2

One of the best ways to find the location of a variable in memory, when you don't have the target program's source code, is to scan the process's memory for its current value and note all addresses that contain that value. Then, do something to make the value change, and check each address in that list, eliminating the ones that don't have the new value. Rinse and repeat.

This technique works very well for finding all sorts of values, and I consider it indispensable. The most well-known tool for doing it is called Cheat Engine, because it's most often used for hacking games. But it works just as well on other types of software, of course.

For some reason, a lot of debuggers, even ones designed for binary analysis, don't have this functionality. What I'm wondering is whether GDB can do this type of scanning. I haven't seen the option for it, but it would be very useful to have, and it would work well in GDB. (I could easily see it being implemented where you initialize a scan by specifying a data type in C syntax, then having a command to filter the addresses by specifying a Boolean expression to be evaluated for each address, via a variable representing a pointer to that data type.)

If this functionality does not exist in GDB, is there an existing fork or patch to add the functionality? I know there are other tools I can use, but GDB is widely supported by many different targets which isn't necessarily supported by this other software.

flarn2006
  • 1,787
  • 15
  • 37

1 Answers1

0

What I'm wondering is whether GDB can do this type of scanning.

(gdb) help find
Search memory for a sequence of bytes.
Usage:
find [/SIZE-CHAR] [/MAX-COUNT] START-ADDRESS, END-ADDRESS, EXPR1 [, EXPR2 ...]
find [/SIZE-CHAR] [/MAX-COUNT] START-ADDRESS, +LENGTH, EXPR1 [, EXPR2 ...]
SIZE-CHAR is one of b,h,w,g for 8,16,32,64 bit values respectively,
and if not specified the size is taken from the type of the expression
in the current language.
Note that this means for example that in the case of C-like languages
a search for an untyped 0x42 will search for "(int) 0x42"
which is typically four bytes, and a search for a string "hello" will
include the trailing '\0'.  The null terminator can be removed from
searching by using casts, e.g.: {char[5]}"hello".

The address of the last match is stored as the value of "$_".
Convenience variable "$numfound" is set to the number of matches.
Employed Russian
  • 199,314
  • 34
  • 295
  • 362
  • 1
    I'm aware of that command, but I don't think it does what I'm asking. Is there an option to have it look at all of the addresses found by a previous search, and only those addresses, without specifying them all manually? – flarn2006 Dec 06 '20 at 23:50