Вопрос

So i am trying to debug some code and all i have is the executable. I know that a register contains the address of what need to know. Is there a way I could print out the hex values from the start of that address to a given length?

things I have tried:

x/s $ebp
p (char) ($ebp)
p (char) (*ebp >> 4 )
p (char)*(%ebp  4 )
p $($ebp)
p  $(%ebp + $0x1)

Does normal pointer arithmetic not work with registers? What does it mean when it says "the history is empty

Это было полезно?

Решение

The x command will be the easiest way to display values in memory. Try, for instance:

(gdb) x/32b $ebp

If this doesn't work (especially if you get an error that "value can't be converted to integer"), you're probably debugging a 64-bit executable. x86-64 registers have different names; use $rbp instead.

The characters after the slash in the x command control how many values are displayed, and what format is used. x/s will attempt to read a string from that address, for instance. If you don't use anything, gdb will use whatever you last used.

While it isn't strictly necessary to answer your question, I've fixed up some of the other commands you were trying to run:

p *((char *) $ebp)       <- treat $ebp as a character pointer and display what it points to
p *((char *) $ebp + 4)   <- with an offset
p ((char *) $ebp)[4]     <- same thing as above, except using array syntax

The $ character is only needed when referring to registers, or to gdb variables. You don't need it for anything else.

Лицензировано под: CC-BY-SA с атрибуция
Не связан с StackOverflow
scroll top