目前我正在做CTF挑战,我经常使用gdb。对于溢出(通过 printf 获取信息或用 put 覆盖 RET 指针),从
info frame
命令获取本地指针非常有帮助(因为在这里你会找到堆栈金丝雀和返回指针):
Stack level 5, frame at 0x7fff2baf0c70:
rip = 0x55cf7d42e27f in cannary_words (main.c:40); saved rip = 0x55cf7d42e36a
called by frame at 0x7fff2baf0c90, caller of frame at 0x7fff2baf0bb0
source language c.
Arglist at 0x7fff2baf0c60, args:
Locals at 0x7fff2baf0c60, Previous frame's sp is 0x7fff2baf0c70
Saved registers:
rbp at 0x7fff2baf0c60, rip at 0x7fff2baf0c68
在此示例中,本地指针是
0x7fff2baf0c60
。因为一直手动复制它非常乏味,而且不适合编写脚本,所以我想知道是否有一个方便的变量来存储它的值。
通过反复试验,我发现 $rip 保存着 rip 值。我找不到任何与 show convenience
命令有帮助的内容。
有人有想法吗?
找到了。要打印地址,请执行以下操作:
print $rbp