How To Find Memory Address Of A Register Gdb

In this GDB tutorial, we look at the GDB command detect.

Sometimes, when you are debugging, yous need to observe a item sequence of bytes in the memory space of the program. Perhaps, y'all want to see all the pointers to a specific object. So, every viii bytes in memory that corresponds to the byte sequence, is an address yous want to place.

Note that, the discover command returns the addresses of all matches; and then we must accept possible faux positives.

That's fine - I guess.

The find command offers you a dissimilar kind of inspection into your program.

Let's dive in.

Hello, world!

Get-go, let's write a unproblematic program that nosotros can use for this GDB tutorial.

Open your favorite editor (e.g., emacs, or 6) and blazon the post-obit lines.

#include <stdio.h>int
main(void)
{
            printf("Howdy, world!\n");
            printf("That is all, good day.\north");
            Return 0;
}

Relieve the program as hello.c

Compile it.

$ gcc -g3 hello.c

Load information technology.

$ gdb a.out

Start it.

(gdb) start

Done it.

Now permit'southward await at the GDB command observe.

Find command

The syntax for the GDB command find is as follows:

observe [/SIZE-CHAR] [/MAX-COUNT] START-Address, Terminate-ADDRESS, EXPR1 [, EXPR2, ...]

Or,

detect [/SIZE-CHAR] [/MAX-COUNT] Offset-Address, +LENGTH, EXPR1 [, EXPR2, ...]

You can search the memory space of a program for a item sequence of bytes specified by EXPR1, EXPR2, etc.

The search begins at a START-Address and continues for either +LENGTH bytes or until the END-ADDRESS.

Later in this GDB tutorial, I show how you go the memory mapping for your program and use information technology to determine the beginning and end addresses for your search query.

[ /SIZE-CHAR] and [/MAX-COUNT] are optional.

[/SIZE-CHAR] sets the size for each search value.

b bytes

h halfwords (two bytes)

west words (four bytes)

thou giant words (viii bytes)

All search values are interpreted in the programming language of the program. For case, the source language of hello.c is C/C++; so when nosotros later in this GDB tutorial search for the string "Hello, world!", it includes the trailing '\0'.

If we don't specify the [/SIZE-CHAR], then the size is taken from the value-type in the source language. This is useful when yous want to specify the search pattern as a mixture of value types.

[/MAX-COUNT] sets the maximum number of matches to return. The default is to print all finds.

You tin utilise strings as search values. Make sure to quote them with double-quotes ("). The string value is copied into the search pattern byte past byte, regardless of the byte order of the target and the size specification.

The accost of each friction match found is returned every bit well equally a count of the number of matches.

Reduce Bug-Fix Fourth dimension
Step back in time in your program's execution and diagnose bugs in minutes, not days.
Learn more about Time Travel Debugging »

Search memory

If yous want to search in the address infinite of your program, you demand to become the memory mapping for your process and determine the start address, and depending on which find command syntax y'all employ, the cease address.

How practice nosotros give GDB an address range to search?

We can use the info proc command to get helpful information about the process. If you expand the command as follows:

(gdb) info proc mappings

This GDB command gives you all the retentivity mappings of the process; all the virtual address ranges, in our case the programme hullo.c, can access.

Taking an educated guess, the "Hi, world!" cord I am searching for must live somewhere in the address range from 0x555555554000 to 0x555555559000. Merely, and this is really important, the address 0x555555559000 is Non the bodily end address. It is the address of the first byte that is non mapped! Using this address in our search volition result in an fault because it searches outside of the mapped address range. I prove you that in my video. So, do step i byte dorsum; 0x555555558fff.

Now, type this.

(gdb) notice 0x555555554000 to 0x555555558fff, "Hullo, earth!"

The event in this example is ii possible instances of the string in memory.

Find Results

To cheque, blazon this:

(gdb) print (char*) 0x555555556004

Here y'all get, we found our string "Hello, globe!".

Print Char

Some terminal tips

Too making sure that yous search in a mapped retention range, there are other things to remember.

If you practise search for a string, then you must map the exact design. In my video, for example, I forget to type the explanation-mark in my search, which y'all will see returns no match because it hits the trailing '\0' terminator.

Missing Char

The find control searches for the full pattern up to the '\0'.

You lot can search for other patterns than strings, for example, a sequence of characters.

(gdb) notice 0x555555554000 to 0x555555558fff, 'H', 'e', 'fifty', 'l', 'o'

Note the single-quotes (').

Char H e l l o

That'south it!

The find help command offers some extra search options and parameters. Take some time to endeavour these out too. I am sure that you do agree that the GDB command find gives you a useful way to get a unlike kind of inspection for debugging your programme.

Don't forget to share your takeaways from this GDB tutorial with your project members and so anybody benefits!

UDB Fourth dimension Travel Debugger
Observe and fix bugs in minutes - even C/C++ race weather condition, retentiveness corruptions and seg faults
Acquire more »