Peeter Joot's (OLD) Blog.

Math, physics, perl, and programming obscurity.

Some gdb dumping examples.

Posted by peeterjoot on April 28, 2010

I often forget how to dump memory in raw form with various debuggers. Here’s a quick note to myself of how to do it in gdb

As bytes (in hex):

(gdb) x/256xb 0x73d2e0
0x73d2e0:       0x00    0x00    0x00    0x00    0x00    0x00    0x00    0x00
0x73d2e8:       0x01    0x00    0x00    0x00    0x00    0x00    0x00    0x00
0x73d2f0:       0x01    0x40    0x00    0x00    0x00    0x00    0x00    0x00
0x73d3d8:       0x00    0x00    0x00    0x00    0x00    0x00    0x00    0xaa

As 4-byte “words”:

(gdb) x/64xw 0x73d2e0
0x73d2e0:       0x00000000      0x00000000      0x00000001      0x00000000
0x73d2f0:       0x00004001      0x00000000      0x00000000      0x00000000
0x73d300:       0x00000000      0x00000000      0x00000000      0x00000000
0x73d310:       0x00000000      0x00000000      0x00010001      0x00040013
0x73d3d0:       0x00000000      0x00000000      0x00000000      0xaa000000

Note that the repeat count isn’t the total number of bytes to dump, but the total number of objects in the size specification:

(gdb) help x
Examine memory: x/FMT ADDRESS.
ADDRESS is an expression for the memory address to examine.
FMT is a repeat count followed by a format letter and a size letter.
Format letters are o(octal), x(hex), d(decimal), u(unsigned decimal),
  t(binary), f(float), a(address), i(instruction), c(char) and s(string).
Size letters are b(byte), h(halfword), w(word), g(giant, 8 bytes).
The specified number of objects of the specified size are printed
according to the format.

Defaults for format and size letters are those previously used.
Default count is 1.  Default address is following last thing printed
with this command or "print".

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: