-
Notifications
You must be signed in to change notification settings - Fork 149
GDB Expressions
GDB expressions are used in many input fields of PINCE. Once you understand it, you'll feel even more comfortable while using PINCE. For instance, lets look how you can use it for displaying data. In AddAddressManually dialog, try typing any widely used library function(such as malloc, open, printf, scanf etc). PINCE will return the value residing in the function's starting address. If you press OK button, PINCE will add the function's address and it's value to address list.
Neat, right? You can use this information to set registers on the fly as well! Double click on the registers and try typing a function name in the field, starting with a * character(*printf, *malloc etc.). You'll see that the registers will be set to the starting address of the function.
There's another use case in AddAddressManually dialog, you can allocate memory on demand! After stopping the process, some GDB expressions like below will allocate memory depending on the context. For instance:
"asdf" will return a string
{0x00ffba42} will return an integer(4byte)
{0x00000023,0x00513245} will return an array of 2 integers
After pressing OK button, PINCE will add the allocated memory address to the table
Additionally, you can use AddAddressManually dialog to see where registers point to. Try inputting some register expressions such as $rip, $rsp+6, $rip+$rax
You can also use GDB expressions for setting breakpoint conditions like this:
$eax==0x523, $rax>0 && ($rbp<0 || $rsp==0), printf($r10)==3
Inputs written in single quotes(') will be interpreted as demangled function names, for instance:
'KMinesScene::metaObject() const' will translate to _ZNK11KMinesScene10metaObjectEv. Try for yourself by using "Go to expression" option in disassembler window
Related GDB docs: