I want to find the address of a string in memory. In this case, I'm looking for "/bin/sh". Its an initialized variable, so its in the .data section and after compilation, it has a fixed address. So what do I do in GDB to find out its memory address? And I do not know the name of the variable its stored in.
4 Answers
Take this example:
1.find the string "Can not open script" .
2.gdb>info proc map
process 8636
Mapped address spaces:
Start Addr End Addr Size Offset objfile
0x8048000 0x8898000 0x850000 0x0 /home/lela/ask/mLinux32
0x8898000 0x8902000 0x6a000 0x850000 /home/lela/ask/mLinux32
0x8902000 0x8d4c000 0x44a000 0x0 [heap]
0xf6800000 0xf6821000 0x21000 0x0
0xf6821000 0xf6900000 0xdf000 0x0
0xf6a00000 0xf6a21000 0x21000 0x0
0xf6a21000 0xf6b00000 0xdf000 0x0
0xf6b00000 0xf6b21000 0x21000 0x0
0xf6b21000 0xf6c00000 0xdf000 0x0
0xf6cbf000 0xf6cc0000 0x1000 0x0
0xf6cc0000 0xf6d00000 0x40000 0x0
0xf6d00000 0xf6d21000 0x21000 0x0
0xf6d21000 0xf6e00000 0xdf000 0x0
0xf6e06000 0xf6e07000 0x1000 0x0
0xf6e07000 0xf6e47000 0x40000 0x0
0xf6e47000 0xf6e48000 0x1000 0x0
0xf6e48000 0xf6e88000 0x40000 0x0
0xf6e88000 0xf6e89000 0x1000 0x0
0xf6e89000 0xf794f000 0xac6000 0x0
0xf794f000 0xf7a4f000 0x100000 0x0
0xf7a4f000 0xf7c15000 0x1c6000 0x0
0xf7c15000 0xf7c17000 0x2000 0x0 /usr/lib/i386-linux-gnu/libgcc_s.so.1
0xf7c17000 0xf7c2d000 0x16000 0x2000 /usr/lib/i386-linux-gnu/libgcc_s.so.1
0xf7c2d000 0xf7c32000 0x5000 0x18000 /usr/lib/i386-linux-gnu/libgcc_s.so.1
0xf7c32000 0xf7c33000 0x1000 0x1c000 /usr/lib/i386-linux-gnu/libgcc_s.so.1
like this result.
3.use find command with the start address and end address,and string with string type length ex:{char[19]},likes below.
gdb➤ find 0x8048000, 0x8902000, {char[19]}"Can not open script"
0x8611234
1 pattern found.
gdb➤ x/s 0x8611234
0x8611234: "Can not open script file \"%s\" to execute.\n"
4.finish.
Related