I'm reversing a 64bit binary with gdb & peda and I've identified a function of interest (probably encoding user input). I want to watch the function interesting's local variable arg1.
How can I watch a local variable of a known function in gdb?
The simplest way to do it is to use a watchpoint. A watchpoint will stop execution when a certain memory address is read or written. According to the GDB Manual section on setting Watchpoints:
You can use a watchpoint to stop execution whenever the value of an expression changes, without having to predict a particular place where this may happen. (This is sometimes called a data breakpoint.) The expression may be as simple as the value of a single variable, or as complex as many variables combined by operators.
Usage: watch [-l|-location] expr [thread thread-id] [mask maskvalue]
Set a watchpoint for an expression. GDB will break when the expression expr is written into by the program and its value changes. The simplest (and the most popular) use of this command is to watch the value of a single variable:
(gdb) watch foo
Breakpoint command lists are much what they sound like. They are lists of GDB commands that are run when a breakpoint is hit. A key feature here is that you can include the continue command in the command list, making GDB not stop like it normally would.
The GDB Manual section on Breakpoint Command Lists tells us the following:
You can give any breakpoint (or watchpoint or catchpoint) a series of commands to execute when your program stops due to that breakpoint. For example, you might want to print the values of certain expressions, or enable other breakpoints.
Usage:
commands [list…]
… command-list …
end
For example, here is how you could use breakpoint commands to print the value of x at entry to foo whenever x is positive.
break foo if x>0
commands
silent
printf "x is %d\n",x
cont
end
