CODEWITHSUNDEEP
gdbgdbserver
ebdavis
ebdavis

Reputation: 125

GDB 'find' command terminating early

I am looking for a specific series of bytes in the memory of a program in GDB.

'find' starting above a certain address (0x104f90) works, but 'find' starting below that address does not:

(gdb) find /w 0x104f90, 0x108fe4, 0x6863203b
 0x108e08
 0x108e58
 0x108ee8

vs

(gdb) find /w 0x104f80, 0x108fe4, 0x6863203b
 Pattern not found.

The memory around this address is (seemingly) accessible by GDB:

(gdb) x/12x 0x104f80
0x104f80:  0x00000000  0x00000000  0x00000000  0x00000000
0x104f90:  0x00000000  0x00000000  0x00000000  0x00000000
0x104fa0:  0x00000000  0x00000000  0x00000000  0x00000000

And both of these addresses are on the heap -- info proc mappings says the heap runs from 0xe7000 - 0x109000

Can anyone advise on what I'm missing here? Thank you!

Upvotes: 1

Views: 409

Answers (1)

ebdavis
ebdavis

Reputation: 125

The problem was that I was using gdbserver, and there is a bug in gdbserver where the 'find' function gives up if it doesn't find what it's looking for in 16,000 bytes. See https://sourceware.org/pipermail/gdb-patches/2020-April/167829.html for the official bug report.

The solutions are either update to gdb 10 (which will have a fix), or limit 'find' queries to less than 16,000 bytes

Upvotes: 2

Related Questions