栈帧信息

(gdb) info frame

Stack level 0, frame at 0x7ffc286552a0:

rip = 0x55943b2bb8c4 in foo; saved rip = 0x55943b2bb9e9

called by frame at 0x7ffc28655300

Arglist at 0x7ffc28655290, args:

Locals at 0x7ffc28655290, Previous frame's sp is 0x7ffc286552a0

Saved registers:

rbp at 0x7ffc28655290, rip at 0x7ffc28655298

进程maps 信息

/proc/11742/maps

---

55943b2bb000-55943b2bc000 r-xp 00000000 08:0a 5772372 /home/xxx/tests/c/gdb/a.out

55943b4bb000-55943b4bc000 r--p 00000000 08:0a 5772372 /home/xxx/tests/c/gdb/a.out

55943b4bc000-55943b4bd000 rw-p 00001000 08:0a 5772372 /home/xxx/tests/c/gdb/a.out

55943b9a8000-55943b9c9000 rw-p 00000000 00:00 0 [heap]

7f4e8b87a000-7f4e8ba50000 r-xp 00000000 08:09 523649 /lib/x86_64-linux-gnu/libc-2.26.so

7f4e8ba50000-7f4e8bc50000 ---p 001d6000 08:09 523649 /lib/x86_64-linux-gnu/libc-2.26.so

7f4e8bc50000-7f4e8bc54000 r--p 001d6000 08:09 523649 /lib/x86_64-linux-gnu/libc-2.26.so

7f4e8bc54000-7f4e8bc56000 rw-p 001da000 08:09 523649 /lib/x86_64-linux-gnu/libc-2.26.so

7f4e8bc56000-7f4e8bc5a000 rw-p 00000000 00:00 0

7f4e8bc5a000-7f4e8bc81000 r-xp 00000000 08:09 523292 /lib/x86_64-linux-gnu/ld-2.26.so

7f4e8be51000-7f4e8be54000 rw-p 00000000 00:00 0

7f4e8be7e000-7f4e8be81000 rw-p 00000000 00:00 0

7f4e8be81000-7f4e8be82000 r--p 00027000 08:09 523292 /lib/x86_64-linux-gnu/ld-2.26.so

7f4e8be82000-7f4e8be83000 rw-p 00028000 08:09 523292 /lib/x86_64-linux-gnu/ld-2.26.so

7f4e8be83000-7f4e8be84000 rw-p 00000000 00:00 0

7ffc28637000-7ffc28658000 rw-p 00000000 00:00 0 [stack]

7ffc286aa000-7ffc286ad000 r--p 00000000 00:00 0 [vvar]

7ffc286ad000-7ffc286af000 r-xp 00000000 00:00 0 [vdso]

ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]

计算

rip 指向a.out 的 .text 段 r-xp

rip - a.out .text 段基址 = 0x55943b2bb8c4 - 0x55943b2bb000 = 0x8c4

objdump

objdump -ds a.out > a.txt

00000000000008a0 :

8a0: 55 push %rbp

8a1: 48 89 e5 mov %rsp,%rbp

8a4: 5d pop %rbp

8a5: e9 66 ff ff ff jmpq 810

00000000000008aa :

8aa: 55 push %rbp

8ab: 48 89 e5 mov %rsp,%rbp

8ae: 48 89 7d e8 mov %rdi,-0x18(%rbp)

8b2: c7 45 fc 00 00 00 00 movl $0x0,-0x4(%rbp)

8b9: c7 45 fc 03 00 00 00 movl $0x3,-0x4(%rbp)

8c0: 48 8b 45 e8 mov -0x18(%rbp),%rax

8c4: 8b 00 mov (%rax),%eax

8c6: 89 45 fc mov %eax,-0x4(%rbp)

8c9: 90 nop

8ca: 5d pop %rbp

8cb: c3 retq

00000000000008cc :

8cc: 55 push %rbp

8cd: 48 89 e5 mov %rsp,%rbp

8d0: 48 83 ec 50 sub $0x50,%rsp

...

a.c 的内容：

void foo(int *p)

{

int a = 0;

a = 1 + 2;

a = *p;

}

int main()

{

...

foo(0);

...

}

定位

0x8c4 即foo函数中 mov (%rax),%eax 对应的a = *p; 一句。完成！