Friday, June 8, 2012

Examining Memory with gdb’s X option.

http://www.ollydbg.de/

You can use the command x (for “examine”) to examine memory in any of several formats,independently of your program’s data types.

x/nfu addr
x addr
x Use the x command to examine memory
.


n, f, and u are all optional parameters that specify how much memory to display and how to format it;

addr is an expression giving the address where you want to start displaying
memory. If you use defaults for nfu, you need not type the slash ‘/’. Several commands set convenient defaults for addr.

n, the repeat count
The repeat count is a decimal integer; the default is 1. It specifies how much
memory (counting by units u) to display.

f, the display format
The display format is one of the formats used by print (‘x’, ‘d’, ‘u’, ‘o’, ‘t’, ‘a’, ‘c’, ‘f’, ‘s’), and in addition ‘i’ (for machine instructions). The default is ‘x’ (hexadecimal) initially.

u, the unit size The unit size is any of:
b Bytes.
h Halfwords (two bytes).
w Words (four bytes). This is the initial default.
g Giant words (eight bytes).

Each time you specify a unit size with x, that size becomes the default unit
the next time you use x. For the ‘i’ format, the unit size is ignored and is
normally not written. For the ‘s’ format, the unit size defaults to ‘b’, unless it
is explicitly given. Use x /hs to display 16-bit char strings and x /ws to display
32-bit strings. The next use of x /s will again display 8-bit strings. Note that
the results depend on the programming language of the current compilation
unit. If the language is C, the ‘s’ modifier will use the UTF-16 encoding while
‘w’ will use UTF-32. The encoding is set by the programming language and
cannot be altered.

addr, starting display address

addr is the address where you want gdb to begin displaying memory. The ex-
pression need not have a pointer value (though it may); it is always interpreted
as an integer address of a byte of memory. The default for addr is usu-
ally just after the last address examined—but several other commands also set
the default address: info breakpoints (to the address of the last breakpoint
listed), info line (to the starting address of a line), and print (if you use it
to display a value from memory).

Examinar 40 posiciones de memoria en formato hexadecimal (x) , en binario (b)

x/40xb $esp