7

I am attempting to reverse engineer a 32-bit stripped, dynamically linked ELF executable. I want to know when a specific string is printed to the console. I ran the following command:

root@testbox> strings -a --radix=x binfile | grep -i reset
d38c4  RESET

This is the string I want to know when is being printed to the console. This could either be happening with printf or puts (which are called many many times during the flow of execution)

What is the appropriate way to use the string's memory address to tell when its being read (thus printed to the screen)?

1 Answer 1

3

You can find the load address of a pattern in a simpler way

objdump -s "executable" | grep -i "pattern"

Confirm it with gdb by

x/s "*(returned address from objdump)"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.