{"action":"created","issue":{"url":"https://api.github.com/repos/hugsy/gef/issues/291","repository_url":"https://api.github.com/repos/hugsy/gef","labels_url":"https://api.github.com/repos/hugsy/gef/issues/291/labels{/name}","comments_url":"https://api.github.com/repos/hugsy/gef/issues/291/comments","events_url":"https://api.github.com/repos/hugsy/gef/issues/291/events","html_url":"https://github.com/hugsy/gef/issues/291","id":336477951,"node_id":"MDU6SXNzdWUzMzY0Nzc5NTE=","number":291,"title":"coredump when catching exec","user":{"login":"zrlw","id":40652892,"node_id":"MDQ6VXNlcjQwNjUyODky","avatar_url":"https://avatars1.githubusercontent.com/u/40652892?v=4","gravatar_id":"","url":"https://api.github.com/users/zrlw","html_url":"https://github.com/zrlw","followers_url":"https://api.github.com/users/zrlw/followers","following_url":"https://api.github.com/users/zrlw/following{/other_user}","gists_url":"https://api.github.com/users/zrlw/gists{/gist_id}","starred_url":"https://api.github.com/users/zrlw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zrlw/subscriptions","organizations_url":"https://api.github.com/users/zrlw/orgs","repos_url":"https://api.github.com/users/zrlw/repos","events_url":"https://api.github.com/users/zrlw/events{/privacy}","received_events_url":"https://api.github.com/users/zrlw/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-06-28T05:30:38Z","updated_at":"2018-06-28T05:46:55Z","closed_at":null,"author_association":"NONE","body":"1. ENV\r\nOperating System: SuSE Enterprise 12 SP 2\r\nArchitecture: x86-64\r\nGNU gdb (GDB; SUSE Linux Enterprise 12) 7.11.1 \r\nPython 2.7.9\r\n\r\n2. Problem\r\ncoredump when catching exec\r\n\r\n3. Steps to reproduce:\r\n$ cat t.c\r\n#include <stdio.h>\r\n#include <string.h>\r\n#include <unistd.h>\r\nmain()\r\n{\r\n  printf(\"my pid=%d, gdb attach me!\\n\", getpid());\r\n  sleep(20);\r\n  char* exec_args[]={\"/usr/bin/ls\", \"ppp\", NULL};\r\n  execve(exec_args[0], exec_args, NULL);\r\n}\r\n$ gcc -g t.c -o t\r\n$ ./t\r\nmy pid=12139, gdb attach me!\r\n\r\nStart a new shell:\r\n$ gdb\r\nattach 12139 \r\nContinuing.\r\nprocess 12158 is executing new program: /usr/bin/ls\r\n[New process 12158]\r\n\r\nThread 2.1 \"ls\" hit Catchpoint 1 (exec'd /usr/bin/ls), 0x00007f34959f3150 in _start () from /lib64/ld-linux-x86-64.so.2\r\n[ Legend: Modified register | Code | Heap | Stack | String ]\r\n-----------------------------------------------------------------------------------[ registers ]----\r\n$rax   : 0xffffffffffffffda\r\n$rbx   : 0x0000000000000000\r\n$rcx   : 0x0000000000000000\r\n$rdx   : 0x0000000000000000\r\n$rsp   : 0x00007ffc97b33a90 -> 0x0000000000000002\r\n$rbp   : 0x0000000000000000\r\n$rsi   : 0x0000000000000000\r\n$rdi   : 0x0000000000000000\r\n$rip   : 0x00007f34959f3150 -> 0x00003618e8e78948\r\n$r8    : 0x0000000000000000\r\n$r9    : 0x0000000000000000\r\n$r10   : 0x0000000000000000\r\n$r11   : 0x0000000000000000\r\n$r12   : 0x0000000000000000\r\n$r13   : 0x0000000000000000\r\n$r14   : 0x0000000000000000\r\n$r15   : 0x0000000000000000\r\n$eflags: [carry parity adjust zero sign trap INTERRUPT direction overflow resume virtualx86 identification]\r\n$ss: 0x002b  $es: 0x0000  $gs: 0x0000  $cs: 0x0033  $fs: 0x0000  $ds: 0x0000  \r\n---------------------------------------------------------------------------------------[ stack ]----\r\n0x00007ffc97b33a90|+0x00: 0x0000000000000002    <-$rsp\r\n0x00007ffc97b33a98|+0x08: 0x00007ffc97b34fdc -> \"/usr/bin/ls\"\r\n0x00007ffc97b33aa0|+0x10: 0x00007ffc97b34fe8 -> 0x7273752f00707070 (\"ppp\"?)\r\n0x00007ffc97b33aa8|+0x18: 0x0000000000000000\r\n0x00007ffc97b33ab0|+0x20: 0x0000000000000000\r\n0x00007ffc97b33ab8|+0x28: 0x0000000000000021 (\"!\"?)\r\n0x00007ffc97b33ac0|+0x30: 0x00007ffc97bc3000 -> 0x00010102464c457f\r\n0x00007ffc97b33ac8|+0x38: 0x0000000000000010\r\n----------------------------------------------------------------------------[ code:i386:x86-64 ]----\r\n   0x7f34959f3140 <update_get_addr+55> rex.XB or BYTE PTR [r11-0x3d], bl\r\n   0x7f34959f3144                  nop    WORD PTR cs:[rax+rax*1+0x0]\r\n   0x7f34959f314e                  xchg   ax, ax\r\n->0x7f34959f3150 <_start+0>       mov    rdi, rsp\r\n   0x7f34959f3153 <_start+3>       call   0x7f34959f6770 <_dl_start>\r\n   0x7f34959f3158 <_dl_start_user+0> mov    r12, rax\r\n   0x7f34959f315b <_dl_start_user+3> mov    eax, DWORD PTR [rip+0x21fc6f]        # 0x7f3495c12dd0 <_dl_skip_args>\r\n   0x7f34959f3161 <_dl_start_user+9> pop    rdx\r\n   0x7f34959f3162 <_dl_start_user+10> lea    rsp, [rsp+rax*8]\r\n-------------------------------------------------------------------------------------[ threads ]----\r\nAborted (core dumped)"},"comment":{"url":"https://api.github.com/repos/hugsy/gef/issues/comments/400917782","html_url":"https://github.com/hugsy/gef/issues/291#issuecomment-400917782","issue_url":"https://api.github.com/repos/hugsy/gef/issues/291","id":400917782,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMDkxNzc4Mg==","user":{"login":"zrlw","id":40652892,"node_id":"MDQ6VXNlcjQwNjUyODky","avatar_url":"https://avatars1.githubusercontent.com/u/40652892?v=4","gravatar_id":"","url":"https://api.github.com/users/zrlw","html_url":"https://github.com/zrlw","followers_url":"https://api.github.com/users/zrlw/followers","following_url":"https://api.github.com/users/zrlw/following{/other_user}","gists_url":"https://api.github.com/users/zrlw/gists{/gist_id}","starred_url":"https://api.github.com/users/zrlw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zrlw/subscriptions","organizations_url":"https://api.github.com/users/zrlw/orgs","repos_url":"https://api.github.com/users/zrlw/repos","events_url":"https://api.github.com/users/zrlw/events{/privacy}","received_events_url":"https://api.github.com/users/zrlw/received_events","type":"User","site_admin":false},"created_at":"2018-06-28T05:46:55Z","updated_at":"2018-06-28T05:46:55Z","author_association":"NONE","body":"missing some code after gdb:\r\n$ gdb\r\n attach 12139\r\ncatch exec\r\nset follow-exec-mode new\r\nc"}}
{"actor":{"display_login":"zrlw"}}