comsecuris / gdbghidra

gdbghidra - a visual bridge between a GDB session and GHIDRA

gdbghidra - a visual bridge between a GDB session and GHIDRA

The purpose of gdbghidra is to provide means during interactive debug sessions in gdb to quickly follow the flow in GHIDRA; similar to our gdbida plugin for IDA Pro. gdbghidra is not meant to be a full debugger. Instead, it merely serves as a small helper tool to assist during interactive debug sessions that make use of a mixture of tools. It provides simple means to quickly follow along a gdb debug session in GHIDRA. Also it does not need any dependencies on the Python side.

gdbghidra consists of the following two parts:

• dist/ghidra_9.0.1_PUBLIC_*_GDBGHIDRA.zip
• data/gdb_ghidra_bridge_client.py : gdb python script

Features

• Sync/colorize cursor inside GHIDRA to PC of GDB session
• Sync stack to GHIDRA on GDB break
• Automatically set register values within GHIDRA for better decompilation
• GHIDRA register window
• Set/Toggle/Delete breakpoints from GHIDRA
• Automatic relocation

Installation

Make a change the ~/.gdbinit configuration file to include the plugin:

source ~/gdb_ghidra_bridge_client.py

To install the plugin in GHIDRA follow these steps:

• Open GHIDRA and select File/Install Extensions.
• Press the green + button and select dist/ghidra_9.0.1_PUBLIC_*_GDBGHIDRA.zip.
• Make sure the Plugin has a tick in the box left.
• Start GHIDRA CodeBrowser.
• Open File/Configure and press the adapter icon in above left oft 'Ghidra Core'.
• Filter for gdb and make sure GDBGhidraPlugin is enabled.

Now you should see the GDBGhidraPlugin window. You can now configure the listener port using the configuration button and start the server using the refresh button.

Next, configure the gdb stub to connect to gdbghidras's port (either command line or gdbinit):

ghidrabridge 10.0.10.10:2305

Building

To build this plugin using gradle run the following command inside gdbghidra directory

gradle -PGHIDRA_INSTALL_DIR=<PATH_TO_GHIDRA_FOLDER>

This produces a fresh extension zip within the gdbghidra/dist folder.

Development

If you want to build gdbghidra from source using GHIDRA's eclipse environment make sure to add json-simple-1.1.1.jar to the classpath as follows:

• Click the Run Menu and select Run Configurations.
• Navigate to Ghidra/GDBGhidra and select Classpath.
• Navigate down the list to User Entries, select User Entries and click on ADD JARS....
• Select lib/json-simple-1.1.1.jar

Between GHIDRA and GDB a simple JSON message format is spoken which could also be used to connect other tools/debuggers to this GHIDRA plugin.

Notes

Please be aware that this is not considered to be finished. Specifically, the following thoughts are on my mind:

• Network listening input masks untested for errors.
• The network connection is not authenticated in any way.
• A lot of potential for additional commands. For now, I kept it super simple.

gdbghidra's Issues

Broken breakpoints are sent by server if no cursor event has been received from client

GDBReceiver.relocate is initialized as 0, and used as a base in

gdbghidra/src/main/java/gdbghidra/GDBReceiver.java

Line 195 in c817839

var response = BreakpointEvent.constructJSONResponse(this.relocate + address.subtract(currentProgram.getImageBase()), "toggle");

when a breakpoint is set. If no cursor event is received that updates .relocate prior to toggling a breakpoint, the address sent to GDB will be wrong.

Ghidra Version: https://github.com/NationalSecurityAgency/ghidra/tree/adedcde30f893fe3f48291f15866aed05df04fc9
gdbghidra Version: c817839

ubuntu ghidra doesn't work

I use gdbghidra in ghidra 9.0.4 2019-May-16(with jdk 11) on Ubuntu 18.04.
open gdbghidra port on 2305.
Gdb script run without error.
But CodeBrowser doesn't follow gdb.

GhidtraBridgeCommand.__init__ connects the bridge instead of invoke

For some reason, the GhidraBridgeCommand __init__ method creates the bridge and sends the first message instead of invoke meaning that the host and port are always the defaults, and that it always attempts to connect the bridge when the script is sourced instead of when the command is run.

Building with Gradle Fails

Hello -

I followed the instructions outlined in README.md, and tried to build this for Ghidra version 10.0.4, which I have an active project in. I get the following error and cannot seem to build this.

$pwd
/opt/gdbghidra

$gradle -PGHIDRA_INSTALL_DIR=/opt/ghidra
FAILURE: Build failed with an exception.

* Where:
Script '/opt/ghidra/support/buildExtension.gradle' line: 80

* What went wrong:
A problem occurred evaluating script.
> Could not set unknown property 'archiveBaseName' for task ':buildExtension' of type org.gradle.api.tasks.bundling.Zip.

* Try:
Run with --stacktrace option to get the stack trace. Run with --info or --debug option to get more log output. Run with --scan to get full insights.

* Get more help at https://help.gradle.org

BUILD FAILED in 0s

Specs:
OS: Ubuntu 20.04.3 LTS
Ghidra Version: 10.0.4 PUBLIC 2021-Sep-28 1538 EDT
Java:

 openjdk 17.0.1 2021-10-19
 OpenJDK Runtime Environment (build 17.0.1+12-Ubuntu-120.04)
 OpenJDK 64-Bit Server VM (build 17.0.1+12-Ubuntu-120.04, mixed mode, sharing)

Gradle:

Gradle 4.4.1
Build time:   2012-12-21 00:00:00 UTC
Revision:     none
Groovy:       2.4.17
Ant:          Apache Ant(TM) version 1.10.7 compiled on October 24 2019
JVM:          11.0.13 (Ubuntu 11.0.13+8-Ubuntu-0ubuntu1.20.04)
OS:           Linux 5.4.0-91-generic amd64

Any ideas what I'm doing wrong / how I could get gdbghidra built for 10.0.4?

Thanks!

Lyell

System.out.print logging, where is the output?

Hi, I'm trying to debug an issue with this on Ghidra 9.1, and I can't figure out where logging output goes.

gdbghidra/src/main/java/gdbghidra/GDBReceiver.java

Line 108 in 139627a

System.out.println("[GDBGhidra] received message: " + String.valueOf(msgBuffer.length()) + " bytes: '" + msgBuffer + "'\n");

E.g., for a line like above.

Ghidra maps stdout/stderr to /dev/null, so I'm not sure what's going on here.

Any help would be appreciated, thanks!

remote target causes python exceptions

In order to work with a remote target (such as a device with openocd), it was necessary to stub out the relocation and mappings methods. Otherwise python would throw an exception that "Can't determine the current process's PID: you must name one". As a quick hack I patched around it, but perhaps there is a better way:

diff --git a/data/gdb_ghidra_bridge_client.py b/data/gdb_ghidra_bridge_client.py
index f2bb7a9..e9a0f5f 100755
--- a/data/gdb_ghidra_bridge_client.py
+++ b/data/gdb_ghidra_bridge_client.py
@@ -297,6 +297,8 @@ class GhidraBridgeCommand(gdb.Command):
 class GDBUtils:
     @staticmethod
     def get_relocation():
+        if True:
+            return "0x0"
         r = GDBUtils.query_gdb('info proc stat', 'relocation', 'Start of text: ', 'End of text: ')
         if r == "unknown":
             return "0x0"
@@ -356,6 +358,8 @@ class GDBUtils:
 
     @staticmethod
     def get_mapping(named):
+        if True:
+            return None
         m = GDBUtils.query_gdb("info proc mappings", "mappings")
         if "unable to open" in m:
             return None

Cannot build (Ghidra 9.1)

Hello, I want to build gdbghidra to use it with Ghidra 9.1-BETA, unfortunately, I got this error message :

Can you help me ?

Incompatible with Ghidra V 9.1.2

Seems like the latest build is incompatible with Ghidra's 2020-Feb-12 release.

Build failed for ghidra 9.1

Gradle version: 6.0.1
Ghidra version: 9.1 (2019-OCT-23 1737 EDT)

output:

$ gradle -PGHIDRA_INSTALL_DIR=/usr/share/ghidra

Task :compileJava FAILED
/home/fabio/src/gdb% gradle -PGHIDRA_INSTALL_DIR=/usr/share/ghidra

Task :compileJava FAILED
/home/fabio/src/gdbghidra/src/main/java/gdbghidra/GDBReceiver.java:46: error: cannot access Address
import ghidra.program.model.address.Address;
^
bad class file: /usr/share/ghidra/Ghidra/Framework/SoftwareModeling/lib/SoftwareModeling.jar(ghidra/program/model/address/Address.class)
class file has wrong version 55.0, should be 52.0
Please remove or make sure it appears in the correct subdirectory of the classpath.

FAILURE: Build failed with an exception.

• What went wrong:
  Execution failed for task ':compileJava'.
  ghidra/src/main/java/gdbghidra/GDBReceiver.java:46: error: cannot access Address
  import ghidra.program.model.address.Address;
  ^
  bad class file: /usr/share/ghidra/Ghidra/Framework/SoftwareModeling/lib/SoftwareModeling.jar(ghidra/program/model/address/Address.class)
  class file has wrong version 55.0, should be 52.0
  Please remove or make sure it appears in the correct subdirectory of the classpath.

FAILURE: Build failed with an exception.

• What went wrong:
  Execution failed for task ':compileJava'.

"Space named [stack] already exists!" on Ghidra 9.1.2

On https://github.com/NationalSecurityAgency/ghidra/tree/adedcde30f893fe3f48291f15866aed05df04fc9 (newest commit as of the time of this issue being opened) the plugin crashes when the gdb client sends the stack information:

Uncaught Exception! 
RuntimeException - ghidra.util.exception.DuplicateNameException: Space named [stack] already exists!
java.lang.RuntimeException: ghidra.util.exception.DuplicateNameException: Space named [stack] already exists!
	at ghidra.app.util.MemoryBlockUtils.createInitializedBlock(MemoryBlockUtils.java:303)
	at gdbghidra.events.MemoryEvent.handleEvent(MemoryEvent.java:104)
	at gdbghidra.GDBReceiver.handleConnection(GDBReceiver.java:134)
	at gdbghidra.GDBReceiver.run(GDBReceiver.java:79)
	at java.base/java.lang.Thread.run(Thread.java:834)
Caused by: ghidra.util.exception.DuplicateNameException: Space named [stack] already exists!
	at ghidra.program.model.address.DefaultAddressFactory.addAddressSpace(DefaultAddressFactory.java:380)
	at ghidra.program.database.ProgramAddressFactory.addOverlayAddressSpace(ProgramAddressFactory.java:113)
	at ghidra.program.database.ProgramDB.addOverlaySpace(ProgramDB.java:1325)
	at ghidra.program.database.mem.MemoryMapDB.createOverlaySpace(MemoryMapDB.java:469)
	at ghidra.program.database.mem.MemoryMapDB.createInitializedBlock(MemoryMapDB.java:490)
	at ghidra.app.util.MemoryBlockUtils.createInitializedBlock(MemoryBlockUtils.java:298)
	... 4 more