CODEWITHSUNDEEP
linuxdebugginggdb
Juicy
Juicy

Reputation: 12530

GDB's find function doesn't find all occurences of the pattern

I'm trying to search for the all occurences of 0xE4FF in the program I'm debugging using GDB's find function. In the following, my search finds two patterns, and I proceed to verify them:

(gdb) find 0x8048000, 0x888a000, 0xE4FF
0x8142c63
0x8848fa4
2 patterns found.
(gdb) x/2bx 0x08142c63
0x8142c63:  0xff        0xe4
(gdb) x/2bx 0x08848fa4
0x8848fa4:  0xff        0xe4

In the tutorial I'm following, the author is using EDB and settles for this address 0x08134597, which falls in the search range I've given to GDB. A quick check confirms that this address holds the pattern I'm searching for, yet GDB didn't report it:

(gdb) x/2bx 0x08134597
0x8134597:  0xff        0xe4

I'm trying to understand why GDB didn't report this (and several other) valid addresses that contain the pattern I'm searching for. Is there an option I can use to make sure GDB reports all of these addresses.

(Note: This is for exploit development and I'm purposefully avoiding GDB-PEDA (which is awesome) and Metasploit. I'm trying to do this as much as possible in pure GDB, last challenge I did I found myself in a situation where that's all I had)

Upvotes: 1

Views: 1519

Answers (1)

Employed Russian
Employed Russian

Reputation: 213754

From (gdb) help find:

Search memory for a sequence of bytes.
Usage:
find [/size-char] [/max-count] start-address, end-address, expr1 [, expr2 ...]
find [/size-char] [/max-count] start-address, +length, expr1 [, expr2 ...]
size-char is one of b,h,w,g for 8,16,32,64 bit values respectively,
and if not specified the size is taken from the type of the expression
in the current language.
Note that this means for example that in the case of C-like languages
a search for an untyped 0x42 will search for "(int) 0x42"
which is typically four bytes.

Note the last sentence. I think you are looking for one of:

find/h 0x8048000, 0x888a000, 0xE4FF
find 0x8048000, 0x888a000, (short)0xE4FF

Upvotes: 2

Related Questions