Skip to content

Return address out of maps #194

@danmaam

Description

@danmaam

When doing finish() inside a callback, libdebug crashes saying "return address out of maps" in certain situations. I attach the environment to reproduce the bug.

root@5d80ccb21f45:/dump/output# python3 new_libdebug_dumper.py 
Traceback (most recent call last):
  File "/usr/local/lib/python3.12/dist-packages/libdebug/state/thread_context.py", line 153, in saved_ip
    return_address = stack_unwinder.get_return_address(self, self._internal_debugger.maps)
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/dist-packages/libdebug/architectures/amd64/amd64_stack_unwinder.py", line 98, in get_return_address
    raise ValueError("Return address not in memory maps.")
ValueError: Return address not in memory maps.

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/dump/output/new_libdebug_dumper.py", line 46, in <module>
    d.wait()
  File "/usr/local/lib/python3.12/dist-packages/libdebug/debugger/debugger.py", line 97, in wait
    self._internal_debugger.wait()
  File "/usr/local/lib/python3.12/dist-packages/libdebug/utils/debugger_wrappers.py", line 73, in inner
    return method(self, *args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/dist-packages/libdebug/debugger/internal_debugger.py", line 496, in wait
    self._join_and_check_status()
  File "/usr/local/lib/python3.12/dist-packages/libdebug/debugger/internal_debugger.py", line 1444, in _join_and_check_status
    raise response
  File "/usr/local/lib/python3.12/dist-packages/libdebug/debugger/internal_debugger.py", line 1421, in __polling_thread_function
    return_value = command(*args)
                   ^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/dist-packages/libdebug/debugger/internal_debugger.py", line 1523, in __threaded_wait
    self.debugging_interface.wait()
  File "/usr/local/lib/python3.12/dist-packages/libdebug/ptrace/ptrace_interface.py", line 485, in wait
    self.status_handler.manage_change(statuses)
  File "/usr/local/lib/python3.12/dist-packages/libdebug/ptrace/ptrace_status_handler.py", line 466, in manage_change
    self._handle_change(pid, status, result)
  File "/usr/local/lib/python3.12/dist-packages/libdebug/ptrace/ptrace_status_handler.py", line 431, in _handle_change
    self._internal_signal_handler(pid, signum, results, status)
  File "/usr/local/lib/python3.12/dist-packages/libdebug/ptrace/ptrace_status_handler.py", line 371, in _internal_signal_handler
    self._handle_breakpoints(pid)
  File "/usr/local/lib/python3.12/dist-packages/libdebug/ptrace/ptrace_status_handler.py", line 116, in _handle_breakpoints
    bp.callback(thread, bp)
  File "/dump/output/new_libdebug_dumper.py", line 12, in malloc_callback
    t.finish()
  File "/usr/local/lib/python3.12/dist-packages/libdebug/state/thread_context.py", line 335, in finish
    self._internal_debugger.finish(self, heuristic=heuristic)
  File "/usr/local/lib/python3.12/dist-packages/libdebug/utils/debugger_wrappers.py", line 72, in inner
    return alias_method(self, *args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/dist-packages/libdebug/debugger/internal_debugger.py", line 1160, in _background_finish
    self.__threaded_finish(thread, heuristic)
  File "/usr/local/lib/python3.12/dist-packages/libdebug/debugger/internal_debugger.py", line 1567, in __threaded_finish
    self.debugging_interface.finish(thread, heuristic=heuristic)
  File "/usr/local/lib/python3.12/dist-packages/libdebug/ptrace/ptrace_interface.py", line 346, in finish
    last_saved_instruction_pointer = thread.saved_ip
                                     ^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/dist-packages/libdebug/state/thread_context.py", line 155, in saved_ip
    raise ValueError(
ValueError: Failed to get the return address. Check stack frame registers (e.g., base pointer).

To launch the environment do

docker build . -f ./Dockerfile-Libdebug -t exim-container-libdebug
docker run --privileged -it -v ./new_dumper:/dump -p 21:21 exim-container-libdebug:latest bash

attachment.zip

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No fields configured for Bug.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions