From dc4b0692a91d1f6937d6a2825494c63f022435f4 Mon Sep 17 00:00:00 2001
From: Dan <46821332+nsadeveloper789@users.noreply.github.com>
Date: Wed, 15 Jan 2025 11:47:36 -0500
Subject: [PATCH 1/2] GP-5263: Update Debugger GhidraClass
---
.../TutorialDebuggerScreenShots.java | 16 ++++++++-
.../Debugger/A1-GettingStarted.html | 34 +++++++++++++-----
.../GhidraClass/Debugger/A1-GettingStarted.md | 15 ++++++--
.../GhidraClass/Debugger/A2-UITour.html | 5 ++-
GhidraDocs/GhidraClass/Debugger/A2-UITour.md | 1 +
.../GhidraClass/Debugger/A3-Breakpoints.html | 12 +++++--
.../GhidraClass/Debugger/A3-Breakpoints.md | 6 +++-
.../GhidraClass/Debugger/A4-MachineState.html | 13 +++++--
.../GhidraClass/Debugger/A4-MachineState.md | 9 +++--
.../GhidraClass/Debugger/B2-Emulation.html | 5 ++-
.../GhidraClass/Debugger/B2-Emulation.md | 4 +--
.../GhidraClass/Debugger/B3-Scripting.html | 17 ++++-----
.../GhidraClass/Debugger/B3-Scripting.md | 6 ++--
.../images/GettingStarted_LaunchGDBDialog.png | Bin 16333 -> 17288 bytes
.../MemoryMap_StaticMappingAfterLaunch.png | Bin 21901 -> 22607 bytes
.../RemoteTargets_GdbPlusGdbserverViaSsh.png | Bin 23692 -> 27095 bytes
.../images/RemoteTargets_GdbViaSsh.png | Bin 19608 -> 23736 bytes
17 files changed, 102 insertions(+), 41 deletions(-)
diff --git a/Ghidra/Test/DebuggerIntegrationTest/src/screen/java/ghidraclass/debugger/screenshot/TutorialDebuggerScreenShots.java b/Ghidra/Test/DebuggerIntegrationTest/src/screen/java/ghidraclass/debugger/screenshot/TutorialDebuggerScreenShots.java
index 3afc608b8d..b978acc640 100644
--- a/Ghidra/Test/DebuggerIntegrationTest/src/screen/java/ghidraclass/debugger/screenshot/TutorialDebuggerScreenShots.java
+++ b/Ghidra/Test/DebuggerIntegrationTest/src/screen/java/ghidraclass/debugger/screenshot/TutorialDebuggerScreenShots.java
@@ -34,6 +34,7 @@ import docking.action.DockingActionIf;
import docking.widgets.fieldpanel.FieldPanel;
import generic.Unique;
import generic.jar.ResourceFile;
+import ghidra.GhidraTestApplicationLayout;
import ghidra.app.cmd.disassemble.DisassembleCommand;
import ghidra.app.context.ProgramLocationActionContext;
import ghidra.app.decompiler.component.DecompilerPanel;
@@ -109,6 +110,7 @@ import ghidra.util.Msg;
import ghidra.util.exception.CancelledException;
import ghidra.util.task.ConsoleTaskMonitor;
import help.screenshot.GhidraScreenShotGenerator;
+import utility.application.ApplicationLayout;
public class TutorialDebuggerScreenShots extends GhidraScreenShotGenerator
implements AsyncTestUtils {
@@ -145,6 +147,18 @@ public class TutorialDebuggerScreenShots extends GhidraScreenShotGenerator
}
};
+ @Override
+ protected ApplicationLayout createApplicationLayout() throws IOException {
+ return new GhidraTestApplicationLayout(new File(getTestDirectoryPath())) {
+ @Override
+ protected Set
termmines in a terminal outside of Ghidra with the
desired command-line parameters.termmines.attach 1234.
+TIP: In later exercises, you may use the +Reset button to re-populate the default value for the +Image field. Be sure to change Run +Command back to “start”, though.
+If the Model window is blank, check for a “noname” +tab in the Dynamic Listing, and click it.
+If the Model window seems incomplete after +attaching, check that its Filter box is cleared.
+read you have completed this exercise. Quit GDB from the
Terminal before proceeding to the next module: A Tour of the UI
If you get Operation not permitted or similar when
trying to attach, it is likely your Linux system is configured with
diff --git a/GhidraDocs/GhidraClass/Debugger/A1-GettingStarted.md b/GhidraDocs/GhidraClass/Debugger/A1-GettingStarted.md
index 47c6dbfb15..3d2968c1a1 100644
--- a/GhidraDocs/GhidraClass/Debugger/A1-GettingStarted.md
+++ b/GhidraDocs/GhidraClass/Debugger/A1-GettingStarted.md
@@ -219,15 +219,24 @@ when using Trace RMI.
Note this technique is only possible because the target waits for input.
1. Run `termmines` in a terminal outside of Ghidra with the desired command-line parameters.
-1. In the Ghidra Debugger, use the **Launch** button drop-down and select **Configured and Launch termmines using... → raw gdb**.
- The "raw" connector will give us a GDB session without a target.
+1. In the Ghidra Debugger, use the **Launch** button drop-down and select **Configure and Launch termmines using... → gdb**.
+1. Clear the **Image** field to configure a GDB session without a target.
1. Ghidra needs to know the location of gdb and the architecture of the intended target.
The defaults are correct for 64-bit x86 targets using the system's copy of GDB.
- Probably, you can just click **Launch**.
+1. Click **Launch**.
1. In the **Model** window (to the left), expand the *Available* node.
1. In the filter box, type `termmines`.
1. Right click on the node and select **Attach**, or, if you prefer, note the PID, e.g. 1234, then in the **Terminal** type, e.g., `attach 1234`.
+**TIP**: In later exercises, you may use the **Reset** button to re-populate the default value for the **Image** field.
+Be sure to change **Run Command** back to "start", though.
+
+### Troubleshooting
+
+If the **Model** window is blank, check for a "noname" tab in the Dynamic Listing, and click it.
+
+If the **Model** window seems incomplete after attaching, check that its Filter box is cleared.
+
## Exercise: Attach
Try attaching on your own, if you have not already.
diff --git a/GhidraDocs/GhidraClass/Debugger/A2-UITour.html b/GhidraDocs/GhidraClass/Debugger/A2-UITour.html
index 797c932b50..4835a64152 100644
--- a/GhidraDocs/GhidraClass/Debugger/A2-UITour.html
+++ b/GhidraDocs/GhidraClass/Debugger/A2-UITour.html
@@ -312,7 +312,10 @@ forward a single instruction each time you press it. Also notice that
the Static Listing moves with the Dynamic Listing. You may navigate in
either listing, and so long as there is a corresponding location in the
other, the two will stay synchronized. You may also open the Decompiler
-just as you would in the CodeBrowser, and it will stay in sync too.
When you have clicked
Step Into a sufficient number of
times, you should end up in a subroutine. You can click K on the keyboard, or
double-click its icon in the margin.
ENTER.ENTER. For GDB, this must be done from the
+top-level Breakpoints node, not the one subordinate to the
+inferior.
If it seems nothing has changed, except now you have a second program -database open, then the new module may not be successfully mapped.
+database open, then the new module may not be successfully mapped. Try +one or more of the following:libc is the current program (tab) in the
Static Listing.libc to complete. Yeah, it
+may take a moment, but auto-mapping is queued as a background task, and
+so it cannot map things until auto-analysis is done.libc, and select
Map Module to libc. (Names and titles will likely
differ.)termmines session.
Write a program that takes a seed from the user and prints a diagram
of the first game board with the mines indicated. Optionally, have it
print each subsequent game board when the user presses
-ENTER. Check your work by re-launching
+ENTER. Check your work by re-launching
termmines, capturing its seed, inputting it into your
program, and then winning the game. Optionally, win 2 more games in the
same session.
Track
-Location button, or you can double-click the sp = [Address]
-label in the top right of the Dynamic Listing.
+Location button, or you can double-click the “sp = …” label in the top
+right of the Dynamic Listing.
To examine a more complicated stack segment, we will break at
rand. Ensure your breakpoint at rand is
enabled and press
Resume.
@@ -295,6 +295,13 @@ section of termmines in the Static Listing, the Dynamic
Listing will follow along showing you the live values in memory. You can
also experiment by placing code units in the Dynamic Listing before
committing to them in the Static Listing.
NOTE: There’s a known issue with auto-seek obtruding +user navigation in the listings. In most cases, just navigating again +will make it stick. If it becomes a real annoyance, set the +Auto-Track drop-down in the top right of the Dynamic +Listing to Do Not Track while you’re doing static RE. +Be sure to put it back to Track Program Counter when +you are done.
main, you could use
href="../../../Ghidra/Features/Decompiler/src/main/doc/sleigh.xml">Sleigh
documentation.
Sleigh is a bit unconventional in that its operators are typed rather -than its variables. All variables are fix-length bit vectors. Their +than its variables. All variables are fixed-length bit vectors. Their sizes are specified in bytes, but they have no other type information.
Stubbing any remaining external calls is left as an exercise. You are
-successful when the emulator crashes with
-pc = 00000000.
Clear or disable your breakpoint and invalidate the emulator cache again before proceeding to the next technique.
RET. As with the
CALL override technique, you must now invalidate the
emulator cache and resume. Stubbing any remaining external functions is
left as an exercise. You are successful when the emulator crashes with
-pc = 00000000.
+“pc = 00000000”.
<
protected void run() throws Exception {
}
}
-NOTE: The scripting API has been refactored a little -since the transition from Recorder-based to TraceRmi-based targets. -Parts of the API that are back-end agnostic are accessible from the +
NOTE: The scripting API has been refactored since
+the transition from Recorder-based to TraceRmi-based targets. Parts of
+the API that are back-end agnostic are accessible from the
FlatDebuggerAPI interface. Parts of the API that require a
-specific back end are in FlatDebuggerRmiAPI and
-FlatDebuggerRecorderAPI, the latter of which is deprecated.
-If a script written for version 11.0.2 or prior is not compiling, it can
-most likely be patched up by changing
-implements FlatDebuggerAPI to
-implements FlatDebuggerRecorderAPI, but we recommend
-porting it to use implements FlatDebuggerRmiAPI.
FlatDebuggerRmiAPI. The old
+FlatDebuggerRecorderAPI was removed in Ghidra 11.3, and
+scripts needing it should be ported to
+FlatDebuggerRmiAPI.
Technically, the Debugger’s “deep” API is accessible to scripts;
however, the flat API is preferred for scripting. Also, the flat API is
usually more stable than the deep API. However, because the dynamic
diff --git a/GhidraDocs/GhidraClass/Debugger/B3-Scripting.md b/GhidraDocs/GhidraClass/Debugger/B3-Scripting.md
index 1cc75193e3..bd54ccfbcc 100644
--- a/GhidraDocs/GhidraClass/Debugger/B3-Scripting.md
+++ b/GhidraDocs/GhidraClass/Debugger/B3-Scripting.md
@@ -24,10 +24,10 @@ public class DemoDebuggerScript extends GhidraScript implements FlatDebuggerAPI
}
```
-**NOTE**: The scripting API has been refactored a little since the transition from Recorder-based to TraceRmi-based targets.
+**NOTE**: The scripting API has been refactored since the transition from Recorder-based to TraceRmi-based targets.
Parts of the API that are back-end agnostic are accessible from the `FlatDebuggerAPI` interface.
-Parts of the API that require a specific back end are in `FlatDebuggerRmiAPI` and `FlatDebuggerRecorderAPI`, the latter of which is deprecated.
-If a script written for version 11.0.2 or prior is not compiling, it can most likely be patched up by changing `implements FlatDebuggerAPI` to `implements FlatDebuggerRecorderAPI`, but we recommend porting it to use `implements FlatDebuggerRmiAPI`.
+Parts of the API that require a specific back end are in `FlatDebuggerRmiAPI`.
+The old `FlatDebuggerRecorderAPI` was removed in Ghidra 11.3, and scripts needing it should be ported to `FlatDebuggerRmiAPI`.
Technically, the Debugger's "deep" API is accessible to scripts; however, the flat API is preferred for scripting.
Also, the flat API is usually more stable than the deep API.
diff --git a/GhidraDocs/GhidraClass/Debugger/images/GettingStarted_LaunchGDBDialog.png b/GhidraDocs/GhidraClass/Debugger/images/GettingStarted_LaunchGDBDialog.png
index cb344c8936964a1701405cb72e6b5d30e4363b37..2d4dbd089d8c250d98ba2c7fcd4dbea1d493fe29 100644
GIT binary patch
literal 17288
zcmcJ%1yqz<-#0vnh=8D=fV7BoiNGK&jdYi^NQabkDBU96-Cfd*f^-TD9nvY?`R!5f
zbDuk&_kGs4zR$JJaly t*t!r(+dTy_28q;`vVIWEF)NDvMt*?QrR`-<`CgZzcdJnj4=Z0
z=5UxY6#ziHF^8-2+?~y8;|BcfjhzootlTWm+adw8(h|y1QY{M5@0u+t(abk)S*t^?
zP*Z?t4C53&`<=G`h5a3Iui?xs#c|B-A~X?}tpcx)@vY|-%eKT8i)DBaU9dlDwZ?zF
z&hC;lmJSpSo|jQ8;D5*su4r2Q?wUBWes4HHBkHd#kYzaw=VcHAZcnq1&5*T~c1xCV
zV1jkha#L4>SV$LxBqJUPD@kz`j0~Ba?6*;Wq4xU{43(XWt7nxXjg=$1x+|wVwd13Y
zHp#VH3Bw~MJXlZbUtpT{*EMfEspO>ex1=*jzah>Iq$U$M9$3=ich?x4;KOWSbIO33
zVr>4%;nvL^Pk?PPXKM1z(^o4W0psZR@m!vB?sW#pQoNtLY2v*@KY)aAsL&0h$i1l=a`rJe8
ex
qX*G7iqrn|Nqp*^dm_hIHSYN?|H^Xj&MI&TEl(
z450d$oyT6vxzECsl#-a?0asvrFNPY|i^!rY(P>LIno10)<04~xPAPt{oH}(MDN3^3
z)WEbJzm;`Eln`6-xvH{Z)snj9UhA;4xxzQ6-IgwbiY{laxN~E22^!$>^*+m)ymX5hnwVD4#1j?svJ1~m$NdM
zX8HyILO1T8d_GKAl;23?IM_e6_pH^g4yPU^ZTNCO^Wc#-YROS6ktc8jF?IIS^sv0E
z6wX_bbj(WY+AF}__-j6I-a_QVX6|-euPUo&rr<~K#<>$>gs-W%drJf?b*w|TRB9Rf%wWHvDy9)2I6+q;ocbJTxsQ;oK-9&qxoQ+>1xBmaFS|VKp*N9^Yp@0<(PdRI{Ij{
zs!H~fTf}>hj!XF