peda | PEDA - Python Exploit Development Assistance for GDB | Hacking library

the p tag is a block display element that's why the "show more" starts at new line, try changing it to span, I tried it on developer tools and it worked.

Let's look at the LOAD segments:

Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
LOAD 0x000000 0x08048000 0x08048000 0x0009d 0x0009d R E 0x1000
LOAD 0x00009d 0x0804909d 0x0804909d 0x00010 0x00010 RW 0x1000

The first one instructs the loader to mmap 0x9d bytes from file offset 0 into virtual memory at address 0x08048000.

The loader can't do exactly that, because memory mapping only works at one page (4096 bytes) granularity. So it mmaps the .text, and everything that follows it in the file, up to one page, at address 0x08048000.

This means that whatever .data followed .text in the file after offset 0x9d will appear at address 0x0804809d and later, but with wrong permissions (Read and Execute).

The second LOAD segment instructs the loader to mmap file contents, starting at offset 0x9d at virtual address 0x0804909d.

The loader can't do exactly that either for the same "page granularity" reason.

Instead, it will round down the offset and the address, and mmap file contents starting from offset 0 at address 0x08049000.

That that means that whatever .text preceded .data in the file will appear at address before 0x0804909d, again with the wrong permissions (Read and Write this time).

You can confirm that that's what's happening by using GDB x/10i 0x8049080 -- you will see exactly the same instructions as with x/10i 0x8048080.

You can also observe the actual mmap system calls the loader performed with strace.

Debugging with gdb confirms the data is contiguous with the code at run time and readelf analysis of the program confirms the data segment is writeable.

You are expecting db '...' to immediately follow CALL one.

That does not actually happen, your .data section is in a different segment (because it needs different permissions):

If you want to examine a CPython symbol table, use the symtable module. What you're doing doesn't make sense.

Assuming you're actually looking at PySTEntry_Type and not some completely unrelated section of virtual memory, what you're looking at is the type object for low-level symbol table entry objects. This thing is to symbol table entries as int is to 12. It does not represent a symbol table or a symbol table entry. It contains information about the operations symbol table entries support.

CPython does not preserve symbol tables beyond the bytecode compilation phase. You cannot examine the symbol tables for a running program, because they don't exist. You can use symtable to create symbol tables for a string representing Python code.

I was expecting base_with_signal_offset = base_with_puts_offset = 0xf7dd8000

There are 3 numbers in your calculation:

That's because Python by default encodes strings by sys.stdout.encoding before writing the bytes. You can directly write bytes to sys.stdout.buffer to avoid encoding:

You can use aggregation:

I assume you forgot to link with --omagic to make the .text section writable.

So mov BYTE PTR ds:0x804807f,ah segfaults, and it's right before aeskeygenassist. You can't keep single-stepping after your program crashes. (You have no handler for SIGSEGV, and the default action is to terminate your program).

When I tried this on my desktop out of curiosity, I can imagine interpreting the behaviour as single-stepping getting "stuck" before aeskeygenassist, if I ignore the segfault message!!! and the fact that trying again says "the program is no longer running".

From a GDB session:

You have compiled your code for a 64-bit target machine, so you are seeing 64-bit registers. To use 32-bit registers, as ECX, you must compile your code with the -m32 flag.