3

I'm new with reversing and I did the following experiment just intent to help my understanding. I created a very simple 64-bit c++ program.

#include <iostream>
#include <string>

using namespace std;

int main(int argc, char* argv[])
{
    string s1{ "test" };
    cout << s1 << endl;
    cout << &s1 << endl;

    cout << "============" << endl;

    int i{ 10 };
    cout << i << endl;
    cout << &i << endl;

    getchar();
}

I then compiled it and started it. The output is:

enter image description here

Now I know the addresses of these two variables and I want to check it in x64dbg. In x64dbg, I attached to the running process and it seems it's not the variables at the aforementioned addresses:

enter image description here

4

1 ) your std::string is not a plain ascii string it is a structure (actually a class) so you cannot take the address and find the string

in your specific case since your string test 's length is less than the threshold you are lucky you can see it in your screenshot look for 74 65 73 74 as ascii you will notice it is "test"

and your int it appears is visible try looking at 0xa == 0n10

edit

Your source slightly modified to show the results of above statements

#include <iostream>
#include <string>
using namespace std;
int main(void)
{
    //small string will be embedded inside std::string class 
    // you can see 74657374 (hex for "test")
    string s1{ "test" };
    cout << s1 << endl;
    cout << &s1 << endl;
    printf("%llx\n", *(__int64 *)(&s1) );
    printf("%p\n" , s1.c_str());
    printf("%s\n" , s1.c_str());

    cout << "\n=========================================================================\n" ;

    // big string a pointer will be present to the c_str member
    // you cannot see the string unless you dereference the pointer for c_str() member

    string s2 { "this is a very very very very very very biggy biggy biggy stringyyyyyy" };
    cout << s2 << endl;
    cout << &s2 << endl;
    printf("%llx\n", *(__int64 *)&s2 );
    printf("%p\n" , s2.c_str());
    printf("%s\n" , s2.c_str());


    return getchar();
}

results

>ogrish.exe
test
001AF7C8
eafc0074736574  <<<< see the hex embedded
001AF7C8   << both &std::string and std::strin.c_str() are same
test  << c_str()  

=========================================================================
this is a very very very very very very biggy biggy biggy stringyyyyyy
001AF7E0   &std::string 
1af7f000265cf0   << address of std::string and c_str() are different
00265CF0   & string->c_str()
this is a very very very very very very biggy biggy biggy stringyyyyyy  << c_str()

and btw keep in mind if you attach to this console process all the code has already run and everything that is on stack can be out of scope and contain bogus values you need to step through for checking things on debugger not execute and attach

  • Does this type of 'address-as-variable' depend on compiler? I have seen this with MSVC compiled binary, not with G++. – Biswapriyo Feb 19 at 13:42
  • not sure what you are asking x64dbg is windows specific so i gave op a normal vc compiled std::string details sizeof(std::string) == 0x18 outofwhich 0x10 is a char buffer this is iirc called short string optimisation and msvc can differ from gcc and gcc can differ from clang – blabb Feb 19 at 20:32
  • @Biswapriyo here is an article that discusses the different implementations of std::string wrt msvc,gcc,clang shaharmike.com/cpp/std-string – blabb Feb 19 at 20:42
1

Answer of blabb is correct, I will just add some more information.

You are looking at wrong window of x64 for searching values. As you can see in your picture content of this window (CPU) is automaticly trying to disassemble data in memory as code. If you want to see values it is better to look up adresses in dump window (bottom left) or in stack window (bottom right).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.