Sunday, April 1, 2012

Inspecting the Process Environment Variables with GDB

While trying to solve the 4th level of the vortex wargame, I found it was necessary to learn how to inspect the location and content of the environment variables within the process memory.

GDB has built-in commands to inspect the process environment, see the GDB manual. You can either list all environment variables or a specific one (e.g. FOOBAR) using the following commands, which will output their values:
(gdb) show environment
(gdb) show environment FOOBAR
In order to locate the environment variables within the process memory, you can query the variable char** environ (see the libc reference and this entry on stack overflow):
(gdb) x/s *((char **)environ)
This will print the location of the first environment variable and its representation as string. To print the next variables, simply add an offset to the variable:
(gdb) x/s *((char **)environ + 1)

I also found these links to be useful: