CODEWITHSUNDEEP
debuggingassemblygdbreverse-engineering
Michael Palm
Michael Palm

Reputation: 357

What is the correct way to examine the stack in gdb?

Since the stack grows torwards to smaller addesses, examining it with gdb is strenuous to me. So far I use

x/64xw 0xffffd0e8-64*4

if I want to see a value located at 0xffffd0e8 (on the stack) and the values following it on the stack (in this case the following 64 words on a 32 bit machine).

Is there an easier way?

Also, is there any way to automatically label the content on the stack with the corresponding variable names? Or to display only one word per line, not four?

Upvotes: 1

Views: 4964

Answers (1)

Julio Guerra
Julio Guerra

Reputation: 5661

If you don't have debug informations to help you, there is nothing else to do other than knowing the ABI and reading it by hand, with the help of GDB as you are doing, which can already do a good set of things only based on the ABI (like the backtrace, but without naming the callers).

If you do have debug informations of your binary, you can use info locals to list local variables of the selected stack frame, and navigate in the stack using frame, bt, info frame, info frame <address>, up, down, etc.

You can't really "annotate" the memory, but what you could do is create convenience variables to dynamically create GDB variables.

Regarding how to conveniently read large arrays of memory, I find very useful simply using print and casting addresses. For example: print (char(*)[]) 0xdeadbeef. And also using artifical arrays to print large regions. GDB will aggregate successive identical values, making it very clear and easy to read homogeneous memory regions (which is not really the case of the stack).

Upvotes: 2

Related Questions