CODEWITHSUNDEEP
gdb
Charlotte Russell
Charlotte Russell

Reputation: 1475

GDB: Print the value of memory address

According to https://www.ethicalhacker.net/columns/heffner/intro-to-assembly-and-reverse-engineering

mov 0xffffffb4,0x1

moves the number 1 into 0xffffffb4.

So, I decided to test this on my own. In GDB, x is the command to print the value of memory address. However, when I run 

x 0x00000000004004fc

I'm not getting the value of 133 (decimal) or 85 (hexadecimal)

Instead, I'm getting 0x85f445c7. Any idea what is this?

me@box:~/c$ gdb -q test
Reading symbols from test...done.
(gdb) l
1       #include <stdio.h>
2
3       int main(){
4               int a = 1;
5               int b = 13;
6               int c = 133;
7               printf("Value of C : %d\n",c);
8               return 0;
9       }
(gdb) b 7
Breakpoint 1 at 0x400503: file test.c, line 7.
(gdb) r
Starting program: /home/me/c/test 

Breakpoint 1, main () at test.c:7
7               printf("Value of C : %d\n",c);
(gdb)

Disassemble

(gdb) disas
Dump of assembler code for function main:
   0x00000000004004e6 <+0>:     push   %rbp
   0x00000000004004e7 <+1>:     mov    %rsp,%rbp
   0x00000000004004ea <+4>:     sub    $0x10,%rsp
   0x00000000004004ee <+8>:     movl   $0x1,-0x4(%rbp)
   0x00000000004004f5 <+15>:    movl   $0xd,-0x8(%rbp)
   0x00000000004004fc <+22>:    movl   $0x85,-0xc(%rbp)
=> 0x0000000000400503 <+29>:    mov    -0xc(%rbp),%eax
   0x0000000000400506 <+32>:    mov    %eax,%esi
   0x0000000000400508 <+34>:    mov    $0x4005a4,%edi
   0x000000000040050d <+39>:    mov    $0x0,%eax
   0x0000000000400512 <+44>:    callq  0x4003c0 <printf@plt>
   0x0000000000400517 <+49>:    mov    $0x0,%eax
   0x000000000040051c <+54>:    leaveq 
   0x000000000040051d <+55>:    retq   
End of assembler dump.
(gdb) x 0x00000000004004fc
0x4004fc <main+22>:     0x85f445c7
(gdb)

Upvotes: 6

Views: 85785

Answers (2)

Hannu
Hannu

Reputation: 285

Notable:

The command

x 0x00000000004004fc

Will look at the instruction and related data for this instruction:

0x00000000004004fc <+22>: movl $0x85,-0xc(%rbp)

... as you can see that the left column (address) is equal to the value used for the command (the address to read)

In the instruction 0x85 is clearly the destination address for the mov, and reflected in the printed value; 0x85f445c7 - which stored as MSB (most significant byte) at the address.

Upvotes: 0

maruf
maruf

Reputation: 669

;DRTL

To print a value in GDB use print or (p in short form) command.

in your command

x 0x00000000004004fc

You have missed p command. You have to use x with p command pair to print value as hexadecimal format, like below:

(gdb) p/x 0x00000000004004fc

If the memory address is some pointer to some structure then you have to cast the memory location before using the pointer. For example,

struct node {
  int data;
  struct node *next
};

is some structure and you have the address of that structure pointer, then to view the contents of that memory location you have to use 

(gdb) p *(struct node *) 0x00000000004004fc

Upvotes: 9

Related Questions