Trying to reverse engineer C code that is 64bit assembly

Question

This is the code I am looking at

0x0000000000401048 <+70>:   mov    0x401ba0(,%rax,4),%eax

This is an array of 15 integers. Just wondering how I can access indices 0 to 15 in gdb

Thanks

Answer 1

GDB allows you to use C-style casts, so simply do this, if you know the address:

(gdb) print/x (int[15])(*0x401ba0)

An example output would be:

$1 = {0x5241c031, 0x41535341, 0x41554154, 0x55574156, 0x48e58948, 0x31f0e483, 0x31f631ff, 0xe8c931d2, 0xfffffb08, 0xc0314850, 0x580f0174, 0x7c00f883, 0xec8948c7, 0x415f415d, 0x415d415e}

If you have the address of your array in a register, you can also use the respective variable ($eax etc).

Answer 2

(gdb) dump binary memory dump.raw 0x401ba0 0x401bdc

dump memory into file dump.raw from address 0x401ba0 until address 0x401bdc

Another option would be examine:

x/nfu <address>
Print memory.
n: How many units to print (default 1).
f: Format character (like „print“).
u: Unit.
Unit is one of:
b: Byte,
h: Half-word (two bytes)
w: Word (four bytes)
g: Giant word (eight bytes)).

Answer 3

For reading and writing to the 15 elements in the array:

(gdb) set variable $A = (int*)0x401ba0
(gdb) p $A[0] = 1
...
(gdb) p $A[14]

For examing their current value,

(gdb) x/15dw $A