如何在我的虚拟 memory 中找到字符串的保存位置？ 使用 gdb 调试.cc 文件

Question

I have an executable file that was compiled from a.cc file. I'm now debugging with the gdb. In line 66 of my code I have:

cout << "Mean: " << mean << endl;

I'm now trying to find where "Mean: " is saved in my virtual memory. Any tips? I've tried different commands like find and print but have had no breakthroughs.

Does anybody have any tips?

Answer 1

Here are a few ways you could find the string.

Let's compile this test:

#include <iostream>
int main(int arch, char *argv[])
{
  double mean = 0.5;
  std::cout << "Mean: " << mean << std::endl;
}

1. Use disassembly. Set breakpoint on the std::cout line:

(gdb) run
Starting program: /tmp/a.out 

Breakpoint 1, main (arch=1, argv=0x7fffffffe328) at t.cc:5
5         std::cout << "Mean: " << mean << std::endl;
(gdb) info line 5
Line 5 of "t.cc" starts at address 0x555555555191 <main(int, char**)+28> and ends at 0x5555555551a4 <main(int, char**)+47>.
(gdb) disas 0x555555555191,0x5555555551a4+1
Dump of assembler code from 0x555555555191 to 0x5555555551a5:
=> 0x0000555555555191 <main(int, char**)+28>:   lea    0xe71(%rip),%rsi        # 0x555555556009
   0x0000555555555198 <main(int, char**)+35>:   lea    0x2ec1(%rip),%rdi        # 0x555555558060 <_ZSt4cout@@GLIBCXX_3.4>
   0x000055555555519f <main(int, char**)+42>:   callq  0x555555555040 <_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc@plt>
   0x00005555555551a4 <main(int, char**)+47>:   movsd  -0x8(%rbp),%xmm0
End of assembler dump.

Above you can see register rsi being loaded with value 0x555555556009 , which is passed as second argument to the std::operator<< () . It must contain the string. Indeed:

(gdb) x/s 0x555555556009
0x555555556009: "Mean: "

2. Use info file to find .rodata section (in which this string resides) and find commands:

(gdb) info file
Symbols from "/tmp/a.out".
Native process:
        Using the running image of child process 905.
        While running this, GDB does not access memory from...
Local exec file:
        `/tmp/a.out', file type elf64-x86-64.
        Entry point: 0x555555555090
        0x00005555555542a8 - 0x00005555555542c4 is .interp
...
        0x0000555555556000 - 0x0000555555556018 is .rodata
...

(gdb) find 0x0000555555556000, 0x0000555555556018, {char[6]}"Mean: "
0x555555556009
1 pattern found.