Variable's position on stack

Question

I wanna create a script/program that will modify value in memory of another process. With GDB I've discovered that variable I want modify is located on heap. Because this variable is create dynamically with every program start, it is placing under another address. I've tried to find pointer on a stack that will point to this value, but also pointer is in another place every program start. Finally I've found variable position with breakpoint in main loop and reading position from registers.

Is any better way to find variable that will be good for script?

Answer 1

I'd change the variable right when it's created and stored into its position. For example, if one function calls another, that other function returns the variable, and the first function stores it somewhere, this will look in assembly somewhat like

80483e7:       e8 d8 ff ff ff          call   80483c4 <value>
80483ec:       8b 54 24 1c             mov    0x1c(%esp),%edx
80483f0:       89 02                   mov    %eax,(%edx)

where 0x1c(%esp) holds the pointer to the variable, and %eax is the value to store there.

Now, you just need a gdb input script like this:

break *0x80483f0
run
set $eax=7
cont

and your program with

gdb myprog < gdb.in

where myprog is your program and gdb.in is the above script.

If you really need to change the variable later, when the program is running, do the same, but replace the set $eax=7 with info registers and redirect the output to a file. Then, when you want to change the variable, read that file, parse the address from it, and use that address to store your variable to.