1

This post might be specific to IDA Pro, so bear that in mind.

I'm currently trying to write a plugin for debugging specifically one executable. I know that a certain object in the executable's process exists at 0xAB40C0 (it always exists there). Can I simply write object* obj = (object*)0xAB40C0; and then access the various members of it?

1

No, the debugger (in whose process context your plugin is running) and the debuggee are two separate processes.

You would need to use ReadProcessMemory() (or its equivalent for your operating system) to read the debuggee's memory.

0

In the case of linux, debuggers typically use the ptrace API to inspect and modify the process space of the process being debugged. And no, they do not share the address space.

As a side note, dynamic binary instrumentation frameworks such as PIN do involve inserting itself into the process space of the binary being instrumented.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.