format core dumpa

[rax666]

gdb>gcore = dump pamieci.
wiecie moze jak ma sie offset pliku do pamieci zajmowanej przez program?
napisalem testowy program

#include <stdio.h>
int main(){
char buf[]="65dsfgsg464123";
sleep(-1);
return 0;
}

skompilowalem i zrobilem dumpa.
teraz chce poznac adres strings buf.
nie bedzie zadnych debug symboli i innych pierdzieli, to jest crackme.

Mapped address spaces:

Start Addr End Addr Size Offset objfile
0x400000 0x401000 0x1000 0 /home/a/Desktop/xxx
0x600000 0x601000 0x1000 0 /home/a/Desktop/xxx
0x601000 0x602000 0x1000 0x1000 /home/a/Desktop/xxx
0x7fed6b4f1000 0x7fed6b657000 0x166000 0 /lib/libc-2.10.1.so
0x7fed6b657000 0x7fed6b856000 0x1ff000 0x166000 /lib/libc-2.10.1.so
0x7fed6b856000 0x7fed6b85a000 0x4000 0x165000 /lib/libc-2.10.1.so
0x7fed6b85a000 0x7fed6b85b000 0x1000 0x169000 /lib/libc-2.10.1.so
0x7fed6b85b000 0x7fed6b860000 0x5000 0
0x7fed6b860000 0x7fed6b87f000 0x1f000 0 /lib/ld-2.10.1.so
0x7fed6ba60000 0x7fed6ba62000 0x2000 0
0x7fed6ba7b000 0x7fed6ba7e000 0x3000 0
0x7fed6ba7e000 0x7fed6ba7f000 0x1000 0x1e000 /lib/ld-2.10.1.so
0x7fed6ba7f000 0x7fed6ba80000 0x1000 0x1f000 /lib/ld-2.10.1.so
0x7fff4f4e7000 0x7fff4f4fc000 0x15000 0 [stack]
0x7fff4f5ff000 0x7fff4f600000 0x1000 0 [vdso]
0xffffffffff600000 0xffffffffff601000 0x1000 0 [vsyscall]



offset = 0x22bf8.
0x7fed6b4f1000 + 22bf8 - 0x3000 = 0x7fed6b676bf8: <Address 0x7fed6b676bf8 out of bounds>