Search code examples
debuggingmemoryassemblygdb

How to read stack memory with gdb


   0x0804889a <+361>:   mov    %eax,0xc(%esp)
   0x0804889e <+365>:   movl   $0x2b,0x8(%esp)
   0x080488a6 <+373>:   movl   $0x1,0x4(%esp)
   0x080488ae <+381>:   movl   $0x8048ab0,(%esp)

program is adding data to %esp (the last line is a string from memory that i can probe)

i'm currently breaking at the last line of the above. and info registers shows

esp            0xffffd704       0xffffd704

when i try to display it i get

$esp = (void *) 0xffffd704

if i try to dump it

(gdb) dump memory mem2 0xffffd704 0xffffffff
Cannot access memory at address 0xffffd704

(gdb) info mem
Using user-defined memory regions.
There are no memory regions defined.

How can I see the data on the stack around esp?


Solution

  • The error message is misleading. According to my tests, gdb prints that if any byte in the range is inaccessible. As such, the problem is with the end address. You can get the stack top from /proc/<pid>/maps, for example for my test program I got:

    $ grep stack /proc/8277/maps
    fffdd000-ffffe000 rw-p 00000000 00:00 0 [stack]
    

    gdb is able to dump that memory range without problems.

    Of course if you only want to read particular values of interest, you can use the x (examine) command.