This is the mail archive of the
gdb@sources.redhat.com
mailing list for the GDB project.
How do I locate a string "FooBar" in the running image of a stripped binary in gdb?
- To: gdb at sources dot redhat dot com
- Subject: How do I locate a string "FooBar" in the running image of a stripped binary in gdb?
- From: Richard Harris <snafutexas at yahoo dot com>
- Date: Tue, 22 May 2001 20:14:36 -0700 (PDT)
- Cc: snafutexas at yahoo dot com
I need to locate a string which has the contents "FooBar".
The binary is stripped. And no debugging information is present.
I know the presence of the string "FooBar" because
I am able to see the string in /proc/kcore
How do I locate the string when I am tracing the binary
through gdb.
I wrote a macro that walks from address1 to address2 and checks
for the substring FooBar, but it takes forever.
How can I narrow the search down?
man proc shows that the "mapped" memory regions are
in /proc/<pid>/maps
The format is:
address perms offset dev inode
00000000-0002f000 r-x-- 00000400 03:03 1401
0002f000-00032000 rwx-p 0002f400 03:03 1401
does this mean I have to search only the memory mapped regions?
Are these memory mapped regions define the currently used
virtual addresses of the process?
__________________________________________________
Do You Yahoo!?
Yahoo! Auctions - buy the things you want at great prices
http://auctions.yahoo.com/