hacking-the-art-of-exploitation

The display format also uses a single-letter shorthand, which is optionally
preceded by a count of how many items to examine. Some common format
letters are as follows:
o
x
u
t
Display in octal.
Display in hexadecimal.
Display in unsigned, standard base-10 decimal.
Display in binary.
These can be used with the examine command to examine a certain
memory address. In the following example, the current address of the EIP
register is used. Shorthand commands are often used with GDB, and even
info register eip can be shortened to just i r eip.
(gdb) i r eip
eip 0x8048384 0x8048384
(gdb) x/o 0x8048384
0x8048384 : 077042707
(gdb) x/x $eip
0x8048384 : 0x00fc45c7
(gdb) x/u $eip
0x8048384 : 16532935
(gdb) x/t $eip
0x8048384 : 00000000111111000100010111000111
(gdb)
The memory the EIP register is pointing to can be examined by using the
address stored in EIP. The debugger lets you reference registers directly, so $eip
is equivalent to the value EIP contains at that moment. The value 077042707 in
octal is the same as 0x00fc45c7 in hexadecimal, which is the same as 16532935 in
base-10 decimal, which in turn is the same as 00000000111111000100010111000111
in binary. A number can also be prepended to the format of the examine command
to examine multiple units at the target address.
(gdb) x/2x $eip
0x8048384 : 0x00fc45c7 0x83000000
(gdb) x/12x $eip
0x8048384 : 0x00fc45c7 0x83000000 0x7e09fc7d 0xc713eb02
0x8048394 : 0x84842404 0x01e80804 0x8dffffff 0x00fffc45
0x80483a4 : 0xc3c9e5eb 0x90909090 0x90909090 0x5de58955
(gdb)
The default size of a single unit is a four-byte unit called a word. The size
of the display units for the examine command can be changed by adding a
size letter to the end of the format letter. The valid size letters are as follows:
b
h
w
g
A single byte
A halfword, which is two bytes in size
A word, which is four bytes in size
A giant, which is eight bytes in size
28 0x200