Examining Memory with x Command

The x (examine) command is more powerful for raw memory:

x/[count][format][size] address

Size Modifiers

  • b = byte (1 byte)
  • h = halfword (2 bytes)
  • w = word (4 bytes)
  • g = giant word (8 bytes)

Format Modifiers

  • x = hexadecimal
  • d = decimal
  • u = unsigned decimal
  • o = octal
  • t = binary
  • c = character
  • s = string
  • i = instruction (disassembly)

count: how many units to display

Examples

View bytes in hex

x/8xb &buffer_one        # 8 bytes in hex
x/16xb buffer_two        # 16 bytes in hex

View as words (4 bytes)

x/4xw &value             # 4 words (16 bytes) in hex
x/8xw $rsp               # Examine stack

View as characters

x/8c buffer_one          # 8 characters
x/20c argv[1]            # 20 characters from argument

View as string

x/s buffer_one           # Show as null-terminated string
x/s 0x555555556004       # String at specific address

View as instructions

x/10i main               # Disassemble 10 instructions
x/5i $pc                 # Show next 5 instructions

Combined format (hex + ASCII)

x/32xb buffer_two        # Hex bytes
x/32c buffer_two         # Same area as characters