Cyber Training GuideHow-To: GDB

Symbols and Strings

Symbols and strings are vital info. Strings are super telling about the functionality of the binary, and symbols are useful for understanding the variables and functions.

Strings

The iz submodule is responsible for finding strings. Based on the help pages for this submodule, we have the following options:

[0x0804923c]> iz?
| iz[?][j]           strings in data sections (in JSON/Base64)
| iz*                print flags and comments r2 commands for all the strings
| izz                search for Strings in the whole binary
| izz*               same as iz* but exposing the strings of the whole binary
| izzz               dump Strings from whole binary to r2 shell (for huge files)
| iz- [addr]         purge string via bin.str.purge

The most important two commands here are iz and izz. The other commands perform similar functions, but these two format strings in the most readable way.

[0x08049050]> iz
[Strings]
nth paddr      vaddr      len size section type  string
―――――――――――――――――――――――――――――――――――――――――――――――――――――――
0   0x00002008 0x0804a008 9   10   .rodata ascii You lose!
1   0x00002012 0x0804a012 12  13   .rodata ascii cat flag.txt
2   0x0000201f 0x0804a01f 23  24   .rodata ascii Good luck winning here!

Symbols and Variables

Use the is command to list the available symbols.

[0x0804923c]> is
[Symbols]
nth paddr      vaddr      bind   type   size lib name                                   demangled
―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――
8   0x00002004 0x0804a004 GLOBAL OBJ    4        _IO_stdin_used
1   ---------- 0x00000000 LOCAL  FILE   0        crt1.o
2   0x000001cc 0x080481cc LOCAL  OBJ    32       __abi_tag
3   ---------- 0x00000000 LOCAL  FILE   0        crtstuff.c
4   0x000010f0 0x080490f0 LOCAL  FUNC   0        deregister_tm_clones
5   0x00001130 0x08049130 LOCAL  FUNC   0        register_tm_clones
6   0x00001170 0x08049170 LOCAL  FUNC   0        __do_global_dtors_aux
7   ---------- 0x0804c028 LOCAL  OBJ    1        completed.0
8   0x00002f0c 0x0804bf0c LOCAL  OBJ    0        __do_global_dtors_aux_fini_array_entry
9   0x000011a0 0x080491a0 LOCAL  FUNC   0        frame_dummy
10  0x00002f08 0x0804bf08 LOCAL  OBJ    0        __frame_dummy_init_array_entry
11  ---------- 0x00000000 LOCAL  FILE   0        args.c
12  ---------- 0x00000000 LOCAL  FILE   0        crtstuff.c
13  0x0000215c 0x0804a15c LOCAL  OBJ    0        __FRAME_END__
14  ---------- 0x00000000 LOCAL  FILE   0
15  0x00002f10 0x0804bf10 LOCAL  OBJ    0        _DYNAMIC
16  0x00002038 0x0804a038 LOCAL  NOTYPE 0        __GNU_EH_FRAME_HDR
17  0x00003000 0x0804c000 LOCAL  OBJ    0        _GLOBAL_OFFSET_TABLE_
19  0x000010e0 0x080490e0 GLOBAL FUNC   4        __x86.get_pc_thunk.bx
20  0x00003020 0x0804c020 WEAK   NOTYPE 0        data_start
23  ---------- 0x0804c028 GLOBAL NOTYPE 0        _edata
24  0x00001258 0x08049258 GLOBAL FUNC   0        _fini
25  0x00003020 0x0804c020 GLOBAL NOTYPE 0        __data_start
29  0x00003024 0x0804c024 GLOBAL OBJ    0        __dso_handle
30  0x00002004 0x0804a004 GLOBAL OBJ    4        _IO_stdin_used
31  0x000011a6 0x080491a6 GLOBAL FUNC   73       win
32  ---------- 0x0804c02c GLOBAL NOTYPE 0        _end
33  0x000010d0 0x080490d0 GLOBAL FUNC   5        _dl_relocate_static_pie
34  0x00001090 0x08049090 GLOBAL FUNC   49       _start
35  0x00002000 0x0804a000 GLOBAL OBJ    4        _fp_hw
37  ---------- 0x0804c028 GLOBAL NOTYPE 0        __bss_start
38  0x0000123c 0x0804923c GLOBAL FUNC   24       main
39  0x00001254 0x08049254 GLOBAL FUNC   0        __x86.get_pc_thunk.ax
40  0x000011ef 0x080491ef GLOBAL FUNC   77       read_in
41  ---------- 0x0804c028 GLOBAL OBJ    0        __TMC_END__
42  0x00001000 0x08049000 GLOBAL FUNC   0        _init
1   0x00001040 0x08049040 GLOBAL FUNC   16       imp.__libc_start_main
2   0x00001050 0x08049050 GLOBAL FUNC   16       imp.fflush
3   0x00001060 0x08049060 GLOBAL FUNC   16       imp.gets
4   0x00001070 0x08049070 GLOBAL FUNC   16       imp.puts
5   0x00001080 0x08049080 GLOBAL FUNC   16       imp.system
6   ---------- ---------- WEAK   NOTYPE 16       imp.__gmon_start__
7   ---------- ---------- GLOBAL OBJ    16       imp.stdout

To get the list of variables, we need to filter for the objects in this list. We can do this using the ~ operator (the grep operator).

[0x0804923c]> is~OBJ
8   0x00002004 0x0804a004 GLOBAL OBJ    4        _IO_stdin_used
2   0x000001cc 0x080481cc LOCAL  OBJ    32       __abi_tag
7   ---------- 0x0804c028 LOCAL  OBJ    1        completed.0
8   0x00002f0c 0x0804bf0c LOCAL  OBJ    0        __do_global_dtors_aux_fini_array_entry
10  0x00002f08 0x0804bf08 LOCAL  OBJ    0        __frame_dummy_init_array_entry
13  0x0000215c 0x0804a15c LOCAL  OBJ    0        __FRAME_END__
15  0x00002f10 0x0804bf10 LOCAL  OBJ    0        _DYNAMIC
17  0x00003000 0x0804c000 LOCAL  OBJ    0        _GLOBAL_OFFSET_TABLE_
29  0x00003024 0x0804c024 GLOBAL OBJ    0        __dso_handle
30  0x00002004 0x0804a004 GLOBAL OBJ    4        _IO_stdin_used
35  0x00002000 0x0804a000 GLOBAL OBJ    4        _fp_hw
41  ---------- 0x0804c028 GLOBAL OBJ    0        __TMC_END__
7   ---------- ---------- GLOBAL OBJ    16       imp.stdout
PreviousChecking SecurityNextStatic Analysis: The a Module

Last updated