Skip to content

Instantly share code, notes, and snippets.

@o11c
Last active November 11, 2016 04:59
Show Gist options
  • Select an option

  • Save o11c/e06f02f755c76d1668157c2c2d2a1a4e to your computer and use it in GitHub Desktop.

Select an option

Save o11c/e06f02f755c76d1668157c2c2d2a1a4e to your computer and use it in GitHub Desktop.
Variables in GDB memory (without a running process)
#!/usr/bin/gdb -x
# Demonstration of manipulating variables without
# touching inferior memory at all.
# Harmless executable that everyone has
file /bin/true
# You probably don't have symbols from /bin/true itself though.
# So, run it once to get type symbols from shared libraries (libc).
# It will finish though, so there is no current process - I'm not cheating.
# Note that value symbols are not needed at all.
run
# No hackery at all!
set $foo = (siginfo_t){}
# This one assumes sizeof(siginfo_t) == 128, which it is on my system.
# If you're doing this from python it's easier.
# The initializer has only 127 elements, since GDB forcibly appends on.
# (You actually can use more, but you get a warning if you do).
set $bar = ((siginfo_t[])"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0")[0]
#
set $foo.si_signo = 0x12345678
set $bar.si_signo = 0x12345678
set ((char[])(siginfo_t[])$foo)[0] = 0xff
set ((char[])(siginfo_t[])$bar)[0] = 0xff
# Assuming si_signo is the first member in this demo,
# this will output 0x123456ff (little-endian systems)
# or 0xff345678 (big-endian systems)
print /x $foo.si_signo
print /x $bar.si_signo
quit
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment