Help/Support Searching heap memory with lldb

tanis · October 30, 2018

Is there any simple way to search the heap memory with lldb? Anyone who erote a script to do just that?

Cheers!

Ted2 · October 30, 2018

There's a memory read command if that's what you mean

tanis · October 30, 2018

15 minutes ago, Ted2 said:

There's a memory read command if that's what you mean

Yes, I know about

mem find -s "mystring" -- 0x000000010216b000 0x000000010295f000

but you need to find out the addresses of the memory arenas that have been allocated by malloc and friends which is not obvious.

You can get a list of memory sections with

image dump sections

but those are the allocations made when the executable is being launched and memory allocated statically. All the memory allocation functions do not end up in that list and I'm not aware of any easy way to track them down.

Ted2 · October 30, 2018

5 hours ago, tanis said:
Yes, I know about
mem find -s "mystring" -- 0x000000010216b000 0x000000010295f000
but you need to find out the addresses of the memory arenas that have been allocated by malloc and friends which is not obvious.

You can get a list of memory sections with
image dump sections
but those are the allocations made when the executable is being launched and memory allocated statically. All the memory allocation functions do not end up in that list and I'm not aware of any easy way to track them down.

See this page here:

https://lldb.llvm.org/lldb-gdb.html

tanis · October 31, 2018

That's fine if you know the address. But in my case I don't know the address of what I'm looking for so I need to find out the virtual address space assigned to the process and read the list of regions in there to scan each of them.

I stumbled upon lldbinit https://github.com/gdbinit/lldbinit and it's got a findmem command that seems to work with malloc-ed memory as well (notice the MALLOC_SMALL):

(lldbinit) findmem -s ciao
Found at : 0000000100000F74 base : 0000000100000000 off : 00000F74 __TEXT
Found at : 0000000101000000 base : 0000000100800000 off : 00800000 MALLOC_SMALL
Found at : 00007FFFC9D3FF74 base : 00007FFFC1F04000 off : 07E3BF74 __LINKEDIT
Found at : 00007FFFC9D4165F                         off : 07E3D65F __LINKEDIT

This pretty much solves most of my problems.