0

With the following command be correct in the following sequence?

gdb-peda -q binary
break main
info registers

1 Answer 1

1

This can be achieved with strings and grep

[rese] strings -a --radix=x x | grep /bin/bash
    6e4 /bin/bash
[rese] gdb -q x # for modern "PIE" binaries"
GEF for linux ready, type `gef' to start, `gef config' to configure
75 commands loaded for GDB 8.1.1 using Python engine 3.6
[*] 5 commands could not be loaded, run `gef missing` to know why.
Reading symbols from x...(no debugging symbols found)...done.
gef➤  x/xs 0x6e4
0x6e4:  "/bin/bash"

However it is to note that the address of strings change at runtime. You'll need to add the base of the module such as

[#0] Id 1, Name: "x", stopped 0x55555540063e in main (), reason: BREAKPOINT
[#0] 0x55555540063e → main()
gef➤  x/xs 0x6e4
0x6e4:  <error: Cannot access memory at address 0x6e4>
gef➤  x/xs 0x5555554006e4
0x5555554006e4: "/bin/bash"

Also another way is to use gdb using the find command

(gdb) help find
Search memory for a sequence of bytes.
Usage:
find [/size-char] [/max-count] start-address, end-address, expr1 [, expr2 ...]
find [/size-char] [/max-count] start-address, +length, expr1 [, expr2 ...]
size-char is one of b,h,w,g for 8,16,32,64 bit values respectively,
and if not specified the size is taken from the type of the expression
in the current language.
Note that this means for example that in the case of C-like languages
a search for an untyped 0x42 will search for "(int) 0x42"
which is typically four bytes, and a search for a string "hello" will
include the trailing '\0'.  The null terminator can be removed from
searching by using casts, e.g.: {char[5]}"hello".

The address of the last match is stored as the value of "$_".
Convenience variable "$numfound" is set to the number of matches.

Example

[rese] gdb -q x
Reading symbols from x...(no debugging symbols found)...done.
(gdb) start
Temporary breakpoint 1 at 0x4004eb
Starting program: /tmp/rese/x

Temporary breakpoint 1, 0x00000000004004eb in main ()
(gdb) info proc mappings
process 516
Mapped address spaces:

          Start Addr           End Addr       Size     Offset objfile
            0x400000           0x401000     0x1000        0x0 /tmp/rese/x
            0x600000           0x601000     0x1000        0x0 /tmp/rese/x
            0x601000           0x602000     0x1000     0x1000 /tmp/rese/x
      0x7ffff79e2000     0x7ffff7bc9000   0x1e7000        0x0 /lib/x86_64-linux-gnu/libc-2.27.so
      0x7ffff7bc9000     0x7ffff7dc9000   0x200000   0x1e7000 /lib/x86_64-linux-gnu/libc-2.27.so
      0x7ffff7dc9000     0x7ffff7dcd000     0x4000   0x1e7000 /lib/x86_64-linux-gnu/libc-2.27.so
      0x7ffff7dcd000     0x7ffff7dcf000     0x2000   0x1eb000 /lib/x86_64-linux-gnu/libc-2.27.so
      0x7ffff7dcf000     0x7ffff7dd3000     0x4000        0x0
      0x7ffff7dd3000     0x7ffff7dfc000    0x29000        0x0 /lib/x86_64-linux-gnu/ld-2.27.so
      0x7ffff7fde000     0x7ffff7fe0000     0x2000        0x0
      0x7ffff7ff7000     0x7ffff7ffb000     0x4000        0x0 [vvar]
      0x7ffff7ffb000     0x7ffff7ffc000     0x1000        0x0 [vdso]
      0x7ffff7ffc000     0x7ffff7ffd000     0x1000    0x29000 /lib/x86_64-linux-gnu/ld-2.27.so
      0x7ffff7ffd000     0x7ffff7ffe000     0x1000    0x2a000 /lib/x86_64-linux-gnu/ld-2.27.so
      0x7ffff7ffe000     0x7ffff7fff000     0x1000        0x0
      0x7ffffffde000     0x7ffffffff000    0x21000        0x0 [stack]
(gdb) find 0x400000, +0x1000, "/bin/bash" # 0x400000 is the start addr for target module x and 0x1000 is the size of the mapping.
0x400584
1 pattern found.
(gdb) x/xs 0x400584
0x400584:       "/bin/bash"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.