This is the mail archive of the gdb@sources.redhat.com mailing list for the GDB project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]

How do I locate a string "FooBar" in the running image of a stripped binary in gdb?



I need to locate a string which has the contents "FooBar".
The binary is stripped. And no debugging information is present.
I know the presence of the string "FooBar" because 
I am able to see the string in /proc/kcore

How do I locate the string when I am tracing the binary
through gdb.

I wrote a macro that walks from address1 to address2 and checks
for the substring FooBar, but it takes forever.

How can I narrow the search down?

man proc shows that the "mapped" memory regions are 
in /proc/<pid>/maps 
The format is:
                        address           perms offset   dev   inode
                        00000000-0002f000 r-x-- 00000400 03:03 1401
                        0002f000-00032000 rwx-p 0002f400 03:03 1401

does this mean I have to search only the memory mapped regions?
Are these memory mapped regions define the currently used
virtual addresses of the process?



__________________________________________________
Do You Yahoo!?
Yahoo! Auctions - buy the things you want at great prices
http://auctions.yahoo.com/


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]