gdb cheatsheet

gdb (The GNU Debugger) allows you to debug your program, it can be very usefull to check if your exploit is working as expected.

gdb add-ons

I recommend you to use one of the following gdb plugins, it will simplify your debugging process by adding new functions and readability to gdb.

• gef
• pwndbg
• peda

Cheatsheets

Stdin

gef➤  r <<< $(python2 -c "print '\xb2\x91\x04\x08'")

or

gef➤  r < payload.txt

Breakpoints

gef➤  b *main
Breakpoint 1 at 0x1139
gef➤  b *main+2
Breakpoint 2 at 0x113b
gef➤  info b
Num     Type           Disp Enb Address            What
1       breakpoint     keep y   0x0000000000001139 <main>
2       breakpoint     keep y   0x000000000000113b <main+2>
gef➤  disable 2
gef➤  info b
Num     Type           Disp Enb Address            What
1       breakpoint     keep y   0x0000000000001139 <main>
2       breakpoint     keep n   0x000000000000113b <main+2>
gef➤  del 1
gef➤  info b
Num     Type           Disp Enb Address            What
2       breakpoint     keep n   0x000000000000113b <main+2>

Navigation

gef➤ si # Step one instruction.
gef➤ ni # Step one instruction, but if it is a function call, proceed until the function returns.
gef➤ c # or 'continue', run the programm normally until we hit a breakpoint.

Printing

x[/Nuf] expr : examine memory.

N : count of how many units to display.

u : unit size; one of : b individual bytes, h halfwords (two bytes), w words (four bytes), g giant words (eight bytes)

f : printing format, s null terminated string, i machine instructions.

gef➤  x 0x55555555513d
0x55555555513d <main+4>:        0xc0058d48
gef➤  x/3 0x55555555513d
0x55555555513d <main+4>:        0xc0058d48      0x4800000e      0xe4e8c789
gef➤  x/3b 0x55555555513d
0x55555555513d <main+4>:        0x48    0x8d    0x05

Heap

gef➤  heap
[!] Syntax
heap (chunk|chunks|bins|arenas)
gef➤  heap chunks
Chunk(addr=0x603010, size=0x290, flags=PREV_INUSE)
    [0x0000000000603010     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................]
Chunk(addr=0x6032a0, size=0x410, flags=PREV_INUSE)
    [0x00000000006032a0     74 6f 74 6f 0a 0a 00 00 00 00 00 00 00 00 00 00    toto............]
Chunk(addr=0x6036b0, size=0x30, flags=PREV_INUSE)
    [0x00000000006036b0     e0 36 60 00 00 00 00 00 00 00 00 00 00 00 00 00    .6`.............]
Chunk(addr=0x6036e0, size=0x20, flags=PREV_INUSE)
    [0x00000000006036e0     74 6f 74 6f 00 00 00 00 00 00 00 00 00 00 00 00    toto............]
- Chunk(addr=0x603700, size=0x20910, flags=PREV_INUSE)  ←  top chunk