I know that you can find any parameters by looking at a positive offset from $ebp using gdb:
(gdb) x/4wx $ebp
Then, I would look at the 3rd and 4th addresses using x/s
because they would be the first and second parameter. What about for local variables? How would I look at the values at a negative offset from $ebp?
Also, is there anyway to look at the value of $eax?
Whenever I try to print the value of $eax using x/s $eax
, the address is out of bound or the value is 0, which I am sure that it is not because I just put a constant value in the register.
I tried info locals
but I get the message "No symbol table info available".
You can use ls() to list all variables that are created in the environment. Use ls() to display all variables.
The @entry form refers to the value of the parameter when the function was entered. This isn't always available, but sometimes it is -- there is a DWARF extension for it, and GCC emits this when possible. There's some information here: https://sourceware.org/gdb/onlinedocs/gdb/Variables.html.
Use the set variable (gdb) and the assign (dbx) commands to change the value associated with a variable, memory address, or expression that is accessible according to the scope and visibility rules of the language. The expression can be any expression that is valid in the current context.
The usual way to examine data in your program is with the print command (abbreviated p ), or its synonym inspect . It evaluates and prints the value of an expression of the language your program is written in (see section Using GDB with Different Languages).
First you need to compile debugging the symbols into your binary. Use the -g option on gcc with your current command to do this. If you're using a different compiler you will need to consult its documentation. After this, 'info locals' and the print command will work.
To look at any local variable all you need to do is use the 'print' command. For example to look at the local variable 'i' it's as easy as 'print i'.
You should be able to handle $eax in the same way as $ebp. I suspect you have problems because you're using x/s. x/s will try and print out a string, and so it will continue until it hits a null character. If this doesn't happen for a long time then the length of the string will go out of bounds. Try 'x/d $eax'. You can even do 'print $eax'. You can also use 'info registers' to get all the register data.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With