Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

BUG: Internal error parsing GDB output! #27

Closed
qdlmcfresh opened this issue May 11, 2020 · 0 comments
Closed

BUG: Internal error parsing GDB output! #27

qdlmcfresh opened this issue May 11, 2020 · 0 comments

Comments

@qdlmcfresh
Copy link

panic:
BUG: Internal error parsing GDB output!

Something went wrong trying to parse the output of GDB and we can't continue
without emitting stupid results. If this is a crash that's not worth money,
please open an issue and include the raw GDB output. If not then just wait, I
guess. :)

GDB OUTPUT:

 <EXPLOITABLE>
</EXPLOITABLE>
<REG>
rax            0x0                 0
rbx            0x0                 0
rcx            0x796620            7956000
rdx            0x0                 0
rsi            0x0                 0
rdi            0x7967f8            7956472
rbp            0x7fffffffdb00      0x7fffffffdb00
rsp            0x7fffffffdae0      0x7fffffffdae0
r8             0x1                 1
r9             0x79c3a0            7979936
r10            0x6e1010            7213072
r11            0x7ffff78f5be0      140737346755552
r12            0x4e55f0            5133808
r13            0x7fffffffdf90      140737488347024
r14            0x0                 0
r15            0x0                 0
rip            0x5ba1d0            0x5ba1d0 <P2PDetector::performShutdown()+48>
eflags         0x10246             [ PF ZF IF RF ]
cs             0x33                51
ss             0x2b                43
ds             0x0                 0
es             0x0                 0
fs             0x0                 0
gs             0x0                 0
</REG>

A debugging session is active.

        Inferior 1 [process 108201] will be killed.

Quit anyway? (y or n) [answered Y; input not from terminal]

COMMAND:
-q --batch --ex run --ex source /home/qdl/fuzzing/exploitable/exploitable/exploitable.py/exploitable.py --ex echo <EXPLOITABLE>
 --ex exploitable -v --ex echo </EXPLOITABLE>
 --ex echo <REG>
 --ex info reg --ex echo </REG>
 --ex quit --args /home/qdl/fuzzing/vermont-debug/vermont -f /home/qdl/crashes3/crashes/id:000021,sig:11,src:000372,op:flip1,pos:781


goroutine 12 [running]:
github.com/bnagy/crashwalk/gdb.explode(...)
        /home/qdl/go/src/github.com/bnagy/crashwalk/gdb/gdb.go:156
github.com/bnagy/crashwalk/gdb.parse.func1()
        /home/qdl/go/src/github.com/bnagy/crashwalk/gdb/gdb.go:371 +0x1a3
github.com/bnagy/crashwalk/gdb.mustAdvanceTo(0x652063, 0xc, 0xc0001213c0, 0xc0001214b8)
        /home/qdl/go/src/github.com/bnagy/crashwalk/gdb/gdb.go:181 +0xb3
github.com/bnagy/crashwalk/gdb.parseStack(0xc0000e83db, 0x4bb, 0xa25, 0xc0001214b8, 0xc0000ec000, 0x18, 0x18)
        /home/qdl/go/src/github.com/bnagy/crashwalk/gdb/gdb.go:324 +0x128
github.com/bnagy/crashwalk/gdb.parse(0xc0000e83db, 0x4bb, 0xa25, 0xc000154000, 0x163, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
        /home/qdl/go/src/github.com/bnagy/crashwalk/gdb/gdb.go:377 +0x164
github.com/bnagy/crashwalk/gdb.(*Engine).Run(0x839a78, 0xc000072a80, 0x3, 0x3, 0xc00001e640, 0x47, 0xffffffffffffffff, 0xb4, 0x0, 0x0, ...)
        /home/qdl/go/src/github.com/bnagy/crashwalk/gdb/gdb.go:487 +0x964
github.com/bnagy/crashwalk.process(0xc000012f70, 0xc0000182a0, 0xc0000181e0, 0xc000016340)
        /home/qdl/go/src/github.com/bnagy/crashwalk/crashwalk.go:372 +0x9d5
created by github.com/bnagy/crashwalk.(*Crashwalk).Run
        /home/qdl/go/src/github.com/bnagy/crashwalk/crashwalk.go:540 +0x222

Trying the same crashfile in gdb manualy

(gdb) source ~/fuzzing/exploitable/exploitable/exploitable.py
(gdb) r
Starting program: /home/qdl/fuzzing/vermont-debug/vermont -f /home/qdl/crashes3/crashes/id:000021,sig:11,src:000372,op:flip1,pos:781
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
14:29:56.244[0] WARNING /home/qdl/fuzzing/vermont-debug/src/vermont.cc:340: starting up vermont config manager
[New Thread 0x7ffff570a700 (LWP 108511)]
[New Thread 0x7ffff4f09700 (LWP 108512)]
[New Thread 0x7fffeffff700 (LWP 108513)]
[New Thread 0x7fffef7fe700 (LWP 108514)]
14:29:56.247[0] WARNING /home/qdl/fuzzing/vermont-debug/src/vermont.cc:347: vermont is up and running
14:29:56.247[1] WARNING /home/qdl/fuzzing/vermont-debug/src/modules/packet/Observer.cpp:262: Observer: reached end of file (22 packets)
14:29:56.247[0] CRITICAL /home/qdl/fuzzing/vermont-debug/src/vermont.cc:364: got
signal - shutting down manager
[Thread 0x7fffef7fe700 (LWP 108514) exited]
Thread 1 "vermont" received signal SIGSEGV, Segmentation fault.
0x00000000005ba1d0 in P2PDetector::performShutdown (this=0x796620)
    at analysis/P2PDetector.cpp:299
299             timer->removeTimeout(NULL);
(gdb) exploitable -v
'exploitable' version 1.32
Linux ubuntu 5.3.0-51-generic #44-Ubuntu SMP Wed Apr 22 21:09:44 UTC 2020 x86_64
Signal si_signo: 11 Signal si_addr: 0
Nearby code:
   0x00000000005ba1be <+30>:    call   QWORD PTR [rdx+0x68]
   0x00000000005ba1c1 <+33>:    xor    eax,eax
   0x00000000005ba1c3 <+35>:    mov    esi,eax
   0x00000000005ba1c5 <+37>:    mov    rcx,QWORD PTR [rbp-0x10]
   0x00000000005ba1c9 <+41>:    mov    rdx,QWORD PTR [rcx+0x118]
=> 0x00000000005ba1d0 <+48>:    mov    rdi,QWORD PTR [rdx]
   0x00000000005ba1d3 <+51>:    mov    QWORD PTR [rbp-0x18],rdi
   0x00000000005ba1d7 <+55>:    mov    rdi,rdx
   0x00000000005ba1da <+58>:    mov    rdx,QWORD PTR [rbp-0x18]
   0x00000000005ba1de <+62>:    call   QWORD PTR [rdx+0x18]
Stack trace:
#  0 P2PDetector::performShutdown at 0x5ba1d0 in /home/qdl/fuzzing/vermont-debug/vermont
#  1 Module::shutdown at 0x618b88 in /home/qdl/fuzzing/vermont-debug/vermont
#  2 CfgHelper<P2PDetector, P2PDetectorCfg>::shutdown at 0x50bfc1 in /home/qdl/fuzzing/vermont-debug/vermont
#  3 ConfigManager::shutdown at 0x4e89c6 in /home/qdl/fuzzing/vermont-debug/vermont
#  4 main at 0x4e5d82 in /home/qdl/fuzzing/vermont-debug/vermont
Faulting frame: #  0 P2PDetector::performShutdown at 0x5ba1d0 in /home/qdl/fuzzing/vermont-debug/vermont
Description: Access violation near NULL on source operand
Short description: SourceAvNearNull (16/22)
Hash: efba8b71d7eb72f594af08922d936240.efba8b71d7eb72f594af08922d936240
Exploitability Classification: PROBABLY_NOT_EXPLOITABLE
Explanation: The target crashed on an access violation at an address matching the source operand of the current instruction. This likely indicates a read access violation, which may mean the application crashed on a simple NULL dereference to
data structure that has no immediate effect on control of the processor.
Other tags: AccessViolation (21/22)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant