1

A very similar (or exact) question was asked here, though it was not answered properly.

enter image description here

I am debugging a process in IDA and am unable to view the dynamic contents of the stack because its value points beyond the address shown in IDA's Stack view. My ESP is shown as pointing to 0xFFFFD95C upon entry at main, while the largest address shown by IDA is 0xFEFFFFFC.

Is there a way to expand this memory range to the end of memory (i.e. 0xFFFFFFFF)?

For those interested, the binary under test is the ELF Crack Me 1 - Time to learn x86 ASM & gdb challenge over at ringzer0team.com.

1

It seems you're using the GDB debugger backend. It does not provide enough information to IDA about available memory ranges, about which you usually get a warning on startup:

---------------------------
Information
---------------------------
The current debugger backend (gdb) does not provide memory information to IDA.
Therefore the memory contents may be invisible by default.
Please use the Debugger/Manual memory regions menu item to configure the memory layout.
It is possible to define just one big region for the whole memory
(IDA will display question marks for missing memory regions in this case).
---------------------------
OK   
---------------------------

So IDA defaults to 0-0xFF000000 (addresses above 0xFF000000 are used by IDA for internal netnode IDs and may lead to issues if used in actual program). So there are two solutions:

  1. Edit the memory regions made by IDA (Edit-Manual memory regions...) and add a new one covering the regions you need (e.g. 0 to 0xFFFFFFF0, or a few smaller ones).

  2. Instead of GDB, use IDA's own Linux debugger which can properly query the OS about available memory regions.

  • This is using GDB as shown. Specifically, I was debugging a remote program by running a GDB server elsewhere. Can the Linux debugger still be used in this case? Otherwise, great solution. – sherrellbc Aug 15 '17 at 9:10
  • yes, you can use linux remote debug server. – Igor Skochinsky Aug 15 '17 at 9:11
  • Must the Remote Linux debugger be used on a Linux host? I have IDA for Windows, but was remotely debugging a Linux process. Can the remote debugger still be used in this case? – sherrellbc Nov 15 '17 at 13:42
  • Indeed it can. I found this solution suggesting to copy linux_server[x64] to the remote Linux host: reverseengineering.stackexchange.com/questions/11516/… – sherrellbc Nov 15 '17 at 13:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.