str(si.exploitable_rating) + "\n")
if si.current_instruction:
f.write(_("Current instruction: ") + si.current_instruction + "\n")
else:
sys.stderr.write(_("Exploitability analysis came up empty\n"))
AbrtExploitable()