| <html lang="en"> |
| <head> |
| <title>Searching Memory - Debugging with GDB</title> |
| <meta http-equiv="Content-Type" content="text/html"> |
| <meta name="description" content="Debugging with GDB"> |
| <meta name="generator" content="makeinfo 4.13"> |
| <link title="Top" rel="start" href="index.html#Top"> |
| <link rel="up" href="Data.html#Data" title="Data"> |
| <link rel="prev" href="Caching-Target-Data.html#Caching-Target-Data" title="Caching Target Data"> |
| <link rel="next" href="Value-Sizes.html#Value-Sizes" title="Value Sizes"> |
| <link href="http://www.gnu.org/software/texinfo/" rel="generator-home" title="Texinfo Homepage"> |
| <!-- |
| Copyright (C) 1988-2019 Free Software Foundation, Inc. |
| |
| Permission is granted to copy, distribute and/or modify this document |
| under the terms of the GNU Free Documentation License, Version 1.3 or |
| any later version published by the Free Software Foundation; with the |
| Invariant Sections being ``Free Software'' and ``Free Software Needs |
| Free Documentation'', with the Front-Cover Texts being ``A GNU Manual,'' |
| and with the Back-Cover Texts as in (a) below. |
| |
| (a) The FSF's Back-Cover Text is: ``You are free to copy and modify |
| this GNU Manual. Buying copies from GNU Press supports the FSF in |
| developing GNU and promoting software freedom.'' |
| --> |
| <meta http-equiv="Content-Style-Type" content="text/css"> |
| <style type="text/css"><!-- |
| pre.display { font-family:inherit } |
| pre.format { font-family:inherit } |
| pre.smalldisplay { font-family:inherit; font-size:smaller } |
| pre.smallformat { font-family:inherit; font-size:smaller } |
| pre.smallexample { font-size:smaller } |
| pre.smalllisp { font-size:smaller } |
| span.sc { font-variant:small-caps } |
| span.roman { font-family:serif; font-weight:normal; } |
| span.sansserif { font-family:sans-serif; font-weight:normal; } |
| --></style> |
| </head> |
| <body> |
| <div class="node"> |
| <a name="Searching-Memory"></a> |
| <p> |
| Next: <a rel="next" accesskey="n" href="Value-Sizes.html#Value-Sizes">Value Sizes</a>, |
| Previous: <a rel="previous" accesskey="p" href="Caching-Target-Data.html#Caching-Target-Data">Caching Target Data</a>, |
| Up: <a rel="up" accesskey="u" href="Data.html#Data">Data</a> |
| <hr> |
| </div> |
| |
| <h3 class="section">10.22 Search Memory</h3> |
| |
| <p><a name="index-searching-memory-830"></a> |
| Memory can be searched for a particular sequence of bytes with the |
| <code>find</code> command. |
| |
| |
| <a name="index-find-831"></a> |
| <dl><dt><code>find </code><span class="roman">[</span><code>/</code><var>sn</var><span class="roman">]</span> <var>start_addr</var><code>, +</code><var>len</var><code>, </code><var>val1</var> <span class="roman">[</span><code>, </code><var>val2</var><code>, ...</code><span class="roman">]</span><dt><code>find </code><span class="roman">[</span><code>/</code><var>sn</var><span class="roman">]</span> <var>start_addr</var><code>, </code><var>end_addr</var><code>, </code><var>val1</var> <span class="roman">[</span><code>, </code><var>val2</var><code>, ...</code><span class="roman">]</span><dd>Search memory for the sequence of bytes specified by <var>val1</var>, <var>val2</var>, |
| etc. The search begins at address <var>start_addr</var> and continues for either |
| <var>len</var> bytes or through to <var>end_addr</var> inclusive. |
| </dl> |
| |
| <p><var>s</var> and <var>n</var> are optional parameters. |
| They may be specified in either order, apart or together. |
| |
| <dl> |
| <dt><var>s</var><span class="roman">, search query size</span><dd>The size of each search query value. |
| |
| <dl> |
| <dt><code>b</code><dd>bytes |
| <br><dt><code>h</code><dd>halfwords (two bytes) |
| <br><dt><code>w</code><dd>words (four bytes) |
| <br><dt><code>g</code><dd>giant words (eight bytes) |
| </dl> |
| |
| <p>All values are interpreted in the current language. |
| This means, for example, that if the current source language is C/C<tt>++</tt> |
| then searching for the string “hello” includes the trailing '\0'. |
| The null terminator can be removed from searching by using casts, |
| e.g.: ‘<samp><span class="samp">{char[5]}"hello"</span></samp>’. |
| |
| <p>If the value size is not specified, it is taken from the |
| value's type in the current language. |
| This is useful when one wants to specify the search |
| pattern as a mixture of types. |
| Note that this means, for example, that in the case of C-like languages |
| a search for an untyped 0x42 will search for ‘<samp><span class="samp">(int) 0x42</span></samp>’ |
| which is typically four bytes. |
| |
| <br><dt><var>n</var><span class="roman">, maximum number of finds</span><dd>The maximum number of matches to print. The default is to print all finds. |
| </dl> |
| |
| <p>You can use strings as search values. Quote them with double-quotes |
| (<code>"</code>). |
| The string value is copied into the search pattern byte by byte, |
| regardless of the endianness of the target and the size specification. |
| |
| <p>The address of each match found is printed as well as a count of the |
| number of matches found. |
| |
| <p>The address of the last value found is stored in convenience variable |
| ‘<samp><span class="samp">$_</span></samp>’. |
| A count of the number of matches is stored in ‘<samp><span class="samp">$numfound</span></samp>’. |
| |
| <p>For example, if stopped at the <code>printf</code> in this function: |
| |
| <pre class="smallexample"> void |
| hello () |
| { |
| static char hello[] = "hello-hello"; |
| static struct { char c; short s; int i; } |
| __attribute__ ((packed)) mixed |
| = { 'c', 0x1234, 0x87654321 }; |
| printf ("%s\n", hello); |
| } |
| </pre> |
| <p class="noindent">you get during debugging: |
| |
| <pre class="smallexample"> (gdb) find &hello[0], +sizeof(hello), "hello" |
| 0x804956d <hello.1620+6> |
| 1 pattern found |
| (gdb) find &hello[0], +sizeof(hello), 'h', 'e', 'l', 'l', 'o' |
| 0x8049567 <hello.1620> |
| 0x804956d <hello.1620+6> |
| 2 patterns found. |
| (gdb) find &hello[0], +sizeof(hello), {char[5]}"hello" |
| 0x8049567 <hello.1620> |
| 0x804956d <hello.1620+6> |
| 2 patterns found. |
| (gdb) find /b1 &hello[0], +sizeof(hello), 'h', 0x65, 'l' |
| 0x8049567 <hello.1620> |
| 1 pattern found |
| (gdb) find &mixed, +sizeof(mixed), (char) 'c', (short) 0x1234, (int) 0x87654321 |
| 0x8049560 <mixed.1625> |
| 1 pattern found |
| (gdb) print $numfound |
| $1 = 1 |
| (gdb) print $_ |
| $2 = (void *) 0x8049560 |
| </pre> |
| </body></html> |
| |
