This question seems so basic but I have spent 5+ hours trying to figure it out. I have written a program in C++ that defines a few variables and does some other stuff. What I want to do in Radare2 is to be able to find the memory address that one of those variable is stored in and then alter it. The steps needed in my opinion are:

  • Set up a breakpoint at or after declaration of variable.
  • Find memory address with value I'm searching for. In this case 10.
  • Change value stored in that address.

The biggest issue I'm having is just knowing what to look at for identifying the address with the value of 10. If I do a pdf of the main function, there are tons of local_xxx which is what I assume I should be looking at:

UPDATED with full disassembly

main (int arg_4h);
|           ; var int local_9ch @ ebp-0x9c
|           ; var int local_8ch @ ebp-0x8c
|           ; var int local_88h @ ebp-0x88
|           ; var int local_84h @ ebp-0x84
|           ; var int local_80h @ ebp-0x80
|           ; var int local_7ch @ ebp-0x7c
|           ; var int local_64h @ ebp-0x64
|           ; var int local_4ch @ ebp-0x4c
|           ; var int local_34h @ ebp-0x34
|           ; var int local_1ch @ ebp-0x1c
|           ; var int local_10h @ ebp-0x10
|           ; arg int arg_4h @ esp+0x4
|           0x565f1a18      8d4c2404       lea ecx, [arg_4h]           ; 4
|           0x565f1a1c      83e4f0         and esp, 0xfffffff0
|           0x565f1a1f      ff71fc         push dword [ecx - 4]
|           0x565f1a22      55             push ebp
|           0x565f1a23      89e5           mov ebp, esp
|           0x565f1a25      57             push edi
|           0x565f1a26      56             push esi
|           0x565f1a27      53             push ebx
|           0x565f1a28      51             push ecx
|           0x565f1a29      81ec98000000   sub esp, 0x98
|           0x565f1a2f      e8740a0000     call sym.__x86.get_pc_thunk.si
|           0x565f1a34      81c608250000   add esi, 0x2508
|           0x565f1a3a      89c8           mov eax, ecx
|           0x565f1a3c      8b4004         mov eax, dword [eax + 4]    ; [0x4:4]=-1 ; 4
|           0x565f1a3f      898564ffffff   mov dword [local_9ch], eax
|           0x565f1a45      65a114000000   mov eax, dword gs:[0x14]    ; [0x14:4]=-1 ; 20
|           0x565f1a4b      8945e4         mov dword [local_1ch], eax
|           0x565f1a4e      31c0           xor eax, eax
|           0x565f1a50      83ec0c         sub esp, 0xc
|           0x565f1a53      8d8578ffffff   lea eax, [local_88h]
|           0x565f1a59      50             push eax
|           0x565f1a5a      89f3           mov ebx, esi
|           0x565f1a5c      e84ff9ffff     call sym.std::allocator_char_::allocator
|           0x565f1a61      83c410         add esp, 0x10
|           0x565f1a64      83ec04         sub esp, 4
|           0x565f1a67      8d8578ffffff   lea eax, [local_88h]
|           0x565f1a6d      50             push eax
|           0x565f1a6e      8d8696e7ffff   lea eax, [esi - 0x186a]
|           0x565f1a74      50             push eax
|           0x565f1a75      8d4584         lea eax, [local_7ch]
|           0x565f1a78      50             push eax
|           0x565f1a79      89f3           mov ebx, esi
|           0x565f1a7b      e8c0f8ffff     call sym.std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char__::basic_string_charconst__std::allocator_char_const
|           0x565f1a80      83c410         add esp, 0x10
|           0x565f1a83      83ec0c         sub esp, 0xc
|           0x565f1a86      8d8578ffffff   lea eax, [local_88h]
|           0x565f1a8c      50             push eax
|           0x565f1a8d      89f3           mov ebx, esi
|           0x565f1a8f      e85cf8ffff     call sym.std::allocator_char_::_allocator
|           0x565f1a94      83c410         add esp, 0x10
|           0x565f1a97      83ec0c         sub esp, 0xc
|           0x565f1a9a      8d8578ffffff   lea eax, [local_88h]
|           0x565f1aa0      50             push eax
|           0x565f1aa1      89f3           mov ebx, esi
|           0x565f1aa3      e808f9ffff     call sym.std::allocator_char_::allocator
|           0x565f1aa8      83c410         add esp, 0x10
|           0x565f1aab      83ec04         sub esp, 4
|           0x565f1aae      8d8578ffffff   lea eax, [local_88h]
|           0x565f1ab4      50             push eax
|           0x565f1ab5      8d869be7ffff   lea eax, [esi - 0x1865]
|           0x565f1abb      50             push eax
|           0x565f1abc      8d459c         lea eax, [local_64h]
|           0x565f1abf      50             push eax
|           0x565f1ac0      89f3           mov ebx, esi
|           0x565f1ac2      e879f8ffff     call sym.std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char__::basic_string_charconst__std::allocator_char_const
|           0x565f1ac7      83c410         add esp, 0x10
|           0x565f1aca      83ec0c         sub esp, 0xc
|           0x565f1acd      8d8578ffffff   lea eax, [local_88h]
|           0x565f1ad3      50             push eax
|           0x565f1ad4      89f3           mov ebx, esi
|           0x565f1ad6      e815f8ffff     call sym.std::allocator_char_::_allocator
|           0x565f1adb      83c410         add esp, 0x10
|           0x565f1ade      c7857cffffff.  mov dword [local_84h], 0x64 ; 'd' ; 100
|           0x565f1ae8      c74580050000.  mov dword [local_80h], 5
|           0x565f1aef      c78574ffffff.  mov dword [local_8ch], 0xa
|           0x565f1af9      c78578ffffff.  mov dword [local_88h], 0xa
|           0x565f1b03      83ec08         sub esp, 8
|           0x565f1b06      8d869ce7ffff   lea eax, [esi - 0x1864]
|           0x565f1b0c      50             push eax
|           0x565f1b0d      8b86ac000000   mov eax, dword [esi + 0xac] ; [0xac:4]=-1 ; 172
|           0x565f1b13      50             push eax
|           0x565f1b14      89f3           mov ebx, esi
|           0x565f1b16      e8a5f7ffff     call sym.std::basic_ostream_char_std::char_traits_char___std::operator___std::char_traits_char___std::basic_ostream_char_std::char_traits_char____charconst
|           0x565f1b1b      83c410         add esp, 0x10
|           0x565f1b1e      83ec08         sub esp, 8
|           0x565f1b21      8d4584         lea eax, [local_7ch]
|           0x565f1b24      50             push eax
|           0x565f1b25      8b86b4000000   mov eax, dword [esi + 0xb4] ; [0xb4:4]=-1 ; 180
|           0x565f1b2b      50             push eax
|           0x565f1b2c      89f3           mov ebx, esi
|           0x565f1b2e      e8fdf7ffff     call sym.std::basic_istream_char_std::char_traits_char___std::operator___char_std::char_traits_char__std::allocator_char___std::basic_istream_char_std::char_traits_char____std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char
|           0x565f1b33      83c410         add esp, 0x10
|           0x565f1b36      8d45b4         lea eax, [local_4ch]
|           0x565f1b39      83ec04         sub esp, 4
|           0x565f1b3c      8d5584         lea edx, [local_7ch]
|           0x565f1b3f      52             push edx
|           0x565f1b40      8d96b9e7ffff   lea edx, [esi - 0x1847]
|           0x565f1b46      52             push edx
|           0x565f1b47      50             push eax
|           0x565f1b48      e81c050000     call sym.std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char__std::operator__char_std::char_traits_char__std::allocator_char___charconst__std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char__const
|           0x565f1b4d      83c40c         add esp, 0xc
|           0x565f1b50      8d45cc         lea eax, [local_34h]
|           0x565f1b53      83ec04         sub esp, 4
|           0x565f1b56      8d96c4e7ffff   lea edx, [esi - 0x183c]
|           0x565f1b5c      52             push edx
|           0x565f1b5d      8d55b4         lea edx, [local_4ch]
|           0x565f1b60      52             push edx
|           0x565f1b61      50             push eax
|           0x565f1b62      e8ba040000     call sym.std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char__std::operator__char_std::char_traits_char__std::allocator_char___std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char_____charconst
|           0x565f1b67      83c40c         add esp, 0xc
|           0x565f1b6a      83ec08         sub esp, 8
|           0x565f1b6d      8d45cc         lea eax, [local_34h]
|           0x565f1b70      50             push eax
|           0x565f1b71      8b86ac000000   mov eax, dword [esi + 0xac] ; [0xac:4]=-1 ; 172
|           0x565f1b77      50             push eax
|           0x565f1b78      89f3           mov ebx, esi
|           0x565f1b7a      e821f7ffff     call sym.std::basic_ostream_char_std::char_traits_char___std::operator___char_std::char_traits_char__std::allocator_char___std::basic_ostream_char_std::char_traits_char____std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char__const
|           0x565f1b7f      83c410         add esp, 0x10
|           0x565f1b82      83ec0c         sub esp, 0xc
|           0x565f1b85      8d45cc         lea eax, [local_34h]
|           0x565f1b88      50             push eax
|           0x565f1b89      89f3           mov ebx, esi
|           0x565f1b8b      e880f6ffff     call sym.std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char__::_basic_string
|           0x565f1b90      83c410         add esp, 0x10
|           0x565f1b93      83ec0c         sub esp, 0xc
|           0x565f1b96      8d45b4         lea eax, [local_4ch]
|           0x565f1b99      50             push eax
|           0x565f1b9a      89f3           mov ebx, esi
|           0x565f1b9c      e86ff6ffff     call sym.std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char__::_basic_string
|           0x565f1ba1      83c410         add esp, 0x10
|           0x565f1ba4      83ec08         sub esp, 8
|           0x565f1ba7      8d459c         lea eax, [local_64h]
|           0x565f1baa      50             push eax
|           0x565f1bab      8b86b4000000   mov eax, dword [esi + 0xb4] ; [0xb4:4]=-1 ; 180
|           0x565f1bb1      50             push eax
|           0x565f1bb2      89f3           mov ebx, esi
|           0x565f1bb4      e877f7ffff     call sym.std::basic_istream_char_std::char_traits_char___std::operator___char_std::char_traits_char__std::allocator_char___std::basic_istream_char_std::char_traits_char____std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char
|           0x565f1bb9      83c410         add esp, 0x10
|           0x565f1bbc      83ec08         sub esp, 8
|           0x565f1bbf      8d862ee8ffff   lea eax, [esi - 0x17d2]
|           0x565f1bc5      50             push eax
|           0x565f1bc6      8d459c         lea eax, [local_64h]
|           0x565f1bc9      50             push eax
|           0x565f1bca      e87d050000     call sym.boolstd::operator___char_std::char_traits_char__std::allocator_char___std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char__const__charconst
|           0x565f1bcf      83c410         add esp, 0x10
|           0x565f1bd2      84c0           test al, al
|       ,=< 0x565f1bd4      751a           jne 0x565f1bf0
|       |   0x565f1bd6      83ec08         sub esp, 8
|       |   0x565f1bd9      8d8630e8ffff   lea eax, [esi - 0x17d0]
|       |   0x565f1bdf      50             push eax
|       |   0x565f1be0      8d459c         lea eax, [local_64h]
|       |   0x565f1be3      50             push eax
|       |   0x565f1be4      e863050000     call sym.boolstd::operator___char_std::char_traits_char__std::allocator_char___std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char__const__charconst
|       |   0x565f1be9      83c410         add esp, 0x10
|       |   0x565f1bec      84c0           test al, al
|      ,==< 0x565f1bee      7407           je 0x565f1bf7
|      |`-> 0x565f1bf0      b801000000     mov eax, 1
|      |,=< 0x565f1bf5      eb05           jmp 0x565f1bfc
|      `--> 0x565f1bf7      b800000000     mov eax, 0
|       |   ; CODE XREF from main (0x565f1bf5)
|       `-> 0x565f1bfc      84c0           test al, al
|       ,=< 0x565f1bfe      7421           je 0x565f1c21
|       |   0x565f1c00      83ec04         sub esp, 4
|       |   0x565f1c03      8d8578ffffff   lea eax, [local_88h]
|       |   0x565f1c09      50             push eax
|       |   0x565f1c0a      8d8574ffffff   lea eax, [local_8ch]
|       |   0x565f1c10      50             push eax
|       |   0x565f1c11      ff7580         push dword [local_80h]
|       |   0x565f1c14      e824f9ffff     call sym.fight_int_int__int
|       |   0x565f1c19      83c410         add esp, 0x10
|      ,==< 0x565f1c1c      e9aa000000     jmp 0x565f1ccb
|      |`-> 0x565f1c21      83ec08         sub esp, 8
|      |    0x565f1c24      8d8632e8ffff   lea eax, [esi - 0x17ce]
|      |    0x565f1c2a      50             push eax
|      |    0x565f1c2b      8d459c         lea eax, [local_64h]
|      |    0x565f1c2e      50             push eax
|      |    0x565f1c2f      e818050000     call sym.boolstd::operator___char_std::char_traits_char__std::allocator_char___std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char__const__charconst
|      |    0x565f1c34      83c410         add esp, 0x10
|      |    0x565f1c37      84c0           test al, al
|      |,=< 0x565f1c39      751a           jne 0x565f1c55
|      ||   0x565f1c3b      83ec08         sub esp, 8
|      ||   0x565f1c3e      8d8634e8ffff   lea eax, [esi - 0x17cc]
|      ||   0x565f1c44      50             push eax
|      ||   0x565f1c45      8d459c         lea eax, [local_64h]
|      ||   0x565f1c48      50             push eax
|      ||   0x565f1c49      e8fe040000     call sym.boolstd::operator___char_std::char_traits_char__std::allocator_char___std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char__const__charconst
|      ||   0x565f1c4e      83c410         add esp, 0x10
|      ||   0x565f1c51      84c0           test al, al
|     ,===< 0x565f1c53      7407           je 0x565f1c5c
|     ||`-> 0x565f1c55      b801000000     mov eax, 1
|     ||,=< 0x565f1c5a      eb05           jmp 0x565f1c61
|     `---> 0x565f1c5c      b800000000     mov eax, 0
|      ||   ; CODE XREF from main (0x565f1c5a)
|      |`-> 0x565f1c61      84c0           test al, al
|      |,=< 0x565f1c63      7434           je 0x565f1c99
|      ||   0x565f1c65      83ec08         sub esp, 8
|      ||   0x565f1c68      8d8638e8ffff   lea eax, [esi - 0x17c8]
|      ||   0x565f1c6e      50             push eax
|      ||   0x565f1c6f      8b86ac000000   mov eax, dword [esi + 0xac] ; [0xac:4]=-1 ; 172
|      ||   0x565f1c75      50             push eax
|      ||   0x565f1c76      89f3           mov ebx, esi
|      ||   0x565f1c78      e843f6ffff     call sym.std::basic_ostream_char_std::char_traits_char___std::operator___std::char_traits_char___std::basic_ostream_char_std::char_traits_char____charconst
|      ||   0x565f1c7d      83c410         add esp, 0x10
|      ||   0x565f1c80      89c2           mov edx, eax
|      ||   0x565f1c82      83ec08         sub esp, 8
|      ||   0x565f1c85      8b86a4000000   mov eax, dword [esi + 0xa4] ; [0xa4:4]=-1 ; 164
|      ||   0x565f1c8b      50             push eax
|      ||   0x565f1c8c      52             push edx
|      ||   0x565f1c8d      89f3           mov ebx, esi
|      ||   0x565f1c8f      e83cf6ffff     call sym.std::ostream::operator___std::ostream_____std::ostream
|      ||   0x565f1c94      83c410         add esp, 0x10
|     ,===< 0x565f1c97      eb32           jmp 0x565f1ccb
|     ||`-> 0x565f1c99      83ec08         sub esp, 8
|     ||    0x565f1c9c      8d8658e8ffff   lea eax, [esi - 0x17a8]
|     ||    0x565f1ca2      50             push eax
|     ||    0x565f1ca3      8b86ac000000   mov eax, dword [esi + 0xac] ; [0xac:4]=-1 ; 172
|     ||    0x565f1ca9      50             push eax
|     ||    0x565f1caa      89f3           mov ebx, esi
|     ||    0x565f1cac      e80ff6ffff     call sym.std::basic_ostream_char_std::char_traits_char___std::operator___std::char_traits_char___std::basic_ostream_char_std::char_traits_char____charconst
|     ||    0x565f1cb1      83c410         add esp, 0x10
|     ||    0x565f1cb4      89c2           mov edx, eax
|     ||    0x565f1cb6      83ec08         sub esp, 8
|     ||    0x565f1cb9      8b86a4000000   mov eax, dword [esi + 0xa4] ; [0xa4:4]=-1 ; 164
|     ||    0x565f1cbf      50             push eax
|     ||    0x565f1cc0      52             push edx
|     ||    0x565f1cc1      89f3           mov ebx, esi
|     ||    0x565f1cc3      e808f6ffff     call sym.std::ostream::operator___std::ostream_____std::ostream
|     ||    0x565f1cc8      83c410         add esp, 0x10
|     ||    ; CODE XREFS from main (0x565f1c1c, 0x565f1c97)
|     ``--> 0x565f1ccb      bf00000000     mov edi, 0
|           0x565f1cd0      83ec0c         sub esp, 0xc
|           0x565f1cd3      8d459c         lea eax, [local_64h]
|           0x565f1cd6      50             push eax
|           0x565f1cd7      89f3           mov ebx, esi
|           0x565f1cd9      e832f5ffff     call sym.std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char__::_basic_string
|           0x565f1cde      83c410         add esp, 0x10
|           0x565f1ce1      83ec0c         sub esp, 0xc
|           0x565f1ce4      8d4584         lea eax, [local_7ch]
|           0x565f1ce7      50             push eax
|           0x565f1ce8      89f3           mov ebx, esi
|           0x565f1cea      e821f5ffff     call sym.std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char__::_basic_string
|           0x565f1cef      83c410         add esp, 0x10
|           0x565f1cf2      89f8           mov eax, edi
|           0x565f1cf4      8b4de4         mov ecx, dword [local_1ch]
|           0x565f1cf7      65330d140000.  xor ecx, dword gs:[0x14]
|       ,=< 0x565f1cfe      0f84a0000000   je 0x565f1da4
|      ,==< 0x565f1d04      e996000000     jmp 0x565f1d9f
..
|      ||   ; CODE XREF from main (0x565f1d04)
|      `--> 0x565f1d9f      e87c070000     call sym.__stack_chk_fail_local ; void __stack_chk_fail(void)
|       `-> 0x565f1da4      8d65f0         lea esp, [local_10h]
|           0x565f1da7      59             pop ecx
|           0x565f1da8      5b             pop ebx
|           0x565f1da9      5e             pop esi
|           0x565f1daa      5f             pop edi
|           0x565f1dab      5d             pop ebp
|           0x565f1dac      8d61fc         lea esp, [ecx - 4]
\           0x565f1daf      c3             ret

I really appreciate you taking the time, any input is welcome!

UPDATED with .cpp source

#include <iostream>
#include <string>

using namespace std;

void fight(int pDmg, int &gold, int &mHp) {
  bool mDead = false;
  cout << "You approach the huge beast slowly..." << endl;
  cout << "Drawing your sword and gitting your teeth you charge!" << endl;

  for(int i = 0; i < 5; i++) {
    cout << "You deal " + to_string(pDmg) + " damage!" << endl;
    mHp -= pDmg;
    cout << "The monster has " + to_string(mHp) + " remaining health!" << endl;
    if(mHp <= 0) {
      mDead = true;
      break;
    }
  }

  if(mDead) {
    cout << "You have defeated the beast!" << endl;
    cout << "You loot his corpse to find 10 gold" << endl;
    gold += 10;
    cout << "You now have " + to_string(gold) + " gold!" << endl;
    cout << "Great job! Game Over..." << endl;
  } else {
    cout << "The monster swings out and hits you with his gigantic club" << endl;
    cout << "You have been knocked out and failed to protect the city!" << endl;
  }
}

int main(int argc, char*argv[]) {
    string name = "Hero";
  string choice = "";
  int playerHp = 100;
  int playerDmg = 5;
  int gold = 10;
  int monsterHp = 10;

  cout << "Enter your name brave hero: ";
  cin >> name;
  cout << "Welcome " + name + ", we need your help! There is a big monster terrorizing the city, are you up for the challenge? (y or n) ";
  cin >> choice;

  if(choice == "y" || choice == "Y") {
    fight(playerDmg, gold, monsterHp);
  } else if(choice == "n" || choice == "N") {
    cout << "I suppose we are doomed!!!!!!!!" << endl;
  } else {
    cout << "Well at least you could have given me a respectable answer!" << endl;
  }

    return 0;
}
  • can you post the source for comparison? – Igor Skochinsky Aug 8 at 21:27
  • @IgorSkochinsky I have added the source and updated the disassemble to include the full output. Thanks for taking a look! – LepleyDev Aug 8 at 22:01

With some outside tools, https://godbolt.org, I was able to get this.

The variable was located next to the other defined variables:

|           0x565f1ade      c7857cffffff.  mov dword [local_84h], 0x64 
; 'd' ; 100
|           0x565f1ae8      c74580050000.  mov dword [local_80h], 5
|           0x565f1aef      c78574ffffff.  mov dword [local_8ch], 0xa
|           0x565f1af9      c78578ffffff.  mov dword [local_88h], 0xa

From there I was able to inspect the address with ps @ 0x565f1af9 and then write the new value with wx 64 @ 0x565f1af9 +6 (+6 since there was an offset to account for).

Pretty awesome learning experience! Hope someone finds this helpful.

  • not sure why you needed to use gotbolt, what was missing in r2? You have the same information in your disassembly in the question post. – Paweł Łukasik Aug 9 at 5:10
  • 1
    Nothing was missing in r2, it just allowed me a better understanding of how the memory was allocated for the program and which parts of assembly aligned with which parts of code. – LepleyDev Aug 10 at 13:17
  • 1
    To match/display sources in r2 or gdb you can use -ggdb flag during compilation. r2 will display sources along your disassembly. – sudhackar Nov 7 at 4:20

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.