Thursday, March 12, 2009

Catching data on the way out

So, pulling variable contents off the stack in the middle of a function and dumping to a file via the debugger is easier then it appears. First, don't use ddd. This process over a few hundred thousand iterations would have taken hours, except it kept crashing ddd in the middle. Using gdb took mere minutes.

#For the dynamic case, stop where we can see what is going on
break some_dynamicly_loaded_function
run
#Now we know our loaded offset
break *some_dynamicly_loaded_function+length_of_said_dynamicly_loaded_function
delete 1

#Hook up commands to process data and continue
commands 2
#Get data from pointer argument
set $start = (((unsigned long*)$esp)[arg_index_of_paramater_you_want])
set $end = ($start + length_of_out_paramter)
append binary memory test.bin $start $end
cont
end

#Fix gdb because it will print every time breakpoint hits, which triggers pagination
set pagination off
#Go
cont