gdb 內存操作

watch 某個地址的讀寫操作  

watch *(int*)0xaaaaa

使用gdb調試程序，讀寫操作是很普遍的事情。其中，讀操作包括：

• 讀取某個變量的值
• 讀取某個內存地址裏的內容
• 讀取某個寄存器的值

對應地，寫操作包括：

• 修改某個變量的值
• 修改某個內存地址裏的內容
• 修改某個寄存器的值

本文將首先簡單介紹一下讀操作，然後重點介紹一下寫操作。

1. 讀操作

• 讀取某個變量的值: p <var>
• 讀取某個內存地址裏的內容: x /NFU <memaddr>
• 讀取某個寄存器的值: info r <register>

2. 寫操作

先上個例子// foo.c

 1 #include <stdio.h>
 2 
 3 typedef enum {false, true} bool;
 4 
 5 static bool g_verbose = 0;
 6 
 7 static void
 8 dump(int a[], int n)
 9 {
10         for (int i = 0; i < n; i++)
11                 printf("%-2d ", a[i]);
12         printf("\n");
13 }
14 
15 int main(int argc, char *argv[])
16 {
17         int a[] = {0x1, 0x2, 0x3, 0x4, 0x5};
18         int n = sizeof(a) / sizeof(int);
19 
20         if (g_verbose) {
21                 printf("Now dump a[] ...\n");
22                 dump(a, n);
23         }
24 
25         int m = 0;
26         for (int i = 0; i < n; i++)
27                 m += a[i];
28 
29         return m;
30 }

在上面的代碼中，第5行我們定義了一個變量g_verbose, 其值爲false。現在，我們將通過gdb在第20行將其修改爲true，給出三種方法，貫穿了修改變量的值，修改內存地址內容和修改寄存器。

2.1 修改某個變量的值

set var <name> = <value>

e.g.

$ gcc -g -Wall -std=c99 -o foo foo.c

$ gdb foo
GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.3) 7.7.1
...<snip>.......................................................................
(gdb) l main
11                      printf("%-2d ", a[i]);
12              printf("\n");
13      }
14
15      int main(int argc, char *argv[])
16      {
17              int a[] = {0x1, 0x2, 0x3, 0x4, 0x5};
18              int n = sizeof(a) / sizeof(int);
19
20              if (g_verbose) {
(gdb) b 20
Breakpoint 1 at 0x8048500: file foo.c, line 20.
(gdb) r
Starting program: /tmp/foo

Breakpoint 1, main (argc=1, argv=0xbffff054) at foo.c:20
20              if (g_verbose) {
(gdb) p g_verbose
$1 = false
(gdb) set var g_verbose = true
(gdb) p g_verbose
$2 = true
(gdb) c
Continuing.
Now dump a[] ...
1  2  3  4  5
[Inferior 1 (process 5544) exited with code 017]
(gdb)

 

2.2 修改某個內存地址裏的內容

set *(unsigned char      *)<memaddr> = <value>  ; write 1 byte
set *(unsigned short     *)<memaddr> = <value>  ; write 2 bytes
set *(unsigned int       *)<memaddr> = <value>  ; write 4 bytes
set *(unsigned long long *)<memaddr> = <value>  ; write 8 bytes

or

set *(char      *)<memaddr> = <value>           ; write 1 byte
set *(short     *)<memaddr> = <value>           ; write 2 bytes
set *(int       *)<memaddr> = <value>           ; write 4 bytes
set *(long long *)<memaddr> = <value>           ; write 8 bytes

e.g.

$ gdb foo
GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.3) 7.7.1
...<snip>.......................................................................
(gdb) l main
11                      printf("%-2d ", a[i]);
12              printf("\n");
13      }
14
15      int main(int argc, char *argv[])
16      {
17              int a[] = {0x1, 0x2, 0x3, 0x4, 0x5};
18              int n = sizeof(a) / sizeof(int);
19
20              if (g_verbose) {
(gdb)
21                      printf("Now dump a[] ...\n");
22                      dump(a, n);
23              }
24
25              int m = 0;
26              for (int i = 0; i < n; i++)
27                      m += a[i];
28
29              return m;
30      }
(gdb) b 20
Breakpoint 1 at 0x8048500: file foo.c, line 20.
(gdb) r
Starting program: /tmp/foo

Breakpoint 1, main (argc=1, argv=0xbffff054) at foo.c:20
20              if (g_verbose) {
(gdb) #
(gdb)
(gdb) p &g_verbose
$1 = (bool *) 0x804a02c <g_verbose>
(gdb) #
(gdb)
(gdb) x /x 0x804a02c
0x804a02c <g_verbose>:  0x00000000
(gdb) #
(gdb)
(gdb) set *(unsigned int *)0x804a02c = 0x1
(gdb) #
(gdb)
(gdb) x /x 0x804a02c
0x804a02c <g_verbose>:  0x00000001
(gdb) #
(gdb)
(gdb) c
Continuing.
Now dump a[] ...
1  2  3  4  5
[Inferior 1 (process 5731) exited with code 017]
(gdb) q

2.3 修改某個寄存器的值

set $<register> = <value>