[ACCEPTED]-How to find a function's memory address with lldb?-lldb

Accepted answer
Score: 18

The command in lldb is "image lookup". I 13 think an example of "info func" <-> "image 12 lookup" was recently added to the lldb/gdb 11 command page - http://lldb.llvm.org/lldb-gdb.html


(lldb) im loo -n puts
1 match found in /usr/lib/system/libsystem_c.dylib:
        Address: libsystem_c.dylib[0x0000000000011d9a] (libsystem_c.dylib.__TEXT.__text + 69850)
        Summary: libsystem_c.dylib`puts

although this is only 10 showing you the offset in libsystem_c.dylib 9 here (0x11d9a) -- to see the actual load 8 address you would need to use the "-v" option 7 to image lookup which will show the range 6 of addresses that puts covers. Or you could 5 do this more directly with the back tick 4 notation in lldb,

(lldb) reg read pc
     rip = 0x0000000100000f2b  a.out`main + 11 at a.c:3
(lldb) reg write pc `(void(*)())puts`
(lldb) reg read pc
     rip = 0x00007fff99ce1d9a  libsystem_c.dylib`puts

OK I had to cast puts() because 3 lldb needed a function prototype here - not 2 super convenient, but if it's one of your 1 own functions that isn't needed:

(lldb) reg write pc `main`
(lldb) reg read pc
     rip = 0x0000000100000f20  a.out`main at a.c:2

More Related questions