Скачать или смотреть How to Find the Address of a String in Binary Using gdb

Learn how to locate string addresses in binaries with `gdb` by utilizing disassembly techniques and memory mappings.
---
This video is based on the question https://stackoverflow.com/q/73752029/ asked by the user 'Swapnil' ( https://stackoverflow.com/u/7070769/ ) and on the answer https://stackoverflow.com/a/73752142/ provided by the user 'Allan Wind' ( https://stackoverflow.com/u/9706/ ) at 'Stack Overflow' website. Thanks to these great users and Stackexchange community for their contributions.

Visit these links for original content and any more details, such as alternate solutions, latest updates/developments on topic, comments, revision history etc. For example, the original title of the Question was: how to find address of string in binary in gdb?

Also, Content (except music) licensed under CC BY-SA https://meta.stackexchange.com/help/l...
The original Question post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license, and the original Answer post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license.

If anything seems off to you, please feel free to write me at vlogize [AT] gmail [DOT] com.
---
Finding the Address of a String in Binary with gdb

When working with C programming and binary executables, having the ability to inspect addresses of strings in memory can be significantly helpful for debugging purposes. In this guide, we will unravel the steps to find the memory address of the string "Hello World" in a simple compiled C program using the GNU Debugger, gdb.

The Problem

Consider the following C code:

[[See Video to Reveal this Text or Code Snippet]]

After compiling this program with the following command:

[[See Video to Reveal this Text or Code Snippet]]

When we try to disassemble the binary using gdb, we notice that we cannot easily find the address for the string "Hello World" used in the printf function. In fact, executing the command p (char*)0xeac yields an error message stating, "Cannot access memory at address 0xeac". So how do we effectively retrieve the desired string's address?

The Solution

Let's break down the solution into organized steps.

Step 1: Disassemble the Binary

Start by running gdb and disassembling the main function. To do this, type:

[[See Video to Reveal this Text or Code Snippet]]

This will provide you with the assembly instructions generated from your C code. Look for the point where "Hello World" is passed, as this is indicative of where you might find its address.

Step 2: Inspect the Print Call

When stepping into the print function with gdb, you might use the command step (s) to step into the function call. This should yield output similar to:

[[See Video to Reveal this Text or Code Snippet]]

This output reveals that the string "Hello World" is located at the memory address 0x555555556004.

Step 3: Alternative Method - Searching Memory

If you want to locate the string address through searching in the binary's memory mappings, follow these steps:

Check Process Mappings:
Execute the command:

[[See Video to Reveal this Text or Code Snippet]]

This will display the process's memory layout, segmenting the address spaces used by your binary.

Search for the String:
Once you have the memory ranges, you can then use the find command to look for the string "Hello World":

[[See Video to Reveal this Text or Code Snippet]]

This command will return the exact memory address where "Hello World" can be found, which should confirm that 0x555555556004 is indeed accurate.

Conclusion

Knowing how to find the address of a string in binary using gdb can significantly enhance your debugging skills, helping to locate issues more efficiently. By following the disassembly process or searching the memory mappings, you can easily pinpoint the addresses of strings and other data in your binaries. By practicing these techniques, you'll become proficient at navigating and debugging your compiled C programs, making you a better programmer.

Now that you have the knowledge, go ahead and try it out in your own coding projects!