{"push_id":586334938,"size":42,"distinct_size":2,"ref":"refs/heads/images","head":"7ead4c425f7e29b74cdc43b83734f232463f3bdb","before":"30d5e320722e4b04dafa5cd7a5c1d4798bd51f7b","commits":[{"sha":"9226284ac933dab6d30949ea6db98e842382e34d","author":{"email":"383f9b0dca128bf833430f7fdb1f5832d008536e@gmx.de","name":"Sebastian Parschauer"},"message":"maps: remove console output\n\nWe've taken over readmaps() from \"scanmem\" but we should really\nhave no console output in library functions. So remove the output\nthere.","distinct":false,"url":"https://api.github.com/repos/sriemer/ugtrain/commits/9226284ac933dab6d30949ea6db98e842382e34d"},{"sha":"e8040fd7e1da886f1e291476d125caf9f4c115ba","author":{"email":"383f9b0dca128bf833430f7fdb1f5832d008536e@gmx.de","name":"Sebastian Parschauer"},"message":"maps: rework readmaps() according to dl_iterate_phdr()\n\nFor PIC support we must be able to read from /proc/$pid/maps from\na C library which is preloaded into the game process. The function\ndl_iterate_phdr() can't be used as it doesn't update the regions\nlist when calling it on some systems. But the idea of using a\ncallback is good.\n\nSo rework the whole maps files to use such a callback and separate\nC from C++ parts. Make readmaps() a C function again. Also replace\na lot of unclean variable/function names, move getting the exe\npath into a separate function and move the maps parsing into\nreadmaps().","distinct":false,"url":"https://api.github.com/repos/sriemer/ugtrain/commits/e8040fd7e1da886f1e291476d125caf9f4c115ba"},{"sha":"8f46996085b1b12f65583395239084d5d0ad47c5","author":{"email":"383f9b0dca128bf833430f7fdb1f5832d008536e@gmx.de","name":"Sebastian Parschauer"},"message":"maps: split maps processing in C++ from parsing in C\n\nFor PIC support we need the maps parsing in C and in a separate\nlightweight object file. So rename maps_l.cpp to maps_l.c, add\nmapscb_l.cpp and move the C++ callback function stuff to\nmapscb_l.cpp. Functionality remains exactly the same.","distinct":false,"url":"https://api.github.com/repos/sriemer/ugtrain/commits/8f46996085b1b12f65583395239084d5d0ad47c5"},{"sha":"389c6e5a6e7731783add0325f4f3454e0ed0a181","author":{"email":"383f9b0dca128bf833430f7fdb1f5832d008536e@gmx.de","name":"Sebastian Parschauer"},"message":"libmemdisc: PIC: add a library backtrace filter\n\nAt the moment there is only PIE support for filtering the backtrace\noutput to code addresses from within the executable. Now that we\nhave the PIC support in the stage 3/4 post-processing for\nunfiltered backtracing it makes sense to filter the backtrace\noutput to a single library as well.\n\nSo parse a further optional section in the discovery string to get\nthe library name. Then check in dlopen() if this library has been\nloaded. If so, iterate with read_maps() over all currently loaded\nmemory regions for libraries to get its start and end code address\nin memory. Finally set these addresses as the new backtrace filter.\n\nUse a discovery string like this:\n3[;gbt][;<lib_name>];<size>;0x0;0x0\n4[;<lib_name>];<size>;0x0;0x0","distinct":false,"url":"https://api.github.com/repos/sriemer/ugtrain/commits/389c6e5a6e7731783add0325f4f3454e0ed0a181"},{"sha":"319b9d97b0f97813eb430ffa41184b25e4a0b9d4","author":{"email":"383f9b0dca128bf833430f7fdb1f5832d008536e@gmx.de","name":"Sebastian Parschauer"},"message":"discovery: PIC: add a library backtrace filter\n\nAt the moment there is only PIE support for filtering the backtrace\noutput to code addresses from within the executable. Now that we\nhave the PIC support in the stage 3/4 post-processing for\nunfiltered backtracing it makes sense to filter the backtrace\noutput to a single library as well.\n\nSo parse a further optional section in the discovery string to get\nthe library name. Then send it as it is to libmemdisc so that it\ncan do its magic.\n\nUse a discovery string like this:\n3[;gbt][;<lib_name>];<size>;0x0;0x0\n4[;<lib_name>];<size>;0x0;0x0","distinct":false,"url":"https://api.github.com/repos/sriemer/ugtrain/commits/319b9d97b0f97813eb430ffa41184b25e4a0b9d4"},{"sha":"006c8df1816b1de0f4059a5449a6f64df904660d","author":{"email":"383f9b0dca128bf833430f7fdb1f5832d008536e@gmx.de","name":"Sebastian Parschauer"},"message":"maps: move PIE detection from discovery to here\n\nHaving the PIE detection in the discovery is unclean and may cause\ntrouble if it is required somewhere else as well. So move it to\nmaps.h where it belongs to. This introduces get_exe_offs() with the\nmemory region start as parameter.","distinct":false,"url":"https://api.github.com/repos/sriemer/ugtrain/commits/006c8df1816b1de0f4059a5449a6f64df904660d"},{"sha":"bae6c23f441bd842e2e74d05ac54970ac6ff0e99","author":{"email":"383f9b0dca128bf833430f7fdb1f5832d008536e@gmx.de","name":"Sebastian Parschauer"},"message":"libmemdisc: rework exe backtrace filtering with own PIE handling\n\nThe backtrace filtering for a library shows that it is not required\nto handle PIC/PIE and backtrace filtering externally. It is way too\ncomplex having to call \"objdump\" to get the start and the end of a\ncode region. A call to read_maps() also knows about the exe code\nregion in memory.\n\nSo remove the parsing of the start and end backtrace filter\naddresses as well as reading PIE info from a FIFO and don't send\nPIE info to the FIFO any more. Instead set the backtrace filter\nstring to \";exe\", set the bt_filter to \"\\0\", call read_maps()\nand handle PIE in its callback function set_bt_addrs() like we\nhandle PIC filter support. This simplifies the whole thing a lot.\nBy default everything becomes unfiltered.\n\nNew unfiltered discovery strings:\n3[;gbt];<size>\n4;<size>\n\nNew discovery strings with exe filter:\n3[;gbt];exe[;<heap_saddr;heap_eaddr];<size>[;<code_addr>]\n4;exe[;<heap_saddr;heap_eaddr];<size>[;<code_addr>]","distinct":false,"url":"https://api.github.com/repos/sriemer/ugtrain/commits/bae6c23f441bd842e2e74d05ac54970ac6ff0e99"},{"sha":"4fdd54cf75946b529d2bd64c4206c6b5bb769769","author":{"email":"383f9b0dca128bf833430f7fdb1f5832d008536e@gmx.de","name":"Sebastian Parschauer"},"message":"system: add sleep_msec_unless_input()\n\nFor certain situations time to sleep in seconds is too long or too\nimprecise. So introduce sleep_msec_unless_input() and calculate the\nseconds and microseconds components to sleep accordingly.","distinct":false,"url":"https://api.github.com/repos/sriemer/ugtrain/commits/4fdd54cf75946b529d2bd64c4206c6b5bb769769"},{"sha":"eace214a43e5cce201c335d9eed891c724f51f12","author":{"email":"383f9b0dca128bf833430f7fdb1f5832d008536e@gmx.de","name":"Sebastian Parschauer"},"message":"libmemdisc: handle PIE externally again\n\nOn high security systems we've noticed that the game process isn't\nalways allowed to read from /proc/$pid/maps itself. So let ugtrain\ndo that again and send the exe code start and code end as well as\nthe determined exe code offset through the FIFO.","distinct":false,"url":"https://api.github.com/repos/sriemer/ugtrain/commits/eace214a43e5cce201c335d9eed891c724f51f12"},{"sha":"d0806b238f149b3e3279087092b2f7eaa66f2968","author":{"email":"383f9b0dca128bf833430f7fdb1f5832d008536e@gmx.de","name":"Sebastian Parschauer"},"message":"libmemdisc: handle PIC externally\n\nOn high security systems we've noticed that the game process isn't\nalways allowed to read from /proc/$pid/maps itself. So let ugtrain\ndo that and send the library code start and code end through the\nFIFO.\n\nBut attention: It is possible that the same library is loaded\nmultiple times. So store a backup of the code address for backtrace\nfiltering before adding the code start of the library to it. Also\ndelay the activation until ugtrain sends a message that it is ready\nto handle PIC. Otherwise we might miss library load messages.\nSearch for the library in the maps before sending the notification\nin form of a library backtrace filter. The library might be loaded\nearly and doesn't appear in dlopen() this way. Send unfiltered if\nit can't be found.\n\nTested against btanks 0.9.8083-4 on Ubuntu 14.04 x86_64 with the\nmissiles of the own tank (starting at 15) with discovery commands:\n\n$ ugtrain -D \"2\" -S btanks\n$ ugtrain -D \"4;1008\" -S btanks\n$ ugtrain -D \"4;exe;1008\" -S btanks\n$ ugtrain -D \"4;libbt_objects.so;1008\" btanks\n$ ugtrain -D \"4;libbt_objects.so;1008\" -S btanks\n$ ugtrain -D \"4;libbt_objects.so;1008;0x36b75\" -S btanks\n$ ugtrain -D \"3;gbt;libbt_objects.so;1008\" -S btanks\n$ ugtrain -D \"3;gbt;libbt_objects.so;1008;0x36b75\" -S btanks\n\nThe libbt_objects.so gets loaded twice with _Znwm() at 0x36b75.\n\nEarly library load has been tested with chromium-bsu 0.9.15.1-1:\n\n$ ugtrain -D \"4;libstdc++.so.6.0.19;288\" chromium-bsu64\n$ ugtrain -D \"4;libstdc++.so.6.0.19;288\" -S chromium-bsu64","distinct":false,"url":"https://api.github.com/repos/sriemer/ugtrain/commits/d0806b238f149b3e3279087092b2f7eaa66f2968"},{"sha":"5a8a5ae64d94888bc660b08c11410d39b6781db1","author":{"email":"383f9b0dca128bf833430f7fdb1f5832d008536e@gmx.de","name":"Sebastian Parschauer"},"message":"README: update to current state and add doc links\n\nIt makes sense having links to the other documentation files. So\nadd them. Document that ugtrain is the best Linux game trainer and\nthat it has ASLR/PIE as well as discovery PIC support.","distinct":false,"url":"https://api.github.com/repos/sriemer/ugtrain/commits/5a8a5ae64d94888bc660b08c11410d39b6781db1"},{"sha":"c2e5f4bb1e1987a8aa0afb11fbec4815a47d0592","author":{"email":"383f9b0dca128bf833430f7fdb1f5832d008536e@gmx.de","name":"Sebastian Parschauer"},"message":"doc: dynmem: update hacking and discovery to current state\n\nThere is still the libmemhack config in static memory mentioned\nbut everything is stored on the heap now. So update that. The PIC\nsupport for the discovery has changed a lot. So document the new\nbehavior. Use PIE for the Chromium B.S.U. example as PIE is the\ndefault now on most Linux systems.","distinct":false,"url":"https://api.github.com/repos/sriemer/ugtrain/commits/c2e5f4bb1e1987a8aa0afb11fbec4815a47d0592"},{"sha":"ffb3e58673bf56f790d35c6f333ad3a895829988","author":{"email":"383f9b0dca128bf833430f7fdb1f5832d008536e@gmx.de","name":"Sebastian Parschauer"},"message":"adapt: common: remove the '-e' option from echo\n\nUsing the dash on Ubuntu instead of the bash causes the '-e' option\nof 'echo' to be printed. We don't need it. So remove it.\nThis only affects debugging output of the adaption scripts.\n\nFixes: 83a5456564d8 (\"adapt: get rid of bashism\")","distinct":false,"url":"https://api.github.com/repos/sriemer/ugtrain/commits/ffb3e58673bf56f790d35c6f333ad3a895829988"},{"sha":"08edaa78cdde54663083113700b6f20a306a45d4","author":{"email":"383f9b0dca128bf833430f7fdb1f5832d008536e@gmx.de","name":"Sebastian Parschauer"},"message":"README: add further limitations\n\nE.g. testing is limited to manual tests on Debian/Ubuntu\ndistributions. This is why we need testers and test developers.","distinct":false,"url":"https://api.github.com/repos/sriemer/ugtrain/commits/08edaa78cdde54663083113700b6f20a306a45d4"},{"sha":"c3e9d6b265dbd48b66ab6be7c53a20c73f654d60","author":{"email":"383f9b0dca128bf833430f7fdb1f5832d008536e@gmx.de","name":"Sebastian Parschauer"},"message":"TODO: enhance and update to current state\n\nThere is so much stuff to do: testing, demoing, improve dumping,\nenhancing PIC support, adding global config processing, fixing glc\npulseaudio support, fixing patchelf,...\n\nThere is enough for possible contributors to pick from.","distinct":false,"url":"https://api.github.com/repos/sriemer/ugtrain/commits/c3e9d6b265dbd48b66ab6be7c53a20c73f654d60"},{"sha":"3fcfd22c1ad4c01ff68b2286ff0860ea8a219e66","author":{"email":"383f9b0dca128bf833430f7fdb1f5832d008536e@gmx.de","name":"Sebastian Parschauer"},"message":"README: add a link to the development TODOs","distinct":false,"url":"https://api.github.com/repos/sriemer/ugtrain/commits/3fcfd22c1ad4c01ff68b2286ff0860ea8a219e66"},{"sha":"c2a8ec7877fd2bd53571d400245a1871fc5e8e9f","author":{"email":"383f9b0dca128bf833430f7fdb1f5832d008536e@gmx.de","name":"Sebastian Parschauer"},"message":"dump: store a backup if a dump file exists\n\nRenaming the just created dump files manually to dump and compare\nwith a new state of a memory object is cumbersome.\n\nSo do that automatically. \"<name>.dump\" becomes \"<name>~.dump\" for\nbeing sorted before the new state. Old backup files are overwritten\nfor always keeping two states.","distinct":false,"url":"https://api.github.com/repos/sriemer/ugtrain/commits/c2a8ec7877fd2bd53571d400245a1871fc5e8e9f"},{"sha":"72b6a5ce73af5d6d65724978a087fba8f2f72e72","author":{"email":"383f9b0dca128bf833430f7fdb1f5832d008536e@gmx.de","name":"Sebastian Parschauer"},"message":"doc: rename dumps as text and add them in binary format\n\nWith the new dumping method storing the old state automatically it\nmakes sense to name dumps like this. Also the possibility to use a\nbinary diff tool like VBinDiff should be given.","distinct":false,"url":"https://api.github.com/repos/sriemer/ugtrain/commits/72b6a5ce73af5d6d65724978a087fba8f2f72e72"},{"sha":"713ddc68ab56a1849b5f8f267b82ddc952d238ab","author":{"email":"383f9b0dca128bf833430f7fdb1f5832d008536e@gmx.de","name":"Sebastian Parschauer"},"message":"doc: dynmem: update for new memory object dump\n\nThe example dump files have different names now. So update the\ndocumentation to reflect that.","distinct":false,"url":"https://api.github.com/repos/sriemer/ugtrain/commits/713ddc68ab56a1849b5f8f267b82ddc952d238ab"},{"sha":"ee9290892707ff7ae5e0ec50874dbc81d446c813","author":{"email":"383f9b0dca128bf833430f7fdb1f5832d008536e@gmx.de","name":"Sebastian Parschauer"},"message":"doc: dynmem: replace \"we\" and short forms\n\nThe documentation is an advice how to do things. So the \"you\" form\nis better. Documentation also often doesn't contain short forms\nlike \"doesn't\", \"you've\", \"don't\", ... So use the long forms.","distinct":false,"url":"https://api.github.com/repos/sriemer/ugtrain/commits/ee9290892707ff7ae5e0ec50874dbc81d446c813"}]}