tahaconfiant

def custom_breakpoints(debugger, command, result, internal_dict):
	target = debugger.GetSelectedTarget()
	
	breakpoint = target.BreakpointCreateByName("fork")
	breakpoint.SetScriptCallbackFunction('follow_fork_child.fork_callback')

	breakpoint = target.BreakpointCreateByName("waitpid")
	breakpoint.SetScriptCallbackFunction('follow_fork_child.waitpid_callback')

tahaconfiant

def get_child_pid(process_name, parent_pid):
	
	child_pid = 0
	
	for pid in check_output(["pgrep", process_name]).split():
		print ("found new pid: %i\n" % int(pid))
		if parent_pid == int(pid):
			continue
		elif int(pid) > parent_pid:
			child_pid = int(pid)

tahaconfiant

# by [email protected]

# LLDB custom command follow-fork-child, equivalent to GDB "follow-fork-mode child"
# tested on $lldb --version
# lldb-1100.0.30.6
# Apple Swift version 5.1.2 (swiftlang-1100.0.278 clang-1100.0.33.9)
# (lldb) script
# Python Interactive Interpreter. To exit, type 'quit()', 'exit()' or Ctrl-D.
# >>> import sys
# >>> print(sys.version)

tahaconfiant

def waitpid_callback(frame, bp_loc, dict):
	global backup_bytes
	global patch_address

	print ("waitpid() detected!")

	# let's attach to the child process: 

	# Get the current debugged process pid
	curr_target = frame.thread.process.GetTarget()

tahaconfiant

	# Let's attempt to attach to the child process
	listener = lldb.SBListener('listener')
	error = lldb.SBError()
	child = curr_target.AttachToProcessWithID(listener, child_pid, error)
	if not error.Success():
		print ("error %s\n" % error.GetCString())
		raise Exception('Failed to attach to the process.')
		assert child.IsValid()
	else:
		print ("sucessfully attached to child, with pid : %s\n" % str(child.GetProcessID()))

tahaconfiant

	# we are attached to the child, we running on the child context:
	# lets recover our backup_bytes
	print('backup_bytes recovered : 0x%x' % backup_bytes)

	# let's write the original backup_byte
	new_value = struct.pack('h', backup_bytes)
	error = lldb.SBError()
	result = child.WriteMemory(patch_address, new_value, error)
	if not error.Success() or result != len(new_value):
		print('SBProcess.WriteMemory() failed!')

tahaconfiant

# by [email protected]

# LLDB custom command follow-fork-child, equivalent to GDB "follow-fork-mode child"
# tested on $lldb --version
# lldb-1100.0.30.6
# Apple Swift version 5.1.2 (swiftlang-1100.0.278 clang-1100.0.33.9)
# (lldb) script
# Python Interactive Interpreter. To exit, type 'quit()', 'exit()' or Ctrl-D.
# >>> import sys
# >>> print(sys.version)

tahaconfiant

def waitpid_callback(frame, bp_loc, dict):
	print ("waitpid() detected!")

	# let's attach to the child process: 

	# get the current process id
	curr_target = frame.thread.process.GetTarget()
	pid = frame.thread.process.GetProcessID()
	print ("current pid is %s\n" % str(pid))
	# let get the current filename of the current target

tahaconfiant

from unicorn import *
from unicorn.x86_const import *

tahaconfiant

mu = Uc (UC_ARCH_X86, UC_MODE_64)