{"action":"created","issue":{"url":"https://api.github.com/repos/pwndbg/pwndbg/issues/85","repository_url":"https://api.github.com/repos/pwndbg/pwndbg","labels_url":"https://api.github.com/repos/pwndbg/pwndbg/issues/85/labels{/name}","comments_url":"https://api.github.com/repos/pwndbg/pwndbg/issues/85/comments","events_url":"https://api.github.com/repos/pwndbg/pwndbg/issues/85/events","html_url":"https://github.com/pwndbg/pwndbg/issues/85","id":161037192,"number":85,"title":"Exception when attaching to QEMU gdb stub","user":{"login":"int0x80","id":1061032,"avatar_url":"https://avatars.githubusercontent.com/u/1061032?v=3","gravatar_id":"","url":"https://api.github.com/users/int0x80","html_url":"https://github.com/int0x80","followers_url":"https://api.github.com/users/int0x80/followers","following_url":"https://api.github.com/users/int0x80/following{/other_user}","gists_url":"https://api.github.com/users/int0x80/gists{/gist_id}","starred_url":"https://api.github.com/users/int0x80/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/int0x80/subscriptions","organizations_url":"https://api.github.com/users/int0x80/orgs","repos_url":"https://api.github.com/users/int0x80/repos","events_url":"https://api.github.com/users/int0x80/events{/privacy}","received_events_url":"https://api.github.com/users/int0x80/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":11,"created_at":"2016-06-18T18:24:43Z","updated_at":"2016-06-20T13:17:46Z","closed_at":"2016-06-20T13:09:17Z","body":"Thanks for all your work on this project.  I'm having trouble attaching to a process suspended by QEMU with a gdb stub.  The specific target is the `stack_bof_01` binary in the [DVRF](https://github.com/praetorian-inc/DVRF) project.  The DVRF setup process was followed as per the [Getting Started](https://www.praetorian.com/blog/getting-started-with-damn-vulnerable-router-firmware-dvrf-v0.1) blog post; while the `pwndbg` setup process was followed as per @ctfhacker's [EpicTreasure](https://github.com/ctfhacker/EpicTreasure) `et_setup.sh`.\r\n\r\nThe target is started as follows: \r\n\r\n```\r\n$ sudo chroot . ./qemu-mipsel-static -g 1234 /pwnable/Intro/stack_bof_01 AAAA\r\n```\r\n\r\nWhen attaching with gdb, `auxv.py` raises a `TypeError` exception.\r\n\r\n```\r\n$ gdb\r\nLoaded 92 commands.  Type pwndbg for a list.\r\npwndbg> target remote 127.0.0.1:1234\r\nRemote debugging using 127.0.0.1:1234\r\n0x00000000 in ?? ()\r\nTraceback (most recent call last):\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/events.py\", line 107, in caller\r\n    func()\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/stack.py\", line 76, in update\r\n    page  = pwndbg.memory.Page(start, stop-start, 6 if not is_executable() else 7, 0, '[stack]')\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/stack.py\", line 122, in is_executable\r\n    ehdr         = pwndbg.elf.exe()\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/proc.py\", line 60, in wrapper\r\n    return func(*a, **kw)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/elf.py\", line 52, in exe\r\n    return load(entry())\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/proc.py\", line 60, in wrapper\r\n    return func(*a, **kw)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/elf.py\", line 60, in entry\r\n    entry = pwndbg.auxv.get().AT_ENTRY\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/auxv.py\", line 103, in get\r\n    return use_info_auxv() or walk_stack() or AUXV()\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/auxv.py\", line 154, in walk_stack\r\n    if not auxv['AT_EXECFN']:\r\nTypeError: 'NoneType' object is not subscriptable\r\nPython Exception <class 'TypeError'> 'NoneType' object is not subscriptable: \r\nTraceback (most recent call last):\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/events.py\", line 107, in caller\r\n    func()\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/stack.py\", line 122, in is_executable\r\n    ehdr         = pwndbg.elf.exe()\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/proc.py\", line 60, in wrapper\r\n    return func(*a, **kw)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/elf.py\", line 52, in exe\r\n    return load(entry())\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/proc.py\", line 60, in wrapper\r\n    return func(*a, **kw)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/elf.py\", line 60, in entry\r\n    entry = pwndbg.auxv.get().AT_ENTRY\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/auxv.py\", line 103, in get\r\n    return use_info_auxv() or walk_stack() or AUXV()\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/auxv.py\", line 154, in walk_stack\r\n    if not auxv['AT_EXECFN']:\r\nTypeError: 'NoneType' object is not subscriptable\r\nPython Exception <class 'TypeError'> 'NoneType' object is not subscriptable: \r\nTraceback (most recent call last):\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/events.py\", line 107, in caller\r\n    func()\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/symbol.py\", line 215, in add_main_exe_to_symbols\r\n    exe  = pwndbg.elf.exe()\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/proc.py\", line 60, in wrapper\r\n    return func(*a, **kw)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/elf.py\", line 52, in exe\r\n    return load(entry())\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/proc.py\", line 60, in wrapper\r\n    return func(*a, **kw)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/elf.py\", line 60, in entry\r\n    entry = pwndbg.auxv.get().AT_ENTRY\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/auxv.py\", line 103, in get\r\n    return use_info_auxv() or walk_stack() or AUXV()\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/auxv.py\", line 154, in walk_stack\r\n    if not auxv['AT_EXECFN']:\r\nTypeError: 'NoneType' object is not subscriptable\r\nPython Exception <class 'TypeError'> 'NoneType' object is not subscriptable: \r\nTraceback (most recent call last):\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/events.py\", line 107, in caller\r\n    func()\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/vmmap.py\", line 39, in get\r\n    pages.extend(info_auxv())\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/vmmap.py\", line 303, in info_auxv\r\n    auxv = pwndbg.auxv.get()\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/auxv.py\", line 103, in get\r\n    return use_info_auxv() or walk_stack() or AUXV()\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/auxv.py\", line 154, in walk_stack\r\n    if not auxv['AT_EXECFN']:\r\nTypeError: 'NoneType' object is not subscriptable\r\nPython Exception <class 'TypeError'> 'NoneType' object is not subscriptable: \r\n```\r\n\r\nIf I wrap the offending lines with a simple `try` and `except`, like so\r\n\r\n```python\r\n    try:\r\n      if not auxv['AT_EXECFN']:\r\n          auxv['AT_EXECFN'] = get_execfn()\r\n\r\n    except:\r\n      pass\r\n```\r\n\r\nI receive a different set of errors:\r\n\r\n```\r\n$ gdb\r\nLoaded 92 commands.  Type pwndbg for a list.\r\npwndbg> target remote 127.0.0.1:1234\r\nRemote debugging using 127.0.0.1:1234\r\n0x00000000 in ?? ()\r\nTraceback (most recent call last):\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/events.py\", line 107, in caller\r\n    func()\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/stack.py\", line 76, in update\r\n    page  = pwndbg.memory.Page(start, stop-start, 6 if not is_executable() else 7, 0, '[stack]')\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/stack.py\", line 122, in is_executable\r\n    ehdr         = pwndbg.elf.exe()\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/proc.py\", line 60, in wrapper\r\n    return func(*a, **kw)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/elf.py\", line 52, in exe\r\n    return load(entry())\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/proc.py\", line 60, in wrapper\r\n    return func(*a, **kw)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/elf.py\", line 80, in entry\r\n    return pwndbg.symbol.get(name)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/symbol.py\", line 158, in get\r\n    if address < pwndbg.memory.MMAP_MIN_ADDR or address >= ((1 << 64)-1):\r\nTypeError: unorderable types: str() < int()\r\nPython Exception <class 'TypeError'> unorderable types: str() < int(): \r\nTraceback (most recent call last):\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/events.py\", line 107, in caller\r\n    func()\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/stack.py\", line 122, in is_executable\r\n    ehdr         = pwndbg.elf.exe()\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/proc.py\", line 60, in wrapper\r\n    return func(*a, **kw)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/elf.py\", line 52, in exe\r\n    return load(entry())\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/proc.py\", line 60, in wrapper\r\n    return func(*a, **kw)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/elf.py\", line 80, in entry\r\n    return pwndbg.symbol.get(name)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/symbol.py\", line 158, in get\r\n    if address < pwndbg.memory.MMAP_MIN_ADDR or address >= ((1 << 64)-1):\r\nTypeError: unorderable types: str() < int()\r\nPython Exception <class 'TypeError'> unorderable types: str() < int(): \r\nTraceback (most recent call last):\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/events.py\", line 107, in caller\r\n    func()\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/symbol.py\", line 215, in add_main_exe_to_symbols\r\n    exe  = pwndbg.elf.exe()\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/proc.py\", line 60, in wrapper\r\n    return func(*a, **kw)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/elf.py\", line 52, in exe\r\n    return load(entry())\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/proc.py\", line 60, in wrapper\r\n    return func(*a, **kw)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/elf.py\", line 80, in entry\r\n    return pwndbg.symbol.get(name)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/symbol.py\", line 158, in get\r\n    if address < pwndbg.memory.MMAP_MIN_ADDR or address >= ((1 << 64)-1):\r\nTypeError: unorderable types: str() < int()\r\nPython Exception <class 'TypeError'> unorderable types: str() < int(): \r\nTraceback (most recent call last):\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/events.py\", line 107, in caller\r\n    func()\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/stack.py\", line 76, in update\r\n    page  = pwndbg.memory.Page(start, stop-start, 6 if not is_executable() else 7, 0, '[stack]')\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/stack.py\", line 122, in is_executable\r\n    ehdr         = pwndbg.elf.exe()\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/proc.py\", line 60, in wrapper\r\n    return func(*a, **kw)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/elf.py\", line 52, in exe\r\n    return load(entry())\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/proc.py\", line 60, in wrapper\r\n    return func(*a, **kw)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/elf.py\", line 80, in entry\r\n    return pwndbg.symbol.get(name)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/memoize.py\", line 44, in __call__\r\n    value = self.func(*args, **kwargs)\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/symbol.py\", line 158, in get\r\n    if address < pwndbg.memory.MMAP_MIN_ADDR or address >= ((1 << 64)-1):\r\nTypeError: unorderable types: str() < int()\r\nPython Exception <class 'TypeError'> unorderable types: str() < int(): \r\n```\r\n\r\nNot sure whether it's helpful, but here is some diagnostic info about my VM.\r\n\r\n```\r\n$ python3 -V\r\nPython 3.5.1+\r\n\r\n$ python2 -V\r\nPython 2.7.11+\r\n\r\n$ cat /etc/lsb-release \r\nDISTRIB_ID=Ubuntu\r\nDISTRIB_RELEASE=16.04\r\nDISTRIB_CODENAME=xenial\r\nDISTRIB_DESCRIPTION=\"Ubuntu 16.04 LTS\"\r\n\r\n$ uname -r\r\n4.4.0-24-generic\r\n```\r\n\r\nPlease let me know how I can help further in debugging this issue."},"comment":{"url":"https://api.github.com/repos/pwndbg/pwndbg/issues/comments/227139128","html_url":"https://github.com/pwndbg/pwndbg/issues/85#issuecomment-227139128","issue_url":"https://api.github.com/repos/pwndbg/pwndbg/issues/85","id":227139128,"user":{"login":"int0x80","id":1061032,"avatar_url":"https://avatars.githubusercontent.com/u/1061032?v=3","gravatar_id":"","url":"https://api.github.com/users/int0x80","html_url":"https://github.com/int0x80","followers_url":"https://api.github.com/users/int0x80/followers","following_url":"https://api.github.com/users/int0x80/following{/other_user}","gists_url":"https://api.github.com/users/int0x80/gists{/gist_id}","starred_url":"https://api.github.com/users/int0x80/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/int0x80/subscriptions","organizations_url":"https://api.github.com/users/int0x80/orgs","repos_url":"https://api.github.com/users/int0x80/repos","events_url":"https://api.github.com/users/int0x80/events{/privacy}","received_events_url":"https://api.github.com/users/int0x80/received_events","type":"User","site_admin":false},"created_at":"2016-06-20T13:17:45Z","updated_at":"2016-06-20T13:17:45Z","body":"Hah, you're right.  I did have one run with a hiccup:\r\n\r\n```\r\npwndbg> set endian little \r\nThe target is assumed to be little endian\r\npwndbg> set architecture mips\r\nThe target architecture is assumed to be mips\r\npwndbg> target remote 127.0.0.1:1234\r\nRemote debugging using 127.0.0.1:1234\r\n0x767b9a80 in ?? ()\r\nTraceback (most recent call last):\r\n  File \"/home/int0x80/tools/pwndbg/pwndbg/events.py\", line 107, in caller\r\n    func()\r\n```\r\n\r\nBut now it seems to be working.  Notice in the run above that we're at `0x767b9a80` instead of the previous value of `0x00000000`.  Either way it seems to be working now.\r\n\r\nI've updated my install of Binjitsu so should be good to go.  Thanks so much for all your help."}}
{"actor":{"display_login":"int0x80"}}