title: GDB find value within memory
body: <p>I am having trouble with the find command in gdb. What I am trying to do is, finding a specific value e.g. (964) within the memory of a process. I have been successfull but my solution takes way to long! </p>
  
  <p>What I did:</p>
  
  <pre><code>cat /proc/16617/maps
  </code></pre>
  
  <p>Than getting the libc_malloc parts, I know the value is within those.</p>
  
  <pre><code>7e43c000-7e451000 rw-p 00000000 00:00 0          [anon:libc_malloc]
  7e452000-7e45b000 rw-p 00000000 00:00 0          [anon:libc_malloc]
  7e470000-7e47c000 rw-p 00000000 00:00 0          [anon:libc_malloc]
  7e47d000-7e490000 rw-p 00000000 00:00 0          [anon:libc_malloc]
  7e4cc000-7e4dc000 rw-p 00000000 00:00 0          [anon:libc_malloc]
  </code></pre>
  
  <p>Than I could use the examine command to investigate each value. This one is working but it takes so much time. I guess the find command within gdb is way faster doing this.</p>
  
  <pre><code>0x78b0e070: 0   829055599   57  59
  0x78b0e080: 2   2024857820  2024857860  2024857900
  0x78b0e090: 1970810756  4587520 71  0
  0x78b0e0a0: 0   2024857756  2024857756  0
  0x78b0e0b0: 0   27  1970675312  1
  0x78b0e0c0: 1   2024857728  0   43
  0x78b0e0d0: 23  23  0   1936029041
  </code></pre>
  
  <p>E.g addresses do not match due to several runs, but it is working :)</p>
  
  <pre><code>x/dw 0x78B0E19c    --&gt; Result 964
  </code></pre>
  
  <p>My find command was sth like this:</p>
  
  <pre><code>find 0x419a1000, 0x7e5b6000, 964
  </code></pre>
  
  <p>But I get as result these</p>
  
  <pre><code>0x419a3058
  0x419a30c0
  0x419a348c
  0x419a3e7d
  0x419a3fec
  5 patterns found.
  </code></pre>
  
  <p>And this is not ture. It can t be possible that it is just within 5 addresses. It should be way more. It also seems that its not searching correctly. Because it just within the 0x419a3xxx range. </p>
  
  <p>I am searching an int value within an arm architecture. But that point shouldn t matter. What I am doing wrong? Could you please provide me some examples to find all int values (964) within the address space of a process? And this pretty fast? :)</p>
  
  <p>Thank you!</p>