GDB & Debugging Tools Reference
Comprehensive guide to GDB and debugging tools for binary exploitation, including breakpoints, memory examination, and essential debugging workflows.
Contents
GDB & Debugging Tools Reference
Complements: [[PWNDBG]] (existing cheat sheet)
GDB with Pwndbg
Installation
git clone https://github.com/pwndbg/pwndbg
cd pwndbg && ./setup.shStarting
gdb ./binary # Load binary
gdb -q ./binary # Quiet mode
gdb -p <pid> # Attach to processEssential Commands
# Execution
r # Run
r < input.txt # Run with stdin from file
r $(python3 -c 'print("A"*100)') # Run with argument
c # Continue
ni # Next instruction (step over)
si # Step instruction (step into)
finish # Run until current function returns
# Breakpoints
b main # Break at main
b *0x401234 # Break at address
b *main+42 # Break at offset
info b # List breakpoints
del 1 # Delete breakpoint #1
disable 1 # Disable breakpoint #1
# Examination
x/20wx $rsp # 20 words hex at RSP
x/s 0x402000 # String at address
x/10i $rip # 10 instructions at RIP
x/20gx $rsp # 20 giant (8-byte) hex at RSP
p $rax # Print register value
p/x $rax # Print in hex
info reg # All registersPwndbg Specific
# Heap
heap # Heap overview
bins # All bins
vis_heap_chunks # Visual heap layout
tcachebins # Tcache bins
fastbins # Fastbins
# Stack
stack 20 # Show 20 stack entries
canary # Show canary value
retaddr # Show return address
# Search
search -s "/bin/sh" # Search for string
search -p 0xdeadbeef # Search for pointer
# Analysis
checksec # Show binary protections
vmmap # Memory mappings
got # GOT entries
plt # PLT entries
rop # Find ROP gadgets
# Context
context # Refresh display
set context-sections all # Show all sectionsOther Useful Tools
ROPgadget
ROPgadget --binary ./vuln
ROPgadget --binary ./vuln --ropchain # Auto-generate chain
ROPgadget --binary ./vuln | grep "pop rdi"ropper
ropper --file ./vuln
ropper --file ./vuln --search "pop rdi"checksec
checksec --file=./vulnobjdump
objdump -d ./vuln # Disassemble
objdump -d ./vuln | grep main # Find main
objdump -t ./vuln # Symbol table
objdump -R ./vuln # Relocations (GOT entries)readelf
readelf -h ./vuln # ELF header
readelf -S ./vuln # Sections
readelf -s ./vuln # Symbols
readelf -l ./vuln # Program headersone_gadget
# Find one-shot RCE gadgets in libc
one_gadget /lib/x86_64-linux-gnu/libc.so.6pwninit
# Auto-patch binary with correct libc/ld
pwninit --bin ./vuln --libc ./libc.so.6seccomp-tools
# Dump seccomp (sandbox) rules
seccomp-tools dump ./vuln