Allow new PE and Mach-O file formats

docs/os/pe.md

@@ -0,0 +1,48 @@
+# PE support
+
+Even though vanilla GEF was oriented around Linux executable ELF support originally, it was also built around an abstraction layer that allows other file formats and architectures via GEF-Extras.
+
+This page explains how to debug [Portable Executable](https://en.wikipedia.org/wiki/Portable_Executable) (or PE) files running on Windows or Wine/Linux.
+
+## Setup
+
+Clone GEF-Extras and
+ - either edit your `~/.gdbinit` to source the PE module
+ - execute the command directly in the prompt
+
+```text
+source /path/to/gef-extras/os/pe.py
+```
+
+This will register the PE format allowing GEF to autodetect the loading of PE. Then just load your file:
+
+```text
+
+```
+
+If you're using Wine/Linux, you can either use `winedbg --gdb` to debug directly the binary, or `winedbg --gdb --no-start` which will allow to connect remotely using `gef-remote`
+
+```text
+$ winedbg --gdb --no-start ./stackoverflow.exe
+002c:002d: create process 'C:\temp\int3.exe'/0x10900 @0x140001480 (0<0>)
+002c:002d: create thread I @0x140001480
+target remote localhost:58523
+```
+
+Then on your host:
+
+```text
+gef➤ source /dev/gef-extras/os/pe.py
+gef➤ gef-remote localhost 58523
+```
+
+*TODO: screenshot*
+
+You can freely interact with the `gef` object direct:
+
+```text
+
+```
+
+
+Most of the commands from GEF should be available, but some specific ones were desised

os/macho.py

@@ -2,58 +2,234 @@
 MachO compatibility layer
 """
 
-@lru_cache()
-def inferior_is_macho():
-    """Return True if the current file is a Mach-O binary."""
-    for x in gdb.execute("info files", to_string=True).splitlines():
-        if "file type mach-o" in x:
-            return True
-    return False
-
-
-@lru_cache()
-def is_macho(filename):
-    """Return True if the specified file is a Mach-O binary."""
-    file_bin = gef.session.constants["file"]
-    cmd = [file_bin, filename]
-    out = gef_execute_external(cmd)
-    if "Mach-O" in out:
-        return True
-    return False
-
-
-def get_mach_regions():
-    sp = gef.arch.sp
-    for line in gdb.execute("info mach-regions", to_string=True).splitlines():
-        line = line.strip()
-        addr, perm, _ = line.split(" ", 2)
-        addr_start, addr_end = [int(x, 16) for x in addr.split("-")]
-        perm = Permission.from_process_maps(perm.split("/")[0])
-
-        zone = file_lookup_address(addr_start)
-        if zone:
-            path = zone.filename
+__AUTHOR__ = "hugsy"
+__VERSION__ = 0.2
+__LICENSE__ = "MIT"
+
+
+import enum
+import pathlib
+import struct
+from typing import TYPE_CHECKING, Any, Dict, Generator, List, Optional, Tuple, Union
+
+if TYPE_CHECKING:
+    from ..scripts import *
+    from ..scripts import gdb
+
+
+class MachO(FileFormat):
+    """Basic MachO parsing."""
+
+    class Constants(enum.IntEnum):
+        MAGIC = 0xbebafeca
+        MAGIC_64 = 0xfeedfacf
+        FAT_BINARY_MAGIC = 0x0ef1fab9
+
+    class CpuType(enum.IntFlag):
+        UNKNOWN = 0
+        VAX = 1
+        ROMP = 2
+        NS32032 = 4
+        NS32332 = 5
+        I386 = 7
+        MIPS = 8
+        NS32532 = 9
+        HPPA = 11
+        ARM = 12
+        MC88000 = 13
+        SPARC = 14
+        I860 = 15
+        I860_LITTLE = 16
+        RS6000 = 17
+        POWERPC = 18
+        ABI64 = 0x1000000
+        X86_64 = ABI64 | I386
+        POWERPC64 = ABI64 | POWERPC
+        ARM64 = ABI64 | ARM
+
+    class CpuSubType(enum.IntEnum):
+        X86_ALL = 3
+        X86_64_ALL = 3
+        ARM_V7 = 9
+        ARM64_ALL = 0
+        POWERPC_ALL = 0
+
+    class FileType(enum.IntEnum):
+        OBJECT = 0x1
+        EXECUTE = 0x2
+        FVMLIB = 0x3
+        CORE = 0x4
+        PRELOAD = 0x5
+        DYLIB = 0x6
+        DYLINKER = 0x7
+        BUNDLE = 0x8
+        DYLIB_STUB = 0x9
+        DSYM = 0xa
+        KEXT_BUNDLE = 0xb
+
+    class CommandType(enum.IntEnum):
+        REQ_DYLD = 0x80000000
+        SEGMENT = 0x1
+        SYMTAB = 0x2
+        SYMSEG = 0x3
+        THREAD = 0x4
+        UNIX_THREAD = 0x5
+        LOAD_FVM_LIB = 0x6
+        ID_FVM_LIB = 0x7
+        IDENT = 0x8
+        FVM_FILE = 0x9
+        PREPAGE = 0xa
+        DYSYMTAB = 0xb
+        LOAD_DYLIB = 0xc
+        ID_DYLIB = 0xd
+        LOAD_DYLINKER = 0xe
+        ID_DYLINKER = 0xf
+        PREBOUND_DYLIB = 0x10
+        ROUTINES = 0x11
+        SUB_FRAMEWORK = 0x12
+        SUB_UMBRELLA = 0x13
+        SUB_CLIENT = 0x14
+        SUB_LIBRARY = 0x15
+        TWOLEVEL_HINTS = 0x16
+        PREBIND_CKSUM = 0x17
+        LOAD_WEAK_DYLIB = 0x80000018
+        SEGMENT_64 = 0x19
+        ROUTINES_64 = 0x1a
+        UUID = 0x1b
+        RPATH = 0x8000001c
+        CODE_SIGNATURE = 0x1d
+        SEGMENT_SPLIT_INFO = 0x1e
+        REEXPORT_DYLIB = 0x8000001f
+        LAZY_LOAD_DYLIB = 0x20
+        ENCRYPTION_INFO = 0x21
+        DYLD_INFO = 0x22
+        DYLD_INFO_ONLY = 0x80000022
+        LOAD_UPWARD_DYLIB = 0x80000023
+        VERSION_MIN_MACOSX = 0x24
+        VERSION_MIN_IPHONEOS = 0x25
+        FUNCTION_STARTS = 0x26
+        DYLD_ENVIRONMENT = 0x27
+        MAIN = 0x80000028
+        DATA_IN_CODE = 0x29
+        SOURCE_VERSION = 0x2A
+        DYLIB_CODE_SIGN_DRS = 0x2B
+        ENCRYPTION_INFO_64 = 0x2C
+        LINKER_OPTION = 0x2D
+        LINKER_OPTIMIZATION_HINT = 0x2E
+        VERSION_MIN_TVOS = 0x2F
+        VERSION_MIN_WATCHOS = 0x30
+        BUILD_VERSION = 0x32
+
+    class MachHeaderFlags(enum.IntFlag):
+        MH_NOUNDEFS = 0x00000001
+        MH_INCRLINK = 0x00000002
+        MH_DYLDLINK = 0x00000004
+        MH_BINDATLOAD = 0x00000008
+        MH_PREBOUND = 0x00000010
+        MH_SPLIT_SEGS = 0x00000020
+        MH_LAZY_INIT = 0x00000040
+        MH_TWOLEVEL = 0x00000080
+        MH_FORCE_FLAT = 0x00000100
+        MH_NOMULTIDEFS = 0x00000200
+        MH_NOFIXPREBINDING = 0x00000400
+        MH_PREBINDABLE = 0x00000800
+        MH_ALLMODSBOUND = 0x00001000
+        MH_SUBSECTIONS_VIA_SYMBOLS = 0x00002000
+        MH_CANONICAL = 0x00004000
+        MH_WEAK_DEFINES = 0x00008000
+        MH_BINDS_TO_WEAK = 0x00010000
+        MH_ALLOW_STACK_EXECUTION = 0x00020000
+        MH_ROOT_SAFE = 0x00040000
+        MH_SETUID_SAFE = 0x00080000
+        MH_NO_REEXPORTED_DYLIBS = 0x00100000
+        MH_PIE = 0x00200000
+        MH_DEAD_STRIPPABLE_DYLIB = 0x00400000
+        MH_HAS_TLV_DESCRIPTORS = 0x00800000
+        MH_NO_HEAP_EXECUTION = 0x01000000
+
+    class MachHeader:
+        magic: "MachO.Constants"
+        cputype: "MachO.CpuType"
+        cpusubtype: "MachO.CpuSubType"
+        filetype: "MachO.FileType"
+        ncmds: int
+        sizeofcmds: int
+        flags: "MachO.MachHeaderFlags"
+
+    name: str = "MachO"
+    __entry_point: Optional[int] = None
+    __checksec: Dict[str, bool]
+
+    def __init__(self, path: Union[str, pathlib.Path]) -> None:
+        """
+        References:
+        - http://www.stonedcoder.org/~kd/lib/MachORuntime.pdf
+        """
+        if isinstance(path, str):
+            self.path = pathlib.Path(path).expanduser()
+        elif isinstance(path, pathlib.Path):
+            self.path = path
         else:
-            path = "[stack]" if sp >= addr_start and sp < addr_end else ""
+            raise TypeError
+
+        if not self.path.exists():
+            raise FileNotFoundError
+
+        self.__checksec = {}
+
+        endian = gef.arch.endianness
+        with self.path.open("rb") as self.fd:
+            # TODO
+            pass
+
+        return
+
+    def __str__(self) -> str:
+        return f"{self.name}('{self.path.absolute()}')"
+
+    def seek(self, off: int) -> None:
+        self.fd.seek(off, 0)
+
+    def read_and_unpack(self, fmt: str) -> Tuple[Any, ...]:
+        size = struct.calcsize(fmt)
+        data = self.fd.read(size)
+        return struct.unpack(fmt, data)
+
+    @classmethod
+    def is_valid(cls, path: pathlib.Path) -> bool:
+        return u32(path.open("rb").read(4)) == MachO.Constants.MAGIC
 
-        yield Section(page_start=addr_start,
-                      page_end=addr_end,
-                      offset=0,
-                      permission=perm,
-                      inode=None,
-                      path=path)
-    return
+    @property
+    def checksec(self) -> Dict[str, bool]:
+        warn("Not implemented")
+        return self.__checksec
 
+    @property
+    def entry_point(self) -> int:
+        if self.__entry_point is None:
+            raise RuntimeError(
+                "MachO parsing failed to retrieve the entry point")
+        return self.__entry_point
 
-def get_process_maps():
-    return list(get_mach_regions())
+    @property
+    def sections(self) -> Generator[Section, None, None]:
+        sp = gef.arch.sp
+        for line in gdb.execute("info mach-regions", to_string=True).splitlines():
+            line = line.strip()
+            addr, perm, _ = line.split(" ", 2)
+            addr_start, addr_end = [int(x, 16) for x in addr.split("-")]
+            perm = Permission.from_process_maps(perm.split("/")[0])
 
+            zone = file_lookup_address(addr_start)
+            if zone:
+                path = zone.filename
+            else:
+                path = "[stack]" if sp >= addr_start and sp < addr_end else ""
 
-def checksec(filename):
-    return {
-        "Canary": False,
-        "NX": False,
-        "PIE": False,
-        "Fortify": False,
-        "Partial RelRO": False,
-    }
+            yield Section(page_start=addr_start,
+                          page_end=addr_end,
+                          offset=0,
+                          permission=perm,
+                          inode=None,
+                          path=path)
+        return