How to watch for changes in a location of memory

How to watch for changes in a location of memory

[Stefano Sabatini]

Hi all,

I would like to check a variable in memory, I don't know in which
function is modified, so I can't do a simple watch on a variable name.

So I wonder if it is possible (gdb 6.8) to watch for a variable using
the location rather than the var name.

I'll try to express it more clearly: for example if I have a struct:
FooCtx* ctx;

containing a field foo, ctx is defined somewhere in the code, and may
be accessed from different contexts, for example:

trash->junk->ctx->foo;
bar->ctx->foo;

etc.

How can I monitor for changes in ctx->foo simply specifying its
location in memory (&ctx->foo), is it currently possible with gdb at
all?

Sorry if I overlooked something obvious.

Thanks in advance, regards.

Re: How to watch for changes in a location of memory

[Eran Ifrah]

You might want to try the 'watch' command which will causes gdb to
break whenever the memory at a given addr has been modified

Read here for more details:

http://sources.redhat.com/gdb/current/onlinedocs/gdb_6.html#SEC34

Eran

On Fri, Aug 8, 2008 at 10:10 AM, Stefano Sabatini
<stefano.sabatini-lala@poste.it> wrote:
> Hi all,
>
> I would like to check a variable in memory, I don't know in which
> function is modified, so I can't do a simple watch on a variable name.
>
> So I wonder if it is possible (gdb 6.8) to watch for a variable using
> the location rather than the var name.
>
> I'll try to express it more clearly: for example if I have a struct:
> FooCtx* ctx;
>
> containing a field foo, ctx is defined somewhere in the code, and may
> be accessed from different contexts, for example:
>
> trash->junk->ctx->foo;
> bar->ctx->foo;
>
> etc.
>
> How can I monitor for changes in ctx->foo simply specifying its
> location in memory (&ctx->foo), is it currently possible with gdb at
> all?
>
> Sorry if I overlooked something obvious.
>
> Thanks in advance, regards.
>



-- 
Eran Ifrah
eran.ifrah@gmail.com

Re: How to watch for changes in a location of memory

[Stefano Sabatini]

On date Friday 2008-08-08 10:37:50 +0200, Eran Ifrah wrote:
> You might want to try the 'watch' command which will causes gdb to
> break whenever the memory at a given addr has been modified
> 
> Read here for more details:
> 
> http://sources.redhat.com/gdb/current/onlinedocs/gdb_6.html#SEC34

Thank you for the good pointer, yes indeed it seems it does what I
want, which is basically:
watch &ctx->foo;

and yes I'll try to RTFM before to post a question the next time!!

[...]

Regards.

Re: How to watch for changes in a location of memory

[Stefano Sabatini]

On date Friday 2008-08-08 10:37:50 +0200, Eran Ifrah wrote:
> You might want to try the 'watch' command which will causes gdb to
> break whenever the memory at a given addr has been modified
> 
> Read here for more details:
> 
> http://sources.redhat.com/gdb/current/onlinedocs/gdb_6.html#SEC34

Thank you for the good pointer, yes indeed it seems it does what I
want, which is basically:
watch &ctx->foo;

and yes I'll try to RTFM before to post a question the next time!!

[...]

Regards.

Re: How to watch for changes in a location of memory

[Andreas Schwab]

Stefano Sabatini <stefano.sabatini-lala@poste.it> writes:

> On date Friday 2008-08-08 10:37:50 +0200, Eran Ifrah wrote:
>> You might want to try the 'watch' command which will causes gdb to
>> break whenever the memory at a given addr has been modified
>> 
>> Read here for more details:
>> 
>> http://sources.redhat.com/gdb/current/onlinedocs/gdb_6.html#SEC34
>
> Thank you for the good pointer, yes indeed it seems it does what I
> want, which is basically:
> watch &ctx->foo;

This is equivalent to `watch ctx', since the address of ctx->foo can
only change if ctx changes.  Watching an address of something is
generally not usefull.

Andreas.

-- 
Andreas Schwab, SuSE Labs, schwab@suse.de
SuSE Linux Products GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
PGP key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."

Re: How to watch for changes in a location of memory

[Andreas Schwab]

Stefano Sabatini <stefano.sabatini-lala@poste.it> writes:

> On date Friday 2008-08-08 10:37:50 +0200, Eran Ifrah wrote:
>> You might want to try the 'watch' command which will causes gdb to
>> break whenever the memory at a given addr has been modified
>> 
>> Read here for more details:
>> 
>> http://sources.redhat.com/gdb/current/onlinedocs/gdb_6.html#SEC34
>
> Thank you for the good pointer, yes indeed it seems it does what I
> want, which is basically:
> watch &ctx->foo;

This is equivalent to `watch ctx', since the address of ctx->foo can
only change if ctx changes.  Watching an address of something is
generally not usefull.

Andreas.

-- 
Andreas Schwab, SuSE Labs, schwab@suse.de
SuSE Linux Products GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
PGP key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."

Re: How to watch for changes in a location of memory

[Eli Zaretskii]

> From: Andreas Schwab <schwab@suse.de>
> Cc: gdb Mailing List <gdb@sources.redhat.com>
> Date: Fri, 08 Aug 2008 13:55:47 +0200
> 
> Stefano Sabatini <stefano.sabatini-lala@poste.it> writes:
> 
> > Thank you for the good pointer, yes indeed it seems it does what I
> > want, which is basically:
> > watch &ctx->foo;
> 
> This is equivalent to `watch ctx', since the address of ctx->foo can
> only change if ctx changes.  Watching an address of something is
> generally not usefull.

And "watch ctx" is also not generally useful, because most platforms
cannot watch large structures.

Re: How to watch for changes in a location of memory

[Eli Zaretskii]

> From: Andreas Schwab <schwab@suse.de>
> Cc: gdb Mailing List <gdb@sources.redhat.com>
> Date: Fri, 08 Aug 2008 13:55:47 +0200
> 
> Stefano Sabatini <stefano.sabatini-lala@poste.it> writes:
> 
> > Thank you for the good pointer, yes indeed it seems it does what I
> > want, which is basically:
> > watch &ctx->foo;
> 
> This is equivalent to `watch ctx', since the address of ctx->foo can
> only change if ctx changes.  Watching an address of something is
> generally not usefull.

And "watch ctx" is also not generally useful, because most platforms
cannot watch large structures.

Re: How to watch for changes in a location of memory

[Andreas Schwab]

Eli Zaretskii <eliz@gnu.org> writes:

>> From: Andreas Schwab <schwab@suse.de>
>> Cc: gdb Mailing List <gdb@sources.redhat.com>
>> Date: Fri, 08 Aug 2008 13:55:47 +0200
>> 
>> Stefano Sabatini <stefano.sabatini-lala@poste.it> writes:
>> 
>> > Thank you for the good pointer, yes indeed it seems it does what I
>> > want, which is basically:
>> > watch &ctx->foo;
>> 
>> This is equivalent to `watch ctx', since the address of ctx->foo can
>> only change if ctx changes.  Watching an address of something is
>> generally not usefull.
>
> And "watch ctx" is also not generally useful, because most platforms
> cannot watch large structures.

In this example, ctx is a pointer (otherwise ctx->foo wouldn't work),
which is small enough on all platforms.

Andreas.

-- 
Andreas Schwab, SuSE Labs, schwab@suse.de
SuSE Linux Products GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
PGP key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."

Re: How to watch for changes in a location of memory

[Andreas Schwab]

Eli Zaretskii <eliz@gnu.org> writes:

>> From: Andreas Schwab <schwab@suse.de>
>> Cc: gdb Mailing List <gdb@sources.redhat.com>
>> Date: Fri, 08 Aug 2008 13:55:47 +0200
>> 
>> Stefano Sabatini <stefano.sabatini-lala@poste.it> writes:
>> 
>> > Thank you for the good pointer, yes indeed it seems it does what I
>> > want, which is basically:
>> > watch &ctx->foo;
>> 
>> This is equivalent to `watch ctx', since the address of ctx->foo can
>> only change if ctx changes.  Watching an address of something is
>> generally not usefull.
>
> And "watch ctx" is also not generally useful, because most platforms
> cannot watch large structures.

In this example, ctx is a pointer (otherwise ctx->foo wouldn't work),
which is small enough on all platforms.

Andreas.

-- 
Andreas Schwab, SuSE Labs, schwab@suse.de
SuSE Linux Products GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
PGP key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."

Re: How to watch for changes in a location of memory

[Paul Koning]

>>>>> "Andreas" == Andreas Schwab <schwab@suse.de> writes:

 Andreas> Eli Zaretskii <eliz@gnu.org> writes:
 >>> From: Andreas Schwab <schwab@suse.de> Cc: gdb Mailing List
 >>> <gdb@sources.redhat.com> Date: Fri, 08 Aug 2008 13:55:47 +0200
 >>> 
 >>> Stefano Sabatini <stefano.sabatini-lala@poste.it> writes:
 >>> 
 >>> > Thank you for the good pointer, yes indeed it seems it does
 >>> what I > want, which is basically: > watch &ctx->foo;
 >>> 
 >>> This is equivalent to `watch ctx', since the address of ctx->foo
 >>> can only change if ctx changes.  Watching an address of something
 >>> is generally not usefull.
 >>  And "watch ctx" is also not generally useful, because most
 >> platforms cannot watch large structures.

 Andreas> In this example, ctx is a pointer (otherwise ctx->foo
 Andreas> wouldn't work), which is small enough on all platforms.

Right.  But from the original note it seems that the requester is
interested in catching changes to field foo of the structure that ctx
points to.

The thing that confuses lots of people when they first use the "watch"
command is that the intuitive meaning is "watch this address" but the
actual meaning is "watch this expression".  So Stefano wrote 
"watch &ctx->foo" but to get the effect that I believe was intended
you'd want "watch ctx->foo".

Similarly, to watch a specific numeric address, you have to say
"watch *(T*)0x123454" as opposed to "watch 0x123454" or something like
that.

	paul

Re: How to watch for changes in a location of memory

[Paul Koning]

>>>>> "Andreas" == Andreas Schwab <schwab@suse.de> writes:

 Andreas> Eli Zaretskii <eliz@gnu.org> writes:
 >>> From: Andreas Schwab <schwab@suse.de> Cc: gdb Mailing List
 >>> <gdb@sources.redhat.com> Date: Fri, 08 Aug 2008 13:55:47 +0200
 >>> 
 >>> Stefano Sabatini <stefano.sabatini-lala@poste.it> writes:
 >>> 
 >>> > Thank you for the good pointer, yes indeed it seems it does
 >>> what I > want, which is basically: > watch &ctx->foo;
 >>> 
 >>> This is equivalent to `watch ctx', since the address of ctx->foo
 >>> can only change if ctx changes.  Watching an address of something
 >>> is generally not usefull.
 >>  And "watch ctx" is also not generally useful, because most
 >> platforms cannot watch large structures.

 Andreas> In this example, ctx is a pointer (otherwise ctx->foo
 Andreas> wouldn't work), which is small enough on all platforms.

Right.  But from the original note it seems that the requester is
interested in catching changes to field foo of the structure that ctx
points to.

The thing that confuses lots of people when they first use the "watch"
command is that the intuitive meaning is "watch this address" but the
actual meaning is "watch this expression".  So Stefano wrote 
"watch &ctx->foo" but to get the effect that I believe was intended
you'd want "watch ctx->foo".

Similarly, to watch a specific numeric address, you have to say
"watch *(T*)0x123454" as opposed to "watch 0x123454" or something like
that.

	paul