gdb – access to memory

September 14th, 2006 mysurface Posted in Developer, gdb | Hits: 13893 | No Comments »

This might be a bit technical, I ll try to explain in a simple way.

Gdb is a debugging tool in linux environment. To get into debug a program call a.out

gdb a.out

Usually you want to set a break point at main function, so we can start to debug from the first entry point.

break main

Next you would like to run the program,

run

If you program accept parameters, you can do so

run 1 2 3

This is equivalent to ./a.out 1 2 3

Now you can start to access to the memory, first check where you are

where

output:

#0  0x080483b4 in main ()

You can see the hex value of the main by doing this

x main
0x80483b4 :       0x04244c8d

If you want to see the instruction in assembly

x/i main
0x80483b4 :       lea    0x4(%esp),%ecx

You want more line instead of a single line

x/20i main
0x80483b4 :    lea    0x4(%esp),%ecx
0x80483b8 :    and    $0xfffffff0,%esp
0x80483bb :    pushl  0xfffffffc(%ecx)
0x80483be :    push   %ebp
0x80483bf :    mov    %esp,%ebp
0x80483c1 :    push   %ecx
0x80483c2 :    sub    $0x44,%esp
0x80483c5 :    mov    0x4(%ecx),%eax
0x80483c8 :    add    $0x4,%eax
0x80483cb :    mov    (%eax),%eax
0x80483cd :    mov    %eax,0x4(%esp)
0x80483d1 :    lea    0xffffffde(%ebp),%eax
0x80483d4 :    mov    %eax,(%esp)
0x80483d7 :    call   0x8048300 <__gmon_start__@plt+16>
0x80483dc :    lea    0xffffffe8(%ebp),%eax
0x80483df :    mov    %eax,0x8(%esp)
0x80483e3 :    lea    0xffffffe8(%ebp),%eax
0x80483e6 :    mov    %eax,0x4(%esp)
0x80483ea :    movl   $0x80484f4,(%esp)
0x80483f1 :    call   0x80482e0

Move to any reachable memory, let say 0×8048300

x/5i 0x8048300
0x8048300 <__gmon_start__@plt+16>:      jmp    *0x80495fc
0x8048306 <__gmon_start__@plt+22>:      push   $0x18
0x804830b <__gmon_start__@plt+27>:      jmp    0x80482c0
0x8048310 <_start>:     xor    %ebp,%ebp
0x8048312 <_start+2>:   pop    %esi

gdb is more to only accessing the memory, but this post is to show you how you can access the memory.

Leave a Reply