1

I wanna create a script/program that will modify value in memory of another process. With GDB I've discovered that variable I want modify is located on heap. Because this variable is create dynamically with every program start, it is placing under another address. I've tried to find pointer on a stack that will point to this value, but also pointer is in another place every program start. Finally I've found variable position with breakpoint in main loop and reading position from registers.

Is any better way to find variable that will be good for script?

2

I'd change the variable right when it's created and stored into its position. For example, if one function calls another, that other function returns the variable, and the first function stores it somewhere, this will look in assembly somewhat like

80483e7:       e8 d8 ff ff ff          call   80483c4 <value>
80483ec:       8b 54 24 1c             mov    0x1c(%esp),%edx
80483f0:       89 02                   mov    %eax,(%edx)

where 0x1c(%esp) holds the pointer to the variable, and %eax is the value to store there.

Now, you just need a gdb input script like this:

break *0x80483f0
run
set $eax=7
cont

and your program with

gdb myprog < gdb.in

where myprog is your program and gdb.in is the above script.

If you really need to change the variable later, when the program is running, do the same, but replace the set $eax=7 with info registers and redirect the output to a file. Then, when you want to change the variable, read that file, parse the address from it, and use that address to store your variable to.

|improve this answer|||||
  • Currently I do modification with this method but I'm looking for method without breakpoint. – bigben Sep 10 '15 at 10:12
  • 1
    If the location is variable, then you can't know in advance where it will be. Your only option is to capture the location when it is generated, which requires either a breakpoint or a patching a detour directly in memory. – peter ferrie Sep 17 '15 at 15:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.