like-dbg - Fully dockerized Linux kernel debugging environmen

项目说明

LIKE-DBG

![Code style: black]()
![Build Status: flake8]()
![Build Status: shellcheck]()
![Build Status: hadolint]()
![codecov]()
![License: MIT]()
![GitHub Release]()

LIKE-DBG (*LI*nux-*KE*rnel-*D*e*B*u*G*ger) aims at automating the boring steps when trying to set up a Linux kernel debugging en.
I set out to dive into kernel exploitation research and found existing solutions not usable enough.
Hence, this is an attempt at making all necessary pre-steps before one can e about diving into research as painless and fun as possible.
All steps from building a kernel, running it inside an emulated en, and attaching a debugger are transparently done inside docker containers to keep system requirements minimal.
Currently, there's a dedicated docker container for every of the following steps:

Building the kernel

Creating a root file system to use with the kernel

Launching the kernel + file system as the _debuggee_

Attaching to the kernel as a _debugger_

Caveats

As this project is in its early stages, I expect things to change rapidly, while also introducing breaking changes along the way.
Major points to improve on are:

Getting towards true multi-architecture support beyond x86_64 and arm64

Extend kernel builder to not only succeed in building recent™ kernels

Add android kernel support

Add (integration) tests

Elevate the debugging experience even more

Features

On the upside, despite its early stages, a couple of useful features are already present:

General:

- Minimal host system requirements due to dockerization of every step
- An easy to grasp configs/user.ini config that allows highly customizable sessions
- Or provide different configurations for different debugging setups via the command-line!
- CTF runner that's specifically designed to handle Linux kernel exploitation challenges
- ctf/misc that houses some nifty scripts to aid in CTFs
- Code quality measures:
- black formatter for python code
- flake8 linter for all python code
- shellcheck linter for shell scripts
- hadolint linter for the Dockerfiles
- Operating system agnostic, meaning it should run just fine on:
- Debian/Ubuntu
- Arch Linux/Manjaro
- Fedora

Kernel builder:

- Multi-arch: x86_64, arm64
- Choose between gcc and clang to build the kernel
- Configuration modes:
- generic-mode,
- syzkaller-mode,
- custom-mode, or
- provide a usable kernel config
- Fine-granular control to build from:
- Commit hash
- Release tag (e.g.: 5.10-rc)
- Major-Minor-Patch (e.g.: 5.10.77)
- Ability to automatically apply patch files
- Basic ability to add custom kernel modules

Root file system builder:

- Powered by debootstrap
- Automatic generation of file system that matches the kernels architecture
- Ability to customize:
- wanted packages in the file system
- the Debian release to base e on

Debuggee:

- Powered by QEMU
- Customization of QEMU runtime options from within the configs/*.ini files.

Debugger:

- Powered by GDB (multiarch) with either
- GEF and GEF-extras, or
- pwndbg
- Allow users to specify GDB script in io/scripts/gdb_script to allow a scenario-tailored debugging experience

Requirements

To get started, you have to ensure to have the following requirements set up in your system:

docker

tmux

python>=3.11

poetry # <

It is recommended to not run this as the root user, e.g. for testing purposes on a VPS.
It may work fine but in general I highly encourage creating a dedicated non-root user to put in the docker and sudo group!

Note: If you're using a custom TMUX config, make sure that your first pane starts at 0!

Optional

This section covers tools that are _not_ required to run LIKE-DBG but are nice to have and assist heavily when debugging or writing an exploit.

musl-gcc

ctags

ropr

Setup

Inside like-dbg run poetry install

Configuration

Fine-tuning the kernel debugging experience is one of the goals of this project.
Currently, all tunable options are exposed in the two configuration files: configs/system.ini and configs/user.ini.
Some fields are recommended to not be altered as they're mainly for de reasons.
However, all the ones to customize the en to your needs should be self-explanatory as all of them are labeled with a brief comment.

Usage

Note: On first time usage run poetry install.

Once you're set with writing/adapting a configuration, the usage depends on your scenario.
The easiest way to get started, which is based on the configs/user.ini configuration is the following:

There exist 2 users for the automatically created filesystems:

root with no password

user:user

This is intended so you can develop and exploit from either perspecti.

Extended Usage

Examples

The examples subdirectory houses samples on how LIKE_DBG may aid you in specific kernel debugging tasks.
Each example contains a dedicated README.md as well that contains the necessary information to reproduce the examples.

Showcase

!img/example.png

Hacking

The python code should be quite readable, so feel free to extend the project with your own ideas. All PRs are very much welcome :)!
Otherwise, feel free to create a feature-request issue or head over to the discussions page to brainstorm some cool new features!

PS: If you want to provide a logo, feel free to do so.

项目信息

开发语言：Python

Star 数：771

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Fully dockerized Linux kernel debugging environment展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。