1

Question

I have a test program called scan (see code section) that I run in one terminal. The program starts running and asks the user to enter a letter:

$ ./scan
Enter a letter

In another terminal window, I run gdb and attach to the scan process:

$ sudo gdb -p `pidof scan`
(gdb)

I would like to send contents of a binary file called payload as input to the scan process. How can I accomplish this in gdb while the process is attached? Is this possible?

Background

I want to attach to the scan process because I want to examine the program's ASLR address space while running. If I run the process directly with gdb ($ gdb scan), gdb turns off ASLR and I get consistent addressing.

For example, running scan directly with gdb (please note that ... is truncated output):

$ gdb scan
(gdb) info functions
...
0x00000000000005a8  _init
0x00000000000005d0  __stack_chk_fail@plt
0x00000000000005e0  printf@plt
0x00000000000005f0  __isoc99_scanf@plt
...

The addresses shown above are the same every time I run gdb this way, which indicates that gdb turns off ASLR. However, when attaching to a process, the addresses always change. On one run:

$ sudo gdb -p `pidof scan`
(gdb) info functions
...
0x00005598706305a8  _init
0x00005598706305d0  __stack_chk_fail@plt
0x00005598706305e0  printf@plt
0x00005598706305f0  __isoc99_scanf@plt

On another run:

0x000055813ccf65a8  _init
0x000055813ccf65d0  __stack_chk_fail@plt
0x000055813ccf65e0  printf@plt
0x000055813ccf65f0  __isoc99_scanf@plt

The file payload contains a binary payload. I know how to send file contents as input when running gdb normally (e.g. (gdb) run < payload), but not when running with an attached process.

I do not want to copy/paste these file contents into the terminal that is runningscan. I also do not want to turn off ASLR.

Things I have tried/read

I have read the gdb manual and gdb help commands:

(gdb) help
(gdb) help target
(gdb) help attach
(gdb) help obscure

Other StackOverflow questions do not ask about sending input to an attached process:

Code

My entire scan program is this:

#include <stdio.h>

int main(int argc, char **argv)
{
    char letter[1];
    char buffer[8]; 
    printf("Enter a letter: ");
    int result = scanf("%s", letter);
    printf("You entered: %s\n", letter);
}
Zion
  • 1,562
  • 13
  • 32
  • 1
    See [this anwser](https://stackoverflow.com/a/43944979/1983398) on how to enable ASLR when running with gdb. – ssbssa Jun 12 '20 at 16:59
  • 1
    That's the answer to the real question. The answer to the XY question might be to have gdb run `close(0); open("payload", O_RDONLY);` – that other guy Jun 12 '20 at 17:30
  • Simulating terminal input is best done by acting on the terminal device itself, such as by using TIOCSTI if you're on a Unix or Linux system, rather than by poking the target process. https://stackoverflow.com/a/7370822/2554472 shows a couple ways to do this. – Mark Plotnick Jun 12 '20 at 18:12

0 Answers0