This is the mail archive of the
gdb@sources.redhat.com
mailing list for the GDB project.
Re: How do I locate a string "FooBar" in the running image of a stripped binary in gdb?
- To: Richard Harris <snafutexas at yahoo dot com>
- Subject: Re: How do I locate a string "FooBar" in the running image of a stripped binary in gdb?
- From: Michael Snyder <msnyder at cygnus dot com>
- Date: Fri, 01 Jun 2001 17:52:42 -0700
- CC: gdb at sources dot redhat dot com
- Organization: Red Hat
- References: <20010523031436.43302.qmail@web14403.mail.yahoo.com>
Richard Harris wrote:
>
> I need to locate a string which has the contents "FooBar".
> The binary is stripped. And no debugging information is present.
> I know the presence of the string "FooBar" because
> I am able to see the string in /proc/kcore
>
> How do I locate the string when I am tracing the binary
> through gdb.
>
> I wrote a macro that walks from address1 to address2 and checks
> for the substring FooBar, but it takes forever.
I can't think of any better way.
> How can I narrow the search down?
Perhaps by searching only the .data or .bss section?
Or the malloc heap? Or the stack? Assuming that you
know your string is either in data, bss, stack or heap...