Use the examine command, or its alias x, to display memory contents or addresses.
Use the following syntax to display the contents of memory starting at address for count items in format format. The default address is the next one after the last address previously displayed. The default count is 1. The default format is the same as was used in the previous examine command, or X if this is the first command given.
The syntax for the examine command is:
examine [address] [/ [count] [format]] |
To display the contents of memory from address1 through address2 inclusive, in format format, type:
examine address1, address2 [/ [format]] |
Display the address, instead of the contents of the address in the given format by typing:
examine address = [format] |
To print the value stored at the next address after the one last displayed by examine, type:
examine +/ i |
To print the value of an expression, enter the expression as an address:
examine address=format examine address= |
The address is any expression resulting in or usable as an address. The address may be replaced with a + (plus sign), which displays the contents of the next address in the default format.
For example, the following are valid addresses.:
0xff99 |
An absolute address |
main |
Address of a function |
main+20 |
Offset from a function address |
&errno |
Address of a variable |
str |
A pointer-value variable pointing to a string |
Symbolic addresses used to display memory are specified by preceding a name with an ampersand (&). Function names can be used without the ampersand; &main is equal to main. Registers are denoted by preceding a name with a dollar sign ($).
The format is the address display format in which dbx displays the results of a query. The output produced depends on the current display format. To change the display format, supply a different format code.
The default format set at the start of each dbx session is X, which displays an address or value as a 32-bit word in hexadecimal. The following memory display formats are legal.
i |
Display as an assembly instruction. |
d |
Display as 16 bits (2 bytes) in decimal. |
D |
Display as 32 bits (4 bytes) in decimal. |
o |
Display as 16 bits (2 bytes) in octal. |
O |
Display as 32 bits (4 bytes) in octal. |
x |
Display as 16 bits (2 bytes) in hexadecimal. |
X |
Display as 32 bits (4 bytes) in hexadecimal. (default format) |
b |
Display as a byte in octal. |
c |
Display as a character. |
w |
Display as a wide character. |
s |
Display as a string of characters terminated by a null byte. |
W |
Display as a wide character. |
f |
Display as a single-precision floating point number. |
F, g |
Display as a double-precision floating point number. |
E |
Display as an extended-precision floating point number. |
ld, lD |
Display 32 bits (4 bytes) in decimal (same as D). |
lo, lO |
Display 32 bits (4 bytes) in octal (same as O). |
lx, LX |
Display 32 bits (4 bytes) in hexadecimal (same as X). |
Ld, LD |
Display 64 bits (8 bytes) in decimal. |
Lo, LO |
Display 64 bits (8 bytes) in octal. |
Lx, LX |
Display 64 bits (8 bytes) in hexadecimal. |
The count is a repetition count in decimal. The increment size depends on the memory display format.
The following examples show how to use an address with count and format options to display five successive disassembled instructions starting from the current stopping point.
For SPARC based systems:
(dbx) stepi stopped in main at 0x108bc 0x000108bc: main+0x000c: st %l0, [%fp - 0x14] (dbx) x 0x108bc/5i 0x000108bc: main+0x000c: st %l0, [%fp - 0x14] 0x000108c0: main+0x0010: mov 0x1,%l0 0x000108c4: main+0x0014: or %l0,%g0, %o0 0x000108c8: main+0x0018: call 0x00020b90 [unresolved PLT 8: malloc] 0x000108cc: main+0x001c: nop |
For x86 based systems:
(dbx) x &main/5i 0x08048988: main : pushl %ebp 0x08048989: main+0x0001: movl %esp,%ebp 0x0804898b: main+0x0003: subl $0x28,%esp 0x0804898e: main+0x0006: movl 0x8048ac0,%eax 0x08048993: main+0x000b: movl %eax,-8(%ebp) |