Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

GDB Patching results in "Cannot access memory at address 0x

Tags:

patch

gdb

I have a program that I need to patch using GDB. The issue is there is a line of code that makes a "less than or equal test" and fails causing the program to end with a Segmentation fault. The program is already compiled and I do not have the source so I cannot change the source code obviously. However, using GDB, I was able to locate where the <= test is done and then I was able to locate the memory address which you can see below.

    (gdb) x/100i $pc
    ... removed extra lines ...
    0x7ffff7acb377:      jle    0x7ffff7acb3b1
    ....

All I need to do is change the test to a 'greater than or equal to' test and then the program should run fine. The opcode for jle is 0x7e and I need to change it to 0x7d. My assignment gives instructions on how to do this as follows:

    $ gdb -write -q programtomodify
    (gdb) set {unsigned char} 0x8040856f = 0x7d
    (gdb) quit

So I try it and get...

    $ gdb -write -q player
    (gdb) set {unsigned char} 0x7ffff7acb377 = 0x7d
    Cannot access memory at address 0x7ffff7acb377

I have tried various other memory addresses and no matter what I try I get the same response. That is my only problem, I don't care if it's the wrong address or wrong opcode instruction at this point, I just want to be able to modify the memory.

I am running Linux Mint 14 via VMware Player

Thank

like image 607
Eric T Avatar asked Nov 03 '22 00:11

Eric T


1 Answers

Cannot access memory at address 0x7ffff7acb377

You are trying to write to an address where some shared library resides. You can find out which library that is with info sym 0x7ffff7acb377.

At the time when you are trying to perform the patch, the said shared library has not been loaded yet, which explains the message you get.

Run the program to main. Then you should be able to write to the address. However, you'll need to have write permission on the library to make your write "stick".

like image 53
Employed Russian Avatar answered Dec 07 '22 21:12

Employed Russian