Search code examples
cdebugginggdbdisassembly

how to find address of string in binary in gdb?


So here is the source code of the binary:

#include <stdio.h>

int main(){
  printf("Hello World\n");
  return 0;
}

and below is the compilation of this source code:

@CTOS:/tmp/mytemp$ gcc helloWorld.c -o helloWorld

Now when I disassemble my binary in gdb as below:

Reading symbols from helloWorld...
(No debugging symbols found in helloWorld)
(gdb) disassemble main
Dump of assembler code for function main:
   0x0000000000001149 <+0>:     endbr64 
   0x000000000000114d <+4>:     push   %rbp
   0x000000000000114e <+5>:     mov    %rsp,%rbp
   0x0000000000001151 <+8>:     lea    0xeac(%rip),%rax     
   0x0000000000001158 <+15>:    mov    %rax,%rdi
   0x000000000000115b <+18>:    call   0x1050 <puts@plt>
   0x0000000000001160 <+23>:    mov    $0x0,%eax
   0x0000000000001165 <+28>:    pop    %rbp
   0x0000000000001166 <+29>:    ret    
End of assembler dump.

(gdb) p (char*)0xeac
$1 = 0xeac <error: Cannot access memory at address 0xeac>

Now I want to know the address of the "Hello World" string which is passed inside puts function call, I want to display the address in gdb by gdb command. How do I do that?


Solution

  • step (s) into the print yield this output:

    __GI__IO_puts (str=0x555555556004 "Hello World") at ioputs.c:35
    

    Another option is to look search for string in text segment of the process. You do that first by looking at process mappings then use find for the string.

    (gdb) info proc mappings
    process 212970
    Mapped address spaces:
    
              Start Addr           End Addr       Size     Offset objfile
          0x555555554000     0x555555555000     0x1000        0x0 /home/allan/a.out
          0x555555555000     0x555555556000     0x1000     0x1000 /home/allan/a.out
          0x555555556000     0x555555557000     0x1000     0x2000 /home/allan/a.out
          0x555555557000     0x555555558000     0x1000     0x2000 /home/allan/a.out
          0x555555558000     0x555555559000     0x1000     0x3000 /home/allan/a.out
          0x7ffff7dd7000     0x7ffff7df9000    0x22000        0x0 /usr/lib/x86_64-linux-gnu/libc-2.31.so
          0x7ffff7df9000     0x7ffff7f53000   0x15a000    0x22000 /usr/lib/x86_64-linux-gnu/libc-2.31.so
          0x7ffff7f53000     0x7ffff7fa2000    0x4f000   0x17c000 /usr/lib/x86_64-linux-gnu/libc-2.31.so
          0x7ffff7fa2000     0x7ffff7fa6000     0x4000   0x1ca000 /usr/lib/x86_64-linux-gnu/libc-2.31.so
          0x7ffff7fa6000     0x7ffff7fa8000     0x2000   0x1ce000 /usr/lib/x86_64-linux-gnu/libc-2.31.so
          0x7ffff7fa8000     0x7ffff7fae000     0x6000        0x0 
          0x7ffff7fca000     0x7ffff7fcc000     0x2000        0x0 
          0x7ffff7fcc000     0x7ffff7fd0000     0x4000        0x0 [vvar]
          0x7ffff7fd0000     0x7ffff7fd2000     0x2000        0x0 [vdso]
          0x7ffff7fd2000     0x7ffff7fd3000     0x1000        0x0 /usr/lib/x86_64-linux-gnu/ld-2.31.so
          0x7ffff7fd3000     0x7ffff7ff3000    0x20000     0x1000 /usr/lib/x86_64-linux-gnu/ld-2.31.so
          0x7ffff7ff3000     0x7ffff7ffb000     0x8000    0x21000 /usr/lib/x86_64-linux-gnu/ld-2.31.so
          0x7ffff7ffc000     0x7ffff7ffd000     0x1000    0x29000 /usr/lib/x86_64-linux-gnu/ld-2.31.so
          0x7ffff7ffd000     0x7ffff7ffe000     0x1000    0x2a000 /usr/lib/x86_64-linux-gnu/ld-2.31.so
          0x7ffff7ffe000     0x7ffff7fff000     0x1000        0x0 
          0x7ffffffde000     0x7ffffffff000    0x21000        0x0 [stack]
    
    (gdb) find 0x555555554000, 0x555555559000, "Hello World"
    0x555555556004