I am trying to get the memory map of a process I am debugging remotely (peda pull request link), the process is ran with qemu-user, for example:
qemu-arm -L /usr/arm-linux-gnueabihf/ -g 1234 ./ch47
the debugging is done with gdb, commands:
$ gdb-multiarch --nx -q ch47 (gdb) target remote localhost:1234 Remote debugging using localhost:1234 warning: remote target does not support file transfer, attempting to access files from local filesystem. warning: Unable to find dynamic linker breakpoint function. GDB will be unable to debug shared library initializers and track explicitly loaded dynamic code. (gdb) info inferiors Num Description Executable * 1 Remote target /home/redouane/infosec/arm_uaf/ch47 (gdb) remote get /proc/self/maps /tmp/map Remote I/O error: Fonction non implantée
The debugged process doesn't have a PID as I see (it's ran in the address-space of qemu-arm, not a separate process).
I am wondering, how does an extension like pwndbg retrieve the memory maps when debugging remotely, and the target does not support file transfer?
pwndbg> vmmap LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA 0x10000 0x13000 r-xp 3000 0 /home/redouane/infosec/arm_uaf/ch47 0x13000 0x22000 ---p f000 2000 /home/redouane/infosec/arm_uaf/ch47 0x22000 0x23000 r--p 1000 2000 /home/redouane/infosec/arm_uaf/ch47 0x23000 0x24000 rw-p 1000 3000 /home/redouane/infosec/arm_uaf/ch47 0xff7c5000 0xff7dd000 r-xp 18000 0 [linker] 0xff7dd000 0xff7ed000 ---p 10000 18000 [linker] 0xff7ed000 0xff7ee000 r--p 1000 18000 [linker] 0xff7ee000 0xff7ef000 rw-p 1000 19000 [linker] 0xfffee000 0xffff0000 rw-p 2000 0 [stack]