title: Search string in memory within GDB
body: <p>I am currently working on memory corruption techniques for a study and especially ROP and ret2libc. I've read many times that for achieving a <code>system()</code> call, the address of the string of <code>/bin/sh</code> (or equivalent) was required on the stack. I managed to get it when dealing with environment variables, but I wanted to known if the string was present in the libc:</p>
  
  <pre><code>$ strings libc-2.22.so  | grep -i /bin/sh
  /bin/sh
  </code></pre>
  
  <p>Okay, but when searching the string with the process started, I saw some strange behaviour:</p>
  
  <pre><code>user@protostar:/opt/protostar/bin$ gdb -q ./stack6
  Reading symbols from /opt/protostar/bin/stack6...done.
  (gdb) start
  Temporary breakpoint 1 at 0x8048500: file stack6/stack6.c, line 27.
  Starting program: /opt/protostar/bin/stack6 
  
  Temporary breakpoint 1, main (argc=1, argv=0xbffff854) at stack6/stack6.c:27
  27  stack6/stack6.c: No such file or directory.
      in stack6/stack6.c
  (gdb) find __libc_start_main,+999999,"/bin/sh"
  Pattern not found.
  (gdb) find __libc_start_main,+99999999,"/bin/sh"
  0xb7fba23f
  warning: Unable to access target memory at 0xb7fd9647, halting search.
  1 pattern found.
  (gdb) x/1s 0xb7fba23f
  0xb7fba23f:  "KIND in __gen_tempname\""
  </code></pre>
  
  <p>And more strangeness when just searching the "sh" pattern:</p>
  
  <pre><code>(gdb) find __libc_start_main,+99999999,"sh"
  0xb7fb7a95
  0xb7fb821d
  warning: Unable to access target memory at 0xb7fdb4a0, halting search.
  2 patterns found.
  (gdb) x/1s 0xb7fb7a95
  0xb7fb7a95:  "getpwuid_r"
  (gdb) x/1s 0xb7fb821d
  0xb7fb821d:  "sh"
  </code></pre>
  
  <p>In a way, I successfully conducted a ret2libc attack using the string located at 0xb7fb821d, but here are my questions:</p>
  
  <ul>
  <li>Why did GDB not "really" find the <code>/bin/sh</code> pattern?</li>
  <li>Why are matches found by gdb not really matching my search?</li>
  </ul>
  
  <p>I am pretty new to all this stuff, and even if I discovered a lot of tricks related to binary exploitation, I think that I am missing something here.</p>