Question

Here I’m examining a simple program written in C that saves a char pointer to a string that says “Hello, world!\n”

Here is the output of my GDB… I’m confused at the inconsistency of GDB and what’s right here:

$ gcc -g pointer.c
$ gdb -q ./a.out
Reading symbols for shared libraries .. done
(gdb) list
1   #include <stdio.h>
2   #include <string.h>
3   
4   int main() {
5     char str[20];
6     char *pointer;
7   
8     strcpy(str, "Hello, world!\n");
9     pointer = str;
10    printf("%s",pointer);
(gdb) 
11  }
(gdb) break 10
Breakpoint 1 at 0x100000ed1: file pointer.c, line 10.
(gdb) run
Starting program: /Users/___/a.out 
Reading symbols for shared libraries +. done

Breakpoint 1, main () at pointer.c:10
10    printf("%s",pointer);
(gdb) print pointer
$1 = 0x7fff5fbff950 "Hello, world!\n"
(gdb) print &pointer
$2 = (char **) 0x7fff5fbff948
(gdb) x/s 0x7fff5fbff950
0x7fff5fbff950:  "Hello, world!\n"
(gdb) x/16b 0x7fff5fbff950
0x7fff5fbff950:  "Hello, world!\n"
0x7fff5fbff95f:  ""
0x7fff5fbff960:  "x??_?"
0x7fff5fbff967:  ""
0x7fff5fbff968:  "՝?Y4?K\033???_?"
0x7fff5fbff977:  ""
0x7fff5fbff978:  "?\016"
0x7fff5fbff97b:  ""
0x7fff5fbff97c:  "\001"
0x7fff5fbff97e:  ""
0x7fff5fbff97f:  ""
0x7fff5fbff980:  ""
0x7fff5fbff981:  ""
0x7fff5fbff982:  ""
0x7fff5fbff983:  ""
0x7fff5fbff984:  ""
(gdb) x/x 0x7fff5fbff950
0x7fff5fbff950: 0x48
(gdb) x/x 0x7fff5fbff951
0x7fff5fbff951: 0x65
(gdb) x/s 0x7fff5fbff951
0x7fff5fbff951:  "ello, world!\n"
(gdb) print &pointer
$3 = (char **) 0x7fff5fbff948
(gdb) x/x 0x7fff5fbff948
0x7fff5fbff948: 0x00007fff5fbff950
(gdb) x/x 0x7fff5fbff949
0x7fff5fbff949: 0x4800007fff5fbff9
(gdb) x/2x 0x00007fff5fbff950
0x7fff5fbff950: 0x77202c6f6c6c6548  0x00000a21646c726f

My questions are:

How many bytes of information is stored in one of these locations in memory? When I’m at the address
0x7fff5fbff950, the contents appear to be 0x48 (ASCII ‘H’). So does that mean, per memory address, only a byte of information is stored? OK. Let’s assume it does. Then I run the same “x/x” command on the address given by print &pointer: 0x7fff5fbff948

I got value 0x00007fff5fbff950, which I recognize (ignoring the leading zeros) to be the beginning of the “Hello, world!\n” string in memory.

Now how can 0x00007fff5fbff948 contain 0x00007fff5fbff950 and still have only one byte of memory? So I look at 0x00007fff5fbff949… and this now tells me again that we’re only looking at a byte each time, since we lost the trailing 0x50 (I know little-endian so maybe I’m wording this confusingly).

Now I get really mad… I try to do x/2x 0x7fff5fbff948 and I’m attacked with two gigantic hexadecimal numbers…

So data in memory is stored byte at a time, and somehow x/x will sometimes give me one byte per memory and sometimes give me an entire address? How can I control what the debugger will output? x/x should be examine the contents of this address and output in hexadecimal. I can use x/b for a single byte, x/2b for 2 bytes… but x/2x means what?

Sorry for the stream of consciousness questions.. hopefully someone can help me clear this up.

Answer 1

Memory is byte addressable meaning each byte has a distinct address. Then you can interpret say a pair of bytes as a 16-bit integer, four bytes as a 32-bit integer, etc. That format specifier lets you do just that – print content of memory according to your interpretation of it. So x/2x 0x7fff5fbff948 will print two word-size (here 64-bit) integers, first at address 0x7fff5fbff948, and second at address 0x7fff5fbff950.