Skip to content

Releases: pwndbg/pwndbg

2024.08.29

09 Sep 11:27
@disconnect3d disconnect3d
2024.08.29
26ba400
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
2024.08.29 Latest
Latest

2024.08.29 Release

Since last release we got a lot of new features and improvements done in Pwndbg.

Among others, we now show register/memory values in disasm view for different architectures, added Binary Ninja integration, added commands helping with Go debugging, added glibc heap
UAF tracking and refactored lots of Pwndbg code for future LLDB port.

Some of this work was paid thanks to the Python Summer of Code program (@OBarronCS, @mbrla0 and @jetchirag's projects) and thanks to Trail of Bits' internships (@Aplet123 and @mbrla0 projects). Here are hightlights from their work:

Major changes

image image image image
  • Added option to search to look for assembly instructions (search --asm <code>) and to set breakpoints on found instructions (search --asmbp <code>)
  • Added vmmap --gaps which displays mapped memory with gaps instead of the normal vmmap display:
image
  • Added commands to display Android Binder driver info (experimental; #1488), and a pcp command to print Linux kernel per-cpu page cache (#1487)

Full changelog

The full changelog can be found here: 2024.02.14...2024.08.29

New Contributors

Also thanks to @patryk4815 for all the help with packaging and releases.

Contributors

dguerri, patryk4815, and 21 other contributors
Assets 14

2024.02.14

18 Feb 20:37
@disconnect3d disconnect3d
2024.02.14
cada600
Compare
Choose a tag to compare
2024.02.14

2024.02.14 Release

Here is the 2024.02.14 release. Thanks to everyone who contributed!

Among others, this release brings GOT tracking mechanism, more step/break commands, mmap/mprotect syscalls, printing of linked lists, displaying of threads in context for multithreaded programs, lots and lots of fixes and more!

The release files can be used to install Pwndbg as self-contained (along with GDB, Python and all deps) package on many distros and x86-64 and arm64/aarch64 architectures. The *-portable.tar.gz archives can be just unpacked and run.

Below is a summary of changes, while the full changelog can be found further on.

Note: this release requires Python >= 3.8 (which means Ubuntu 18.04 or Debian 10 are not supported anymore).

Summary of changes

General changes:

  • Added portable Pwndbg archive to release as well as nix, rpm, deb, arch and alpine packages
  • Added $base(objfile_name) function to compute base address of given memory page, e.g. print $base(libc)+0x123 will return base of libc + 0x123
  • Context will now display threads information for multi-threaded programs
    • this is limited by context-max-threads parameter (use set context-max-threads <N> to change)
  • Added glibc heap exploitation support for libc 2.12+ (#1823)
  • Added support for FreeBSD (#1832)
  • The gdb-pt-dump git submodule was moved to a python dependency (#1929)

New commands:

  • track-got {enable,disable,info,query} ... can be used to track (#1971)
  • stepuntilasm <asm> will step through program instructions until a matching part of instruction string is found (#1798)
  • break-if-taken <loc> and break-if-not-taken <loc> will setup a breakpoint on given location of a branch instruction which will stop the program if the branch was taken or not (#1799)
  • plist ... can be used to print linked lists (#1795, #1817)
  • mmap ... and mprotect ... commands will invoke the mmap or mprotect syscalls with given arguments in the debugged program
    • note: this works by assembling a shellcode for the syscall call, placing the code on current PC/IP address, executing the syscall and reverting back the register and memory changes made
  • thread command to display threads information
  • hi command to check if an address belongs to a glibc heap chunk (#1938)
  • tips to display tips about Pwndbg usage
  • sigreturn <address> to print sigreturn x86-64 frame (#1940)

Changed commands:

  • Added telescope --frame to display stack frame information (requires BP and SP to point to the same memory region) (#1855)
  • Glibc heap commands now also print real chunk size (#1748)
  • Added spray --only-funcptrs | -x flag to spray only the memory addresses where values point to executable memory pages (#1809)
  • Added -A <N> and -B <N> flags to vmmap to display N entries after/before the filtered page (#1810)
  • The linux kernel memory pages figured out by gdb-pt-dump can now be filtered in vmmap (they have unique names) (#1837)
  • Added new arguments/options to the search memory command (#1867)
  • telescope output can now show frame pointer offsets (#1925)
  • distance <single-address> now prints offset from memory page start address (#1926)
  • Added stack -i | --inverse to show stack in reverse order (#1978)
  • Added new positional argument to cyclic command to save its output to file (so it can later be used, e.g. as run < input) (#2009)

Detailed changelog (from git log)

Read more

Contributors

anthraxx, patryk4815, and 37 other contributors
Assets 12
Loading

2023.07.17 packages (debian10-final, ubuntu18.04-final)

05 Oct 12:34
@disconnect3d disconnect3d
2023.07.17-pkgs
72ab4aa
Compare
Choose a tag to compare
2023.07.17 packages (debian10-final, ubuntu18.04-final)

This is the 2023.07.17 release but which contains packages for various distributions (Debian-like using dpkg, RHEL-like using yum/rpm, Arch Linux and Alpine (.apk)).

The packages are totally self-contained: they include all what you need to run GDB+Pwndbg after installation.
They do not rely on any dependencies and are build in (hopefully) reproducible way using Nix package manager.

Please ignore the 'source code' attached, it is fr later commit than 2023.07.17. The packages were build from the 2023.07.17 version.

Assets 7
Loading

2023.07.17 (debian10-final, ubuntu18.04-final)

17 Jul 13:02
@disconnect3d disconnect3d
2023.07.17
71c4e1d
Compare
Choose a tag to compare
2023.07.17 (debian10-final, ubuntu18.04-final)

Here is the 2023.07.17 release. Thanks to everyone who contributed!

We would also like to honour Zach Riggle once again, who was a long time contributor and maintainer of Pwndbg.

Also please note that this release will be the last to support Python 3.6 and Python 3.7 (and so Ubuntu 18.04 and Debian 10).

TL;DR what this release brings

  • The setup.sh now installs Python dependencies in a virtual environment created in pwndbg/.venv/ and gdbinit.py sets appropriate paths so that the created virtual environment is used automatically (previously, we installed deps in the system's Python interpreter which could break users' setups)
  • New or improved commands:
    • The pwndbg helper command can now filter commands list by category, e.g.: pwndbg -c heap (categories are: heap, kernel, linux etc.)
    • Added killthreads [<ids....>] command to kill threads with given IDs
    • Added slab contains <addr> [<addrs...>] command to inspect Linux kernel heap (when debugging kernel)
    • Added spray <addr> ... command to spray memory with given values (instead of doing pi pwndbg.gdblib.memory.write(address, b'data'))
    • Improved got command display and filtering
    • Multiple heap commands improvements (heap, vis_heap_chunks optimized, find_fake_fast, *bins)
      • Optimized vis_heap_chunks command
    • telescope -r now always displays the input address
    • Fixed vmmap for 32-bit kernels
    • Fixed patch-list and patch-revert commands
    • More AI clouds support in the ai command
  • Improved RISC-V support -- added branch prediction through Unicorn emulation
  • Added basic heap heuristics for RISC-V and PowerPC
  • Added krelease function that allows us to implement different behavior for different Linux kernel versions
  • Better glibc version detection

...and other bug fixes and improvements. See below for full changelog!

Full Changelog / What's Changed

Read more

Contributors

gsingh93, ThomsonTan, and 23 other contributors
Assets 2
Loading

2023.03.19

19 Mar 10:56
@disconnect3d disconnect3d
2023.03.19
5d4026d
Compare
Choose a tag to compare
2023.03.19

Here is the 2023.03.19 release. Thanks to everyone who contributed!

TL;DR what this release brings

  • New or edited commands:
    • kbase, kchecksec, slab - kernel debugging only commands to get kernel base address, checksec for kernel and list kernel slabs
    • valist - dumps arguments of a va_list structure on given address
    • ai - ask AI about the current debugging session (requires openAI API key)
    • cunwatch now operates on the index/number of expression instead of requiring the user to pass the whole expression to unwatch
    • cyclic - improved UX by adding nicer info/error messages
    • the tls command now leverages GDB's scheduler locking so now when it calls a function to obtain TLS address it won't allow any other target threads to run, which could previously cause issues on targets with multiple threads
  • We added command categories and refactored the display of pwndbg help :)
  • Added support for riscv:rv64 architecture
  • Lots of glibc heap commands fixes and improvements
    • Better support for 32-bit and big-endian architectures
    • Better heap heuristics
    • largebins now display bin size ranges instead of indexes
    • arena displays thread id
    • vis_heap_chunks has now --all-chunks to display all chunks
    • we renamed two flags in the vis_heap_chunks command (--naive -> --beyond-top and --display_all -> --no_truncate)
  • It is now possible to display instruction opcodes in the disasm context by setting set nearpc-num-opcode-bytes 9
  • Fixes for vmmap recursion errors
  • Fixes for Rust binaries debugging
  • Support for Rizin
  • Unicorn emulation is now disabled if mmap(1GB, RWX) fails due Unicorn Engine aborts on environments with low memory
  • Improved virtualenv detection and warnings
  • Fixed message when locales are wrong: in fact, Pwndbg requires LC_CTYPE=C.UTF-8 environment variable and not LC_ALL=en_US.UTF-8 PYTHONIOENCODING=UTF-8 as it previously suggested

What's Changed

Read more

Contributors

gsingh93, oblivia-simplex, and 9 other contributors
Assets 2
Loading

2022.12.19

19 Dec 22:34
@disconnect3d disconnect3d
2022.12.19
894f6e2
Compare
Choose a tag to compare
2022.12.19

A new release is here :). Thanks to all contributors for improving Pwndbg!

TL;DR what this release brings

  • New or edited commands:
    • kconfig to obtain debugged Linux kernel config
    • cymbol to add/show/load/edit/delete custom structures written in plain C
    • mprotect to set memory protections (the command was fixed as it was not working for some time)
    • bins and find_fake_fast were improved
    • cyclic - the Pwntools' pwn cyclic commmand was ported as a native command
  • We improved the support for debugging QEMU kernels and more improvements and new commands are incomming
    • You can set Pwndbg to fetch vmmap info for kernels in three different modes, see help set kernel-vmmap
  • Added support for heap commands for cases when libc debug symbols are not present. For this, certain heuristics regarding the code are used and as a last resort, the user can set addresses of heap related symbols to make the heap command work properly. See heap_config and help set resolve-heap-via-heuristic for more information.
  • We improved coredump debugging (vmmap fetching)
  • We refactored lots of code and more refactoring is incomming
  • Lots of tests and CI targets were added to ensure we don't hit regressions
  • And more... see the full changelog below

What's Changed

Read more

Contributors

erivas, gsingh93, and 24 other contributors
Assets 2
Loading

2022.08.30

30 Aug 03:02
@disconnect3d disconnect3d
2022.08.30
cf2c3ee
Compare
Choose a tag to compare
2022.08.30

A new release is here :). Thanks to all contributors for improving Pwndbg!

TL;DR what this release brings

  • New commands or new flags:
    • attachp [pid | process name | device file] to attach to process by pid/name/device file,
    • setflag to set CPU flags register values,
    • telescope --reverse ... to see memory before a provided address,
    • heap_config to set heap commands configuration,
  • Better support for heap debugging without symbols:
    • It is now possible to make Pwndbg determine the addresses of heap symbols when they are missing; also this is going to be improved further soon,
    • If symbols cannot be found, heap_config can be used to configure symbols addresses,
    • We now define a $heap_base convenient variable,
  • better kernel debugging support - we use gdb-pt-dump to dump memory map information which should be much faster than the previous solution of parsing monitor info mem information,
  • better support for coredump debugging, mainly its vmmap display - we now parse what we can to get that info (btw GDB could improve on generating core dumps as well, see GDB-bugzilla#29508,
  • we now display file paths based on /proc/$pid/fd/$fd of opened files when showing the arguments of POSIX file APIs (open, read, write, close etc.) in the disasm view,
  • we now display tips when Pwndbg is launched (can be disabled with set show-tips off added do ~/.gdbinit)
  • better support for virtualenvs - though, we display a warning that this may not work as expected (due to C libraries dependencies like libffi-dev etc)
  • more tests and improved CI as we now test on Ubuntu 18.04, 20.04 and 22.04,
    • ./tests.sh now has [<filter-tests-names>] [--pdb] arguments,
  • ...and lots and lots of fixes!

What's Changed

New Contributors

Full Changelog: 2022.01.05...2022.08.30

Contributors

viciu, akiym, and 23 other contributors
Assets 2
Loading

The 2022 release

05 Jan 11:34
@disconnect3d disconnect3d
2022.01.05
96d3d5a
Compare
Choose a tag to compare
The 2022 release

Commits included:

96d3d5a (HEAD -> dev, tag: 2022.01.05) Set docs version to 2022.01.05
eec6f74 (origin/dev, origin/HEAD) Use `add-symbol-file` correctly.
439b660 added pylintrc file for standarized linting
cddbcb5 Fix search bug in kernel mode
6d2b6c6 .
5a39da7 moved block to source gdbinit
5844257 removed source line
a1c9d09 added little blurb for endeavourOS
0e45524 added command to source gdbinit.py
8b05953 Fixed multiple alignment issues of compact register view
38c38aa Fix typos
2616e70 Updated permissions for Docker container
1cc12ad Added devcontainer configuration for VS Code to directly develop inside Docker container
84e783a Ignore printing vertical tabs in vis_heap_chunks command
d348c74 Update emulator.py
9448cf5 Fix error message on interrupts
5c0627d Update pwndbg/glibc.py
e0e32dc fix ending of chain
bd7c3aa add test for heap bins
94eea64 safe-linking: use __libc_version when debug symbols loaded
09f2cb6 Add safe-linking support
95e3bb0 Fix lint
0ec3180 Hopefully fix windbg commands tests on CI
9636331 CI: show installed packages
1d70e14 Fix #932,#788: fix command parsing
d861d6e Skip attachp tests when cant attach
eee5dbc Remove Py2 class object inheritance
ef86a5c Remove shebang and coding lines
89b2df5 Remove incorrect i386 regs: dil/sil/spl/bpl
9a17798 Speedup emulator by disabling debug formatting when not debugging
270fef3 Remove redundant disasm.is_call function
af41986 Bump capstone to 4.0.2
e239e9c Hopefully fix recursion error
c8c9e3f Add Codecov
9c8df00 Add basic coverage testing
3583b57 fix(tempdir): use safe and unpredictable cachedir location
1c63382 Do not sort auxv, use the implicit order
526b3ea Hopefully fix CI tests
b203d53 SLES/OpenSUSE: enable debugging repo before installing
6fd42dd Add attachp command and tests for it
1e28920 Stop skipping tests
34f9535 Fix isort
4439446 Maintain backward compatibility with Python < 3.10
07b7c75 Migrate to 3.10 compatible abc usage.
b739733 fix typo in dd command
f11afe2 Fix get_highlight_source line splitting
8cc218f Adding p2p command - pointer chain search
a7a554f Add square brackets to vmmap's anonymous map names
648c7f0 Fix heap unprinted messages
e2c899e Fix isort lint import issues
00e94a9 Fix unprinted 'Unknown register' context warning
8975d42 Better pwndbg.commands.OnlyWithFile error for QEMU targets
c294ede pwndbg.file.get_file: better warning message
32cdc10 piebase, breakrva: print error on failures
71291d8 Fix vmmap_load on remote targets
Assets 2
Loading

The 2021 release

22 Jun 12:05
@disconnect3d disconnect3d
2021.06.22
a79c85b
Compare
Choose a tag to compare
The 2021 release

The 2021 release, which contains many fixes & some enhancements.

Thanks to all contributors!

TL;DR git log since last release:

a79c85b (HEAD -> dev, tag: 2021.06.22, origin/dev, origin/HEAD) Update links to use Discord
668e53f Fix xinfo used with symbols that are function pointers
8db8f4d fix: update_length() raise exception in some cases
30d6745 Make brva alias accept same args as breakrva
aa25aac fix(disasm,emulate): support mips32r6
44471df fix(emulate): refix emulate, let it works correct on unicorn-1.0.2rc1 ~ unicorn-1.0.2
99a5ef3 fix exception raised by cs.syntax when debugging mips binary
5389eb6 fix(emulate): let `emulate` works on unicorn-1.0.2rc1 ~ unicorn-1.0.2
87da998 fix(telescope): also unroll buffer if last line is skipped
05036de fix(telescope): avoid superfluous whitespace after register column
75b4249 feature(telescope): reduce cognitive load by adding skip count label
baf3fe7 feature(telescope): option to set min repeating values before skipping
14325af chore: clean up unused imports
a8c2fb5 fix(ui): fix display of addrsz to be hex formated
a5c9738 feature(radare2): add r2pipe command to execute stateful radare2 cmds
5d0441b feature(shell): put 'pwn' into allow list for pwntools
56d1fac chore(profile): extend test binary so unicorn engine shows more code flow
f1aa0c8 feature(profile): use a simple module based approach to define profiles
fbfd47f fix(profile): accept any valid location for pyprof2calltree
87bf6ac chore(ghidra): simplify logic and clean up code flow
707fe12 chore(ghidra): use memoize feature to cache r2pipe handle
44770fd fix(ghidra): handle PIE base address when opening the r2pipe
71ca721 feature(ghidra): use configurable code prefix marker for line indicator
a100d87 fix(ghidra): make if-no-source condition work as expected
6354fdc fix(ghidra): avoid crash if we try to decompile a faulty addr/func
e8b5124 chore(ghidra): modularize ghidra functions into utils and commands
b036575 feature(radare2): add argument to set base when loading for PIE (#897)
cd3cbf3 Update README to show more modern supported Linux versions (#885)
00c9740 use_info_auxv() : change regex (#894)
96df189 Changed register list to use precomputed tuples (#866)
cd0cd82 Fixed bug when the GDB is debuggin an architecture arm-eabi (disassembly-flavor). (#889)
4d213a1 Fix #881 (#883)
ae6f25a Fix #858 (#877)
26a18f1 Remove quotes from command option interpolation (#876)
bf49bf8 Unit test fix (#868)
5639589 Remove unimplemented dlmalloc (#874)
c31c720 docs: fix simple typo, divison -> division (#870)
f74aa34 The disassembly flavor is hard-coded. It does not change from Intel to AT&T (#860)
304bf26 Improved the number of Runs/Layers in the container. Upgraded Ubuntu and install GoLand to run the tests. (#862)
cc92959 Added comment command  (#857)
812278b Allow return offsets and use it for 'start' method. (#864)
bde3637 added fix for i386 libc6-dbg package. (#859)
29f962c ropgadget: fix path export. (#854)
cfe93ab  fix for ubuntu 20.04 (#850)
979d330 Fixes #841
30c816b Moved filename to the end of the command (#842)
ea11f86 Add basic i8086 support (#835)
f096be7 Compact, [big-endian] hexdump (#839)
779634a fix prev chunk size check (#837)
9250cc5 Compact register list for context view (#830)
7690b60 Fixed bug: bins gets the wrong pointer offset (#832)
d626db1 add config context-backtrace-lines (#831)
b209c2b Added installation configuration for Gentoo (#820)
a9c43ed In setup.sh, remove installation of python2 for apt (#828)
487caa1 Fix #814: better aslr output (#818)
301012a Py3k (#817)
ccd8f76 Remove travis (#816)
ce2266e Add GitHub Actions support (#809)
15b11c7 Add Dockerfile for easier dev (#815)
96716ce Fix mprotect failing on py2
Assets 2
Loading

2020.07.23

22 Jul 22:24
@disconnect3d disconnect3d
2020.07.23
fa326d3
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
2020.07.23

This release brings a lot of fixes and improvements and a new mprotect command that injects/calls the corresponding syscall (x64/x86 only for now).

Thanks to all contributors!

Detailed commit log

Assets 2
Loading