tl,tr: Find memory address of an uncalled function, without having source code(or having function name) in gdb.
Issue: given a source code given to me, which looks like this:
#include<stdio.h>
func foo1(){ => I want memory address of this function
//smth here
}
int main(){
//smth here =>in any way this doesn't calls or sets pointer or anything related to foo1.
}
Obviously, this looks easy by info function foo1
.
But here’s the catch I want to pretend that I do not have source code, just executable of this, so only part inside main would be seen right? A user who is going to run executable will not really know there exists a function foo1.(As main and foo1 has no connection as such)
So using gdb only how can I find memory address of foo1?
What section of memory layout it may be contained?
(I checked in .text .data )
by
info files,
disassemble <memory-address .text>
disassemble 0x00007ff730c4a000
Dump of assembler code for function __mingw_winmain_nShowCmd:
0x00007ff730c4a000 <+0>: or (%rax),%al
0x00007ff730c4a002 <+2>: add %al,(%rax)
0x00007ff730c4a004 <+4>: add %al,(%rax)
0x00007ff730c4a006 <+6>: add %al,(%rax)
0x00007ff730c4a008 <+8>: add %al,(%rax)
0x00007ff730c4a00a <+10>: add %al,(%rax)
0x00007ff730c4a00c <+12>: add %al,(%rax)
0x00007ff730c4a00e <+14>: add %al,(%rax)
End of assembler dump.
disassemble <memory-address .data>
disassemble 0x00007ff730c31000
Dump of assembler code for function __mingw_invalidParameterHandler:
0x00007ff730c31000 <+0>: ret
End of assembler dump.
similarly, I disassembled entry point, but still no clue.
disassemble 0x7ff730c314e0
Dump of assembler code for function mainCRTStartup:
0x00007ff730c314e0 <+0>: sub $0x28,%rsp
0x00007ff730c314e4 <+4>: mov 0x1aaa5(%rip),%rax # 0x7ff730c4bf90 <.refptr.mingw_app_type>
0x00007ff730c314eb <+11>: movl $0x0,(%rax)
0x00007ff730c314f1 <+17>: call 0x7ff730c31190 <__tmainCRTStartup>
0x00007ff730c314f6 <+22>: nop
0x00007ff730c314f7 <+23>: nop
0x00007ff730c314f8 <+24>: add $0x28,%rsp
0x00007ff730c314fc <+28>: ret
End of assembler dump.
by python-gdb api i tried this:
for symbol in gdb.objfiles():
#print(gdb.symtab)
print(symbol.lookup_global_symbol)
I read docs here
which resulted in:
source gdb_script.py
<built-in method lookup_global_symbol of gdb.Objfile object at 0x000001E5EF7F5030>
<built-in method lookup_global_symbol of gdb.Objfile object at 0x000001E5EF7F5170>
<built-in method lookup_global_symbol of gdb.Objfile object at 0x000001E5EF7F51C0>
<built-in method lookup_global_symbol of gdb.Objfile object at 0x000001E5EF7F5210>
<built-in method lookup_global_symbol of gdb.Objfile object at 0x000001E5EF7F5260>
new question arised, What exactly is this now? Addresses looks different, it has left me more confused now.(I want to know what exactly above means).
I want to do this with gdb, no other tools.
Im a newbie to reverse engineering, please let it go, if something is not cleared from my side. 🙁
nastya is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
15