A little but interesting memory

2016-04-16  本文已影响0人  葛星辰
Memory dump tool in Visual Studio 2015

Visual Studio has a memory dump tool.At the first time I use this tool,I thought it is arcane.But in the process of reading The C Programming Language(Second Edition),I found I can write a similar tool with few lines of codes.

void myputchar(char ch){
    switch(ch){
        case '\n':
            myputchar('\\');
            myputchar('n');
            break;
        case '\r':
            myputchar('\\');
            myputchar('r');
            break;            
        default:
            putchar(ch);
            break;
    }
}


void memory_dump(unsigned char* po,int len){
    for (int i = 0; i < len ; i++)
        if ( i % 16 == 15){
      
            printf("%.2X     ",*(i+po));
            for (int j = i - 15;j < i + 1;j++)
                myputchar(*(j+po)); //myputchar() is used to handle '\r' ,'\n'  in case of unexpected new line
            putchar('\n');
            }
        else if ( i % 16 == 0){
            printf("%X: ",(i+po));
            printf("%.2X ",*(i+po));
            }            
        else
            printf("%.2X ",*(i+po));
}

po is the address of the begining byte of a memory area you want to dump,len is the length of this memory area.

Here is an example of how to use this funtion:

#include <stdio.h>
#include <string.h>

void myputchar(char ch){
    switch(ch){
        case '\n':
            myputchar('\\');
            myputchar('n');
            break;
        case '\r':
            myputchar('\\');
            myputchar('r');
            break;            
        default:
            putchar(ch);
            break;
    }
}


void memory_dump(unsigned char* po,int len){
    for (int i = 0; i < len ; i++)
        if ( i % 16 == 15){
      
            printf("%.2X     ",*(i+po));
            for (int j = i - 15;j < i + 1;j++)
                myputchar(*(j+po));
            putchar('\n');
            }
        else if ( i % 16 == 0){
            printf("%X: ",(i+po));
            printf("%.2X ",*(i+po));
            }            
        else
            printf("%.2X ",*(i+po));
}


int main(){
           
    char amessage1[] = "My name is Vincent,";
    char amessage2[] = "I love the c programing language!";
    unsigned char* po1 = (unsigned char*) amessage1;
    unsigned char* po2 = (unsigned char*) amessage2;
    unsigned char* po;
    if (po1 < po2)
        po = po1;
    else
        po = po2;        
        
    memory_dump(po,192);
    
    putchar('\n');    
    
    strcat(amessage1,amessage2);
    
    memory_dump(po,192);
            
}
Result in Windows Result in Ubuntu

In this example, the program on Windows stopped working,the program on Ubuntu worked properly.We can see the memory change after evaluating the expression strcat(amessage1,amessage2);.

In Windows,the address of string "My name is Vincent," is higher than that of string "I love the c programing language!",which is the opposite on Ubuntu.The program tends to append the string "I love the c programing language!" to the string "My name is Vincent,".So the program in Windows overrided some unknown bytes which have higher address.These bytes may contains some important imformation like the return address of the function main (I am not very sure) according to my previous article An experiment on buffer overflow .Another string function strcpy() will have the same problem.They don't check if the elements they manipulate are out of the range of the array. So we can see string functions in <string.h> like strcpy(),strcat() are not safe.

上一篇下一篇

猜你喜欢

热点阅读