Repository: pwndbg/pwndbg

Issue:
GOT command returns wrong addresses
Running on latest dev version

Issue found running binary with PIE enabled, ASLR disabled, NO RELRO
Running the `got` command returns wrong addresses for the GOT.
I think it may have something to do with there only being two mapped regions for the binary, rather than 3 as usual. 

Example from below: The real `settbuf@GOT` address is `0x56559cb4`. `got` command says it is `0x5655acb4`. A 0x1000 (exact size of memory page) offset

Virtual memory mapping (while running)
![image](https://user-images.githubusercontent.com/30163540/44911954-0ebada80-ad6c-11e8-9cfc-1273246d9532.png)


Running the GOT command whilst the program is running causes an error as the heap isn't initialized yet.
![image](https://user-images.githubusercontent.com/30163540/44911983-298d4f00-ad6c-11e8-9e53-9ae87e3fe2cb.png)


Running GOT command returns addresses in the heap data region. (this was taken after heap was initialised)

![image](https://user-images.githubusercontent.com/30163540/44911888-d6b39780-ad6b-11e8-8f43-08eb7df1a084.png)

Memory mapping after heap initialised. The GOT addresses above point into the heap.
![image](https://user-images.githubusercontent.com/30163540/44912232-dd8eda00-ad6c-11e8-8a30-2ec70930a70a.png)




Discussion:
Gonna fix it in a few days
Any updates?
@adamtanana No; but I will look at this today or tomorrow.
@adamtanana Can you provide ur binary or a minimal [not] working example?

It seems everything works fine for this:
```c
//usr/bin/gcc -Wl,-z,norelro main.c; exit
#include <stdio.h>

void foo() {} // easy breakpointz

int main() {
    puts("Hello world");
    foo();
}
```

When I am stopped/breakpointed on `foo`:
```
Breakpoint foo
pwndbg> got

GOT protection: No RELRO | GOT functions: 1
 
[0x555555754a80] puts@GLIBC_2.2.5 -> 0x7ffff7a649c0 (puts) ◂— push   r13
pwndbg> vmmap
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
    0x555555554000     0x555555555000 r-xp     1000 0      /playground/pwndbg_got_problem/a.out
    0x555555754000     0x555555755000 rw-p     1000 0      /playground/pwndbg_got_problem/a.out
    0x555555755000     0x555555776000 rw-p    21000 0      [heap]
    0x7ffff79e4000     0x7ffff7bcb000 r-xp   1e7000 0      /lib/x86_64-linux-gnu/libc-2.27.so
    0x7ffff7bcb000     0x7ffff7dcb000 ---p   200000 1e7000 /lib/x86_64-linux-gnu/libc-2.27.so
    0x7ffff7dcb000     0x7ffff7dcf000 r--p     4000 1e7000 /lib/x86_64-linux-gnu/libc-2.27.so
    0x7ffff7dcf000     0x7ffff7dd1000 rw-p     2000 1eb000 /lib/x86_64-linux-gnu/libc-2.27.so
    0x7ffff7dd1000     0x7ffff7dd5000 rw-p     4000 0      
    0x7ffff7dd5000     0x7ffff7dfc000 r-xp    27000 0      /lib/x86_64-linux-gnu/ld-2.27.so
    0x7ffff7fcf000     0x7ffff7fd1000 rw-p     2000 0      
    0x7ffff7ff7000     0x7ffff7ffa000 r--p     3000 0      [vvar]
    0x7ffff7ffa000     0x7ffff7ffc000 r-xp     2000 0      [vdso]
    0x7ffff7ffc000     0x7ffff7ffd000 r--p     1000 27000  /lib/x86_64-linux-gnu/ld-2.27.so
    0x7ffff7ffd000     0x7ffff7ffe000 rw-p     1000 28000  /lib/x86_64-linux-gnu/ld-2.27.so
    0x7ffff7ffe000     0x7ffff7fff000 rw-p     1000 0      
    0x7ffffffdd000     0x7ffffffff000 rw-p    22000 0      [stack]
0xffffffffff600000 0xffffffffff601000 r-xp     1000 0      [vsyscall]
pwndbg> p puts
$1 = {int (const char *)} 0x7ffff7a649c0 <_IO_puts>
pwndbg> search -p 0x7ffff7a649c0
a.out           0x555555754a80 0x7ffff7a649c0
warning: Unable to access 16000 bytes of target memory at 0x7ffff7bd2d07, halting search.
```
@adamtanana bump? :(

EDIT: @adamtanana sent me a binary through email and posted here about that, but I deleted personal info from here.
FYI, you can attach any file to GitHub by renaming it to e.g. `.jpg` and drag / drop it on the comment box.
@zachriggle thx for editing @adamtanana post and removing my e-mail (it can be found on the internet, but it's better to keep it at one place, not many :P). But github lets people see post edits, so I removed the post.

The binary [remove `.zip` from its name]:
[sploitwarz.zip](https://github.com/pwndbg/pwndbg/files/2398895/sploitwarz.zip)


Resolving patch:
diff --git a/pwndbg/commands/got.py b/pwndbg/commands/got.py
--- a/pwndbg/commands/got.py
+++ b/pwndbg/commands/got.py
@@ -33,7 +33,7 @@ def got(name_filter=''):
         return
 
     if "PIE enabled" in pie_status:
-        bin_text_base = pwndbg.memory.page_align(pwndbg.elf.entry())
+        bin_text_base = pwndbg.vmmap.find(pwndbg.elf.entry()).start
 
     relro_color = message.off
     if 'Partial' in relro_status:
diff --git a/pwndbg/memory.py b/pwndbg/memory.py
--- a/pwndbg/memory.py
+++ b/pwndbg/memory.py
@@ -359,7 +359,7 @@ def find_lower_boundary(addr, max_pages=1024):
             if addr < 0:
                 break
     except gdb.MemoryError:
-        pass
+        addr += pwndbg.memory.PAGE_SIZE
     return addr
 
 


Test patch: