0

I'm reversing a 64bit binary with gdb & peda and I've identified a function of interest (probably encoding user input). I want to watch the function interesting's local variable arg1.

How can I watch a local variable of a known function in gdb?

1
0

You could use a Watchpoint

The simplest way to do it is to use a watchpoint. A watchpoint will stop execution when a certain memory address is read or written. According to the GDB Manual section on setting Watchpoints:

You can use a watchpoint to stop execution whenever the value of an expression changes, without having to predict a particular place where this may happen. (This is sometimes called a data breakpoint.) The expression may be as simple as the value of a single variable, or as complex as many variables combined by operators.

Usage: watch [-l|-location] expr [thread thread-id] [mask maskvalue]

Set a watchpoint for an expression. GDB will break when the expression expr is written into by the program and its value changes. The simplest (and the most popular) use of this command is to watch the value of a single variable:

(gdb) watch foo

You could use Breakpoint Command Lists

Breakpoint command lists are much what they sound like. They are lists of GDB commands that are run when a breakpoint is hit. A key feature here is that you can include the continue command in the command list, making GDB not stop like it normally would.

The GDB Manual section on Breakpoint Command Lists tells us the following:

You can give any breakpoint (or watchpoint or catchpoint) a series of commands to execute when your program stops due to that breakpoint. For example, you might want to print the values of certain expressions, or enable other breakpoints.

Usage:
commands [list…]
… command-list …
end

For example, here is how you could use breakpoint commands to print the value of x at entry to foo whenever x is positive.

break foo if x>0
commands
silent
printf "x is %d\n",x
cont
end

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.