This is the mail archive of the gdb@sources.redhat.com mailing list for the GDB project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]

Re: How do I locate a string "FooBar" in the running image of a stripped binary in gdb?


Richard Harris wrote:
> 
> I need to locate a string which has the contents "FooBar".
> The binary is stripped. And no debugging information is present.
> I know the presence of the string "FooBar" because
> I am able to see the string in /proc/kcore
> 
> How do I locate the string when I am tracing the binary
> through gdb.
> 
> I wrote a macro that walks from address1 to address2 and checks
> for the substring FooBar, but it takes forever.

I can't think of any better way.  

> How can I narrow the search down?

Perhaps by searching only the .data or .bss section?
Or the malloc heap?  Or the stack?  Assuming that you 
know your string is either in data, bss, stack or heap...


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]