[Bug] vmmap command not showing memory regions of QEMU emulated x86-64 binary

[avncharlie]

GEF+GDB version

GEF: (Standalone)
Blob Hash(/home/funkyhamster/.gef-.py): 5435c79e60d1f0732ef289513d95e21e87902816
SHA256(/home/funkyhamster/.gef-.py): d69a75e2872dd87c6d89d33a731a61706e49e99534bada7657e50bc7b79ff5b7
GDB: 12.1
GDB-Python: 3.10

Operating System

Ubuntu 22.04.3 LTS

Describe the issue you encountered

When using gef-remote to debug a x86-64 binary running using QEMU, the vmmap command doesn't correctly show the emulated program's memory regions. It just shows this one region:

(remote) gef➤  vmmap
[ Legend:  Code | Heap | Stack ]
Start              End                Offset             Perm Path
0x0000000000000000 0xffffffffffffffff 0x0000000000000000 rwx /home/funkyhamster/test/x86

Do you read the docs and look at previously closed issues/PRs for similar cases?

Yes

Architecture impacted

• X86
• X64
• ARM
• ARM64
• MIPS
• MIPS64
• PPC
• PPC64
• RISCV

Describe your issue. Without a proper reproduction step-by-step, your issue will be ignored.

I compiled the test program below with this command: x86_64-linux-gnu-gcc main.c -o x86

#include <stdio.h>
int main() {
    printf("hello, world!\n");
}

I ran it under QEMU using this command: qemu-x86_64 -g 1234 ./x86
I then ran gef with these commands:

set arch i386:x86-64
file x86
gef-remote --qemu-user --qemu-binary x86 localhost 1234

gef successfully attaches to this program and I can see the assembly listing + registers.
However, when I run vmmap I don't see the expected memory areas of this program.

Minimalist test case

#include <stdio.h>
int main() {
    printf("hello, world!\n");
}

Additional context?

No response

[hugsy]

Hi @avncharlie

This is not a bug and it is implemented very explicitly in the code

https://github.com/hugsy/gef/blob/main/gef.py#L11127-L11134

qemu-user & gdb don't share enough information via the gdb remote protocol to reliably reconstitute the equivalent of /proc/<pid/maps on the client's end. That's why a preferred approach if you can would be to use the remote mode (https://hugsy.github.io/gef/commands/gef-remote/#remote-mode) instead, where gef will rebuild locally a mock procfs environment and you will see the regions.

Cheers

[avncharlie]

Thanks, makes sense!