Ufdjrw

How to move the player while also allowing forces to affect it

Why do we use polarized capacitors?

Is this food a bread or a loaf?

Shall I use personal or official e-mail account when registering to external websites for work purpose?

How could a lack of term limits lead to a "dictatorship?"

Manga about a female worker who got dragged into another world together with this high school girl and she was just told she's not needed anymore

What happens when a metallic dragon and a chromatic dragon mate?

Should the British be getting ready for a no-deal Brexit?

Ideas for 3rd eye abilities

Typesetting a double Over Dot on top of a symbol

What do you call something that goes against the spirit of the law, but is legal when interpreting the law to the letter?

Does the average primeness of natural numbers tend to zero?

Can a planet have a different gravitational pull depending on its location in orbit around its sun?

New order #4: World

Is ipsum/ipsa/ipse a third person pronoun, or can it serve other functions?

What does "enim et" mean?

What do the Banks children have against barley water?

Denied boarding due to overcrowding, Sparpreis ticket. What are my rights?

What is the offset in a seaplane's hull?

If a centaur druid Wild Shapes into a Giant Elk, do their Charge features stack?

Is "plugging out" electronic devices an American expression?

Are white and non-white police officers equally likely to kill black suspects?

Does bootstrapped regression allow for inference?

A poker game description that does not feel gimmicky

examine command in gdb?

Improve INSERT-per-second performance of SQLite?GDB: What to do when you type “list” to see the code in C, but it prints to you “No source file for address __________”GDB examine command, multiple units at target addressIos Debugging with GDB and No Symbols - Examine ObjectsGDB examine command confusionExamining strings using gdbget return address GDBGDB find command error “warning: Unable to access x bytes of target memory at y, halting search”What mechanism overwrites the return address of a stack frame, preventing certain buffer overflow exploits?Finding argv address in GDB

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;

0

A number can also be prepended to the format of the examine command
to examine multiple units at the target address.

source: hacking the art of exploration

(gdb) x/2x $eip
0x8048384 <main+16>: 0x00fc45c7 0x83000000

(gdb) x/x $eip
0x8048384 <main+16>: 0x00fc45c7

I know that the second examine command returns the memory address that eip is currently locating. What about the first one which returns two memory address?

c gdb

share|improve this question

asked Mar 8 at 7:16

Henok TesfayeHenok Tesfaye

757522

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  $eip can be seen as a pointer variable. So in C terms, x/x $eip prints $eip[0] and x/2x $eip prints $eip[0] and $eip[1].
  
  – Some programmer dude
  Mar 8 at 7:19
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  OK, what does they indicate?
  
  – Henok Tesfaye
  Mar 8 at 7:21
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Then let me ask you this: Do you know what EIP is and what it's used for? What do you think that $eip is pointing at?
  
  – Some programmer dude
  Mar 8 at 7:24
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Yes, EIP is a register inside the CPU, it is used to hold the memory address of instructions in our program which is currently executing. $eip is pointing to the address in the .text section of our program.
  
  – Henok Tesfaye
  Mar 8 at 7:27
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  My question is, there is only 1 $eip, so why it shows two memory address?
  
  – Henok Tesfaye
  Mar 8 at 7:31
  

  
  
  
  

 | 
show 3 more comments

0

A number can also be prepended to the format of the examine command
to examine multiple units at the target address.

source: hacking the art of exploration

(gdb) x/2x $eip
0x8048384 <main+16>: 0x00fc45c7 0x83000000

(gdb) x/x $eip
0x8048384 <main+16>: 0x00fc45c7

I know that the second examine command returns the memory address that eip is currently locating. What about the first one which returns two memory address?

c gdb

share|improve this question

asked Mar 8 at 7:16

Henok TesfayeHenok Tesfaye

757522

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  $eip can be seen as a pointer variable. So in C terms, x/x $eip prints $eip[0] and x/2x $eip prints $eip[0] and $eip[1].
  
  – Some programmer dude
  Mar 8 at 7:19
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  OK, what does they indicate?
  
  – Henok Tesfaye
  Mar 8 at 7:21
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Then let me ask you this: Do you know what EIP is and what it's used for? What do you think that $eip is pointing at?
  
  – Some programmer dude
  Mar 8 at 7:24
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Yes, EIP is a register inside the CPU, it is used to hold the memory address of instructions in our program which is currently executing. $eip is pointing to the address in the .text section of our program.
  
  – Henok Tesfaye
  Mar 8 at 7:27
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  My question is, there is only 1 $eip, so why it shows two memory address?
  
  – Henok Tesfaye
  Mar 8 at 7:31
  

  
  
  
  

 | 
show 3 more comments

A number can also be prepended to the format of the examine command
to examine multiple units at the target address.

source: hacking the art of exploration

(gdb) x/2x $eip
0x8048384 <main+16>: 0x00fc45c7 0x83000000

(gdb) x/x $eip
0x8048384 <main+16>: 0x00fc45c7

I know that the second examine command returns the memory address that eip is currently locating. What about the first one which returns two memory address?

c gdb

share|improve this question

asked Mar 8 at 7:16

Henok TesfayeHenok Tesfaye

757522

(gdb) x/2x $eip
0x8048384 <main+16>: 0x00fc45c7 0x83000000

(gdb) x/x $eip
0x8048384 <main+16>: 0x00fc45c7

share|improve this question

asked Mar 8 at 7:16

Henok TesfayeHenok Tesfaye

757522

share|improve this question

asked Mar 8 at 7:16

Henok TesfayeHenok Tesfaye

757522

asked Mar 8 at 7:16

Henok TesfayeHenok Tesfaye

757522

asked Mar 8 at 7:16

Henok TesfayeHenok Tesfaye

757522

1 Answer
1

active

oldest

votes

0

The examine command of gdb has the following syntax:

x/[n][f][u]

where n, f and u are optional and n is the length, f the format and u the unit size.

Possible formats are:

• s (null terminated string)


• i (machine code instruction)


• x (hexadecimal value)

If no unit size can be one of the following values:

• b (bytes)


• h (2 bytes)


• w (4 bytes)


• g (8 bytes)

where w is the default.

Therefore x/2x prints 2 hexadecimal values with a size of 4 bytes from your code segment.

share|improve this answer

edited Mar 8 at 7:29

answered Mar 8 at 7:23

kalehmannkalehmann

2,7631023

add a comment | 

Your Answer

StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55058445%2fexamine-command-in-gdb%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

0

The examine command of gdb has the following syntax:

x/[n][f][u]

where n, f and u are optional and n is the length, f the format and u the unit size.

Possible formats are:

• s (null terminated string)


• i (machine code instruction)


• x (hexadecimal value)

If no unit size can be one of the following values:

• b (bytes)


• h (2 bytes)


• w (4 bytes)


• g (8 bytes)

where w is the default.

Therefore x/2x prints 2 hexadecimal values with a size of 4 bytes from your code segment.

share|improve this answer

edited Mar 8 at 7:29

answered Mar 8 at 7:23

kalehmannkalehmann

2,7631023

add a comment | 

0

The examine command of gdb has the following syntax:

x/[n][f][u]

where n, f and u are optional and n is the length, f the format and u the unit size.

Possible formats are:

• s (null terminated string)


• i (machine code instruction)


• x (hexadecimal value)

If no unit size can be one of the following values:

• b (bytes)


• h (2 bytes)


• w (4 bytes)


• g (8 bytes)

where w is the default.

Therefore x/2x prints 2 hexadecimal values with a size of 4 bytes from your code segment.

share|improve this answer

edited Mar 8 at 7:29

answered Mar 8 at 7:23

kalehmannkalehmann

2,7631023

add a comment | 

The examine command of gdb has the following syntax:

x/[n][f][u]

where n, f and u are optional and n is the length, f the format and u the unit size.

Possible formats are:

• s (null terminated string)


• i (machine code instruction)


• x (hexadecimal value)

If no unit size can be one of the following values:

• b (bytes)


• h (2 bytes)


• w (4 bytes)


• g (8 bytes)

where w is the default.

Therefore x/2x prints 2 hexadecimal values with a size of 4 bytes from your code segment.

share|improve this answer

edited Mar 8 at 7:29

answered Mar 8 at 7:23

kalehmannkalehmann

2,7631023

x/[n][f][u]

share|improve this answer

edited Mar 8 at 7:29

answered Mar 8 at 7:23

kalehmannkalehmann

2,7631023

answered Mar 8 at 7:23

kalehmannkalehmann

2,7631023

answered Mar 8 at 7:23

kalehmannkalehmann

2,7631023