fix install script, docs

Author: bata24

FAQ.md

@@ -32,6 +32,11 @@ This is the directory where gef temporarily stores files.
 Since it is used for caching, there is no problem in deleting it.
 It will be created automatically the next time gef starts.
 
+## Will this GEF work as a plugin for hugsy/gef?
+No, it doesn't work. It replaces hugsy/gef.
+However, compatibility with hugsy/gef has already been lost. You should be considered a completely different product.
+
+
 ## Will each GEF command be more accurate if I have vmlinux with debug symbols?
 No, whether vmlinux includes debug information has no effect on GEF behavior.
 GEF always uses its own resolved address with `kallsyms-remote`.
@@ -41,6 +46,15 @@ It also performs its own heuristic structure member detection in each command.
 No, GEF does not support real mode.
 Please consider using other scripts, such as [here](https://astralvx.com/debugging-16-bit-in-qemu-with-gdb-on-windows/).
 
+## Does GEF support Android?
+I've never tried it, so I don't know.
+
+I think it will work for userland debugging.
+However, Android does not use glibc, so the heap structure is different.
+Therefore, I think at least `heap` related commands will not work.
+
+Regarding kernel debugging, I haven't been able to confirm how much the structure is different.
+
 ## Is it possible to debug userland with GEF when using qemu-system?
 Partially yes. I think it can be used when you want to track before and after a system call.
 However, if KPTI is enabled, many kernel-related commands cannot be used.
@@ -121,7 +135,7 @@ The `got` command uses `objdump` internally to obtain the PLT address.
 However, with certain combinations of `binutils` and `glibc` versions, `objdump` does not display the PLT address.
 
 The currently known combinations are as follows.
-- `binutils 2.38` + `glibc 2.37 or later` (`binutils 2.38` is default of Ubuntu 22.04)
+- `binutils 2.38` (Ubuntu 22.04 default) + `glibc 2.37 or later`
 
 This problem occurs when you try to use newer glibc in an Ubuntu 22.04 environment using `patchelf` etc.
 The workaround is to build and install new `binutils` from source code.
@@ -139,7 +153,7 @@ If the mode remains switched due to an interruption during command execution, et
 Yes, you can access by `__LCO__` that means loaded command objects. For example, `pi __LCO__["vmmap"]`.
 
 ## I want to call the function in `KernelAddressHeuristicFinder` class from `python-interactive`, but the class name is too long and I often forget it.
-Yes, you can access by `KF`. For example. `pi KF.get_slab_caches()`.
+You can access by `KF`. For example, `pi KF.get_slab_caches()`.
 
 ## How can I get the instruction object?
 You can get instruction object by `pi get_insn(addr=None)`.
@@ -166,6 +180,8 @@ There are also similar functions. Here are the list.
     - `p8`, `p16`, `p32`, `p64`
     - `u8`, `u16`, `u32`, `u64`, `u128`
 
+If you want the complete list, run `gef pyobj-list`.
+
 
 # About development schedule
 
@@ -198,6 +214,8 @@ But this is a personal development, so I have the final decision. I appreciate y
 You will need a screenshot or a copy of the terminal string when the problem occurred.
 In addition, I am glad if there are the results of the `version` command and `arch-info` command.
 
+Additionally, if the issue is related to kernel debugging, please provide a set of environments (`run.sh`, `bzImage`, `rootfs`, etc.) or where to get them.
+
 ## Is it okay to fork and modify?
 Yes, however, please follow the license.
 

QEMU-USER-SUPPORTED-ARCH.md

@@ -118,7 +118,7 @@ I also list the tools I used in my Ubuntu 22.04 environment.
 * arc32 (HS38; ARCv2)
     * toolchain: `arcle-hs38--glibc--bleeding-edge-2023.08-1` from https://toolchains.bootlin.com/
     * qemu: https://github.com/foss-for-synopsys-dwc-arc-processors/qemu
-        * `./configure --target-list=arc-linux-user`.
+        * `./configure --target-list=arc-linux-user`
     * gdb: build from latest.
         * `./configure --enable-targets=all --with-python=/usr/bin/python3`
 * arc32 (HS58; ARCv3)

README.md

@@ -23,8 +23,8 @@
 This is a fork of [GEF](https://github.com/hugsy/gef).
 However, there are two major improvements.
 
-1. Added many heuristic commands for kernel debugging __WITHOUT symboled vmlinux__.
-2. Added support for [many userland architectures](https://github.com/bata24/gef/blob/dev/QEMU-USER-SUPPORTED-ARCH.md) (for qemu-user).
+1. Added many heuristic commands for kernel debugging __WITHOUT symboled vmlinux__ (for qemu-system).
+2. Added support for [many architectures](https://github.com/bata24/gef/blob/dev/QEMU-USER-SUPPORTED-ARCH.md) (for qemu-user).
 
 Many other commands have been added and improved. Enjoy!
 
@@ -114,7 +114,7 @@ See [SUPPORTED-MODE.md](https://github.com/bata24/gef/blob/dev/SUPPORTED-MODE.md
     * ![](https://raw.githubusercontent.com/bata24/gef/dev/images/v2p-p2v.png)
 * `xp`: is a shortcut for physical memory dump.
     * ![](https://raw.githubusercontent.com/bata24/gef/dev/images/xp.png)
-* `qemu-device-info`: dumps device information for qemu-escape.
+* `qemu-device-info`: dumps device information for qemu-escape (WIP).
 
 ### Qemu-system cooperation - Linux specific
 * `ksymaddr-remote`: displays kallsyms information from scanning kernel memory.
@@ -141,7 +141,7 @@ See [SUPPORTED-MODE.md](https://github.com/bata24/gef/blob/dev/SUPPORTED-MODE.md
     * Supported on x64 + SLOB + no-symbol + kASLR.
     * ![](https://raw.githubusercontent.com/bata24/gef/dev/images/slob-dump.png)
 * `slub-tiny-dump`: dumps slub-tiny free-list.
-    * Supported on x64/x86 + SLUB_TINY + no-symbol + kASLR.
+    * Supported on x64/x86 + SLUB-TINY + no-symbol + kASLR.
     * ![](https://raw.githubusercontent.com/bata24/gef/dev/images/slub-tiny-dump.png)
 * `kbase`: displays the kernel base address.
 * `kversion`: displays the debugged kernel version.
@@ -150,11 +150,11 @@ See [SUPPORTED-MODE.md](https://github.com/bata24/gef/blob/dev/SUPPORTED-MODE.md
     * ![](https://raw.githubusercontent.com/bata24/gef/dev/images/kbase-kversion-kcmdline-kcurrent.png)
 * `ktask`: displays each task address.
     * ![](https://raw.githubusercontent.com/bata24/gef/dev/images/ktask.png)
-    * It also displays the memory map of the user-land process.
+    * It also displays the memory map of the userland process.
     * ![](https://raw.githubusercontent.com/bata24/gef/dev/images/ktask-maps.png)
-    * It also displays the register values saved on kstack of the user-land process.
+    * It also displays the register values saved on kstack of the userland process.
     * ![](https://raw.githubusercontent.com/bata24/gef/dev/images/ktask-regs.png)
-    * It also displays the file descriptors of the user-land process.
+    * It also displays the file descriptors of the userland process.
     * ![](https://raw.githubusercontent.com/bata24/gef/dev/images/ktask-fd.png)
 * `kmod`: displays each module address.
     * ![](https://raw.githubusercontent.com/bata24/gef/dev/images/kmod.png)
@@ -402,11 +402,11 @@ See [SUPPORTED-MODE.md](https://github.com/bata24/gef/blob/dev/SUPPORTED-MODE.md
     * ![](https://raw.githubusercontent.com/bata24/gef/dev/images/vdso.png)
 * `vvar`: dumps the area of vvar.
     * ![](https://raw.githubusercontent.com/bata24/gef/dev/images/vvar.png)
-* `gdtinfo`: pretty prints GDT entries. If user-land, show sample entries.
+* `gdtinfo`: pretty prints GDT entries. If userland, show sample entries.
     * ![](https://raw.githubusercontent.com/bata24/gef/dev/images/gdtinfo.png)
-* `idtinfo`: pretty prints IDT entries. If user-land, show sample entries.
+* `idtinfo`: pretty prints IDT entries. If userland, show sample entries.
     * ![](https://raw.githubusercontent.com/bata24/gef/dev/images/idtinfo.png)
-* `tls`: pretty prints TLS area.
+* `tls`: pretty prints TLS area. Some architectures only support glibc.
     * ![](https://raw.githubusercontent.com/bata24/gef/dev/images/tls.png)
 * `fsbase`/`gsbase`: pretty prints `$fs_base`, `$gs_base`.
     * ![](https://raw.githubusercontent.com/bata24/gef/dev/images/fsbase_gsbase.png)
@@ -519,7 +519,7 @@ See [SUPPORTED-MODE.md](https://github.com/bata24/gef/blob/dev/SUPPORTED-MODE.md
     * ![](https://raw.githubusercontent.com/bata24/gef/dev/images/search-mangled-ptr.png)
 * `strings`: searches ASCII string from specific location.
     * ![](https://raw.githubusercontent.com/bata24/gef/dev/images/strings.png)
-* `read-system-register`: reads system register for old qemu.
+* `read-system-register`: reads system register for old qemu (ARM32 only).
     * ![](https://raw.githubusercontent.com/bata24/gef/dev/images/read-system-register.png)
 * `v8`: displays v8 tagged object.
     * ![](https://raw.githubusercontent.com/bata24/gef/dev/images/v8.png)
@@ -541,7 +541,7 @@ See [SUPPORTED-MODE.md](https://github.com/bata24/gef/blob/dev/SUPPORTED-MODE.md
     * ![](https://raw.githubusercontent.com/bata24/gef/dev/images/symbols.png)
 * `saveo`/`diffo`: saves and diffs the command outputs.
     * ![](https://raw.githubusercontent.com/bata24/gef/dev/images/saveo-diffo.png)
-* `seq-length`: detects consecutive length of the same value.
+* `seq-length`: detects consecutive length of the same sequence.
     * ![](https://raw.githubusercontent.com/bata24/gef/dev/images/seq-length.png)
 * `gef arch-list`: displays defined architecture information.
 * `gef pyobj-list`: displays defined global python object.

gef.py

@@ -52893,7 +52893,7 @@ def modify_regs(self):
 
 @register_command
 class TlsCommand(GenericCommand):
-    """Display TLS base address."""
+    """Display TLS base address. Some architectures only support glibc."""
     _cmdline_ = "tls"
     _category_ = "02-b. Process Information - Base Address"
 
@@ -54131,7 +54131,7 @@ def do_invoke(self, args):
 
 @register_command
 class SequenceLengthCommand(GenericCommand):
-    """Detect consecutive lengths of the same value."""
+    """Detect consecutive lengths of the same sequence."""
     _cmdline_ = "seq-length"
     _category_ = "03-d. Memory - Calculation"
 

install-minimal.sh

@@ -1,21 +1,29 @@
 #!/bin/sh -eux
 
 if [ ! $(id -u) = 0 ]; then
-  echo "[-] Detected non-root user, install failed."
-  exit 1
+    echo "[-] Detected non-root user."
+    echo "[-] INSTALLATION FAILED"
+    exit 1
 fi
 
 echo "[+] apt"
 apt-get update
 apt-get install -y gdb-multiarch binutils gcc file
 
 echo "[+] download gef"
-wget -q https://raw.githubusercontent.com/bata24/gef/dev/gef.py -O /root/.gdbinit-gef.py
+if [ -e /root/.gdbinit-gef.py ]; then
+    echo "[-] /root/.gdbinit-gef.py already exists. Please delete or rename."
+    echo "[-] INSTALLATION FAILED"
+    exit 1
+else
+    wget -q https://raw.githubusercontent.com/bata24/gef/dev/gef.py -O /root/.gdbinit-gef.py
+fi
 
 echo "[+] setup gef"
 STARTUP_COMMAND="source /root/.gdbinit-gef.py"
 if [ ! -e /root/.gdbinit ] || [ "x$(grep "$STARTUP_COMMAND" /root/.gdbinit)" = "x" ]; then
-  echo "$STARTUP_COMMAND" >> /root/.gdbinit
+    echo "$STARTUP_COMMAND" >> /root/.gdbinit
 fi
 
+echo "[+] INSTALLATION SUCCESSFUL"
 exit 0

install.sh

@@ -1,8 +1,9 @@
 #!/bin/sh -eux
 
 if [ ! $(id -u) = 0 ]; then
-  echo "[-] Detected non-root user, install failed."
-  exit 1
+    echo "[-] Detected non-root user."
+    echo "[-] INSTALLATION FAILED"
+    exit 1
 fi
 
 echo "[+] apt"
@@ -14,36 +15,43 @@ pip3 install crccheck unicorn capstone ropper keystone-engine tqdm
 
 echo "[+] install seccomp-tools, one_gadget"
 if [ "x$(which seccomp-tools)" = "x" ]; then
-  gem install seccomp-tools
+    gem install seccomp-tools
 fi
 
 if [ "x$(which one_gadget)" = "x" ]; then
-  gem install one_gadget
+    gem install one_gadget
 fi
 
 echo "[+] install rp++"
 if [ "x$(uname -m)" = "xx86_64" ]; then
-  if [ "x$(which rp-lin)" = "x" ] && [ ! -e /usr/local/bin/rp-lin ]; then
-    wget -q https://github.com/0vercl0k/rp/releases/download/v2.1.1/rp-lin-clang.zip -P /tmp
-    unzip /tmp/rp-lin-clang.zip -d /usr/local/bin/
-    chmod +x /usr/local/bin/rp-lin
-    rm /tmp/rp-lin-clang.zip
-  fi
+    if [ "x$(which rp-lin)" = "x" ] && [ ! -e /usr/local/bin/rp-lin ]; then
+        wget -q https://github.com/0vercl0k/rp/releases/download/v2.1.1/rp-lin-clang.zip -P /tmp
+        unzip /tmp/rp-lin-clang.zip -d /usr/local/bin/
+        chmod +x /usr/local/bin/rp-lin
+        rm /tmp/rp-lin-clang.zip
+    fi
 fi
 
 echo "[+] install vmlinux-to-elf"
 if [ "x$(which vmlinux-to-elf)" = "x" ] && [ ! -e /usr/local/bin/vmlinux-to-elf ]; then
-  pip3 install --upgrade lz4 zstandard git+https://github.com/clubby789/python-lzo@b4e39df
-  pip3 install --upgrade git+https://github.com/marin-m/vmlinux-to-elf
+    pip3 install --upgrade lz4 zstandard git+https://github.com/clubby789/python-lzo@b4e39df
+    pip3 install --upgrade git+https://github.com/marin-m/vmlinux-to-elf
 fi
 
 echo "[+] download gef"
-wget -q https://raw.githubusercontent.com/bata24/gef/dev/gef.py -O /root/.gdbinit-gef.py
+if [ -e /root/.gdbinit-gef.py ]; then
+    echo "[-] /root/.gdbinit-gef.py already exists. Please delete or rename."
+    echo "[-] INSTALLATION FAILED"
+    exit 1
+else
+    wget -q https://raw.githubusercontent.com/bata24/gef/dev/gef.py -O /root/.gdbinit-gef.py
+fi
 
 echo "[+] setup gef"
 STARTUP_COMMAND="source /root/.gdbinit-gef.py"
 if [ ! -e /root/.gdbinit ] || [ "x$(grep "$STARTUP_COMMAND" /root/.gdbinit)" = "x" ]; then
-  echo "$STARTUP_COMMAND" >> /root/.gdbinit
+    echo "$STARTUP_COMMAND" >> /root/.gdbinit
 fi
 
+echo "[+] INSTALLATION SUCCESSFUL"
 exit 0