I am trying to get the memory map of a process I am debugging remotely (peda pull request link), the process is ran with qemu-user, for example:

qemu-arm -L /usr/arm-linux-gnueabihf/ -g 1234 ./ch47

the debugging is done with gdb, commands:

$ gdb-multiarch --nx -q ch47

(gdb) target remote localhost:1234

Remote debugging using localhost:1234
warning: remote target does not support file transfer, attempting to access files from local filesystem.
warning: Unable to find dynamic linker breakpoint function.
GDB will be unable to debug shared library initializers
and track explicitly loaded dynamic code.

(gdb) info inferiors 
  Num  Description       Executable        
* 1    Remote target     /home/redouane/infosec/arm_uaf/ch47 

(gdb) remote get /proc/self/maps /tmp/map
Remote I/O error: Fonction non implantée

The debugged process doesn't have a PID as I see (it's ran in the address-space of qemu-arm, not a separate process).

I am wondering, how does an extension like pwndbg retrieve the memory maps when debugging remotely, and the target does not support file transfer?

pwndbg> vmmap
   0x10000    0x13000 r-xp     3000 0      /home/redouane/infosec/arm_uaf/ch47
   0x13000    0x22000 ---p     f000 2000   /home/redouane/infosec/arm_uaf/ch47
   0x22000    0x23000 r--p     1000 2000   /home/redouane/infosec/arm_uaf/ch47
   0x23000    0x24000 rw-p     1000 3000   /home/redouane/infosec/arm_uaf/ch47
0xff7c5000 0xff7dd000 r-xp    18000 0      [linker]
0xff7dd000 0xff7ed000 ---p    10000 18000  [linker]
0xff7ed000 0xff7ee000 r--p     1000 18000  [linker]
0xff7ee000 0xff7ef000 rw-p     1000 19000  [linker]
0xfffee000 0xffff0000 rw-p     2000 0      [stack]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.