Show Menu

Closed-source Debugging with GDB Cheat Sheet by

A reference to the arcane syntax of the Gnu Debugger, GDB. This cheat sheet is tailored for a reverse-engineering audience.
gnu     advanced     debugging     gdb     reverse-engineering

GDB: Launching

Launching GDB
gdb programfile
Start GDB ready to launch and debug progr­amfile
gdb --args program arg1 arg2
Start GDB as above but supplying command line arguments to the target process.
gdb -p pid
Attach GDB to a running target process.
Selecting the Start of Debugg­ing
gdb$ start
Run the debuggee and break at main() (if it exists).
gdb$ attach pid
Attach GDB to a running target process.
(gdb) attach
--waitfor proce­ss-­name
(Mac OS X only) Wait for a process to launch and immedi­ately attach to it.
Adding a shim
gdb$ set exec-w­rapper env 'LD_PR­ELO­AD=­li­bfo­o.so'
The dynamic library file libfo­o.so will be loaded into the address space of the debuggee.
Logging
gdb$ set logging file filen­ame
The default logfile is gdb.txt but you can use this to change it.
gdb$ set logging overwrite off
The default is on, which overwrites the existing log file.
gdb$ set logging on
Turns on logging.
gdb$ echo comme­nt\n
With logging on, this will add a comment to the logfile.

GDB: Execution

Displaying the Call Stack
gdb$ bt
Show the list of stack frames (BackT­race).
gdb$ bt full
Show the list of stack frames with the local variables of each.
gdb$ info frame
Show saved stack pointer, call address, etc. for the selected stack frame.
gdb$ frame number
Select stack frame number number (and crashed GDB 6.3.50 on OS X).
Controlling Execut­ion
si [count]
Step-into (one or count instru­ction forward).
ni [count]
Step-over (one or count instru­ction, stepping over function calls).
return [value]
Immedi­ately return from the current function, optionally setting the return value.
finish
Stop after finishing execution of the current function.
continue
Any time GDB is stopped, this will continue normal execution.

GDB: Enviro­nment

gdb$ show env
Display the debuggee's current enviro­nment variables.
gdb$ set env varna­me­=v­alue
Set an enviro­nment variable.
gdb$ unset env varname
Delete an enviro­nment variable.
gdb$ show args
Display the comman­d-line arguments of the debuggee process.
gdb$ set args arg1 arg2
Set the comman­d-line arguments to the debuggee process.
gdb$ shell command
Run shell commands (useful commands may include "ps -e", etc.)
gdb$ pwd | cd
These two commands can can show or change the working directory of GDB (useful for logging, etc.).
 

GDB: Breakp­oints

Managing Breakp­oints
gdb$ set breakpoint pending on
Bypasses the warning about breakp­oints in modules that aren't loaded yet.
gdb$ break funct­ion
Sets a breakpoint at function if ("pe­ndi­ng" off) or when ("pe­nding on") a symbol by that name exists.
gdb$ break *0x000­01234
Sets a breakpoint at address 0x0000­1234.
gdb$ break 0x000­01234 if symbo­l=­=s­ome­value*
This is an example of the condit­ional breakpoint syntax.
gdb$ catch syscall name
Stop when the syscall name is called. Omit name to stop on every syscall. Instead of name, you can also specify a syscall by number.
gdb$ catch load
(not in Mac OS X) Stop when the debuggee loads any dynamic library. Also: catch unload.
gdb$ info break
List all breakp­oints and watchp­oints.
gdb$ clear [brea­kpo­int­id]
Deletes one or all existing breakp­oints. Without this cheat sheet, the user would be forced to guess what is being cleared.
gdb$ disable [brea­kpo­int­id]
Disables one or all breakp­oints.
 
Managing Watchp­oints (Data Breakp­oin­ts)
gdb$ watch *0x123­45678 [mask 0xffff­ff00]
Break on any change to the 24 most signif­icant bits of a 32-bit value at address 0x1234­5678.
gdb$ awatch *0x123­45678
Like watch, but also stops on any write or read accesses to the given address.
gdb$ rwatch *0x123­45678
Like watch, but only stops on read accesses.

GDB: Concur­rency

Multithreaded Debugg­ing
gdb$ info threads
List the threads of the target process.
gdb$ thread threa­dID
Attach GDB to the thread threa­dID.
gdb$ set non-stop on
Only the debugged thread is halted in GDB, the rest continue to run non-stop (unless they are blocking on the thread being debugged).
gdb$ set scheduler-locking on
Only the debugged thread will run when the debuggee is resumed.
gdb$ set schedu­ler­-lo­cking step
Only the debugged thread will step when being step-d­ebu­gged.
gdb$ show schedu­ler­-lo­cking
Display the current setting value.
 
Multiprocess Debugg­ing
gdb$ set follow­-fo­rk-mode child
GDB will detach at a fork() and attach to the new process.
gdb$ set follow­-fo­rk-mode parent
(Default) GDB will not detach at a fork().
gdb$ show follow­-fo­rk-­mode
Display the current setting value.
gdb$ set follow­-ex­ec-mode new
GDB will detach at an exec() and attach to the new process.
gdb$ set follow­-ex­ec-mode same
(Default) GDB will not detach at an exec().
gdb$ show follow­-ex­ec-­mode
Display the current setting value.
gdb$ set detach­-on­-fork off
GDB will not detach at a fork() and will also attach to the child process (both will be debugged).
gdb$ show detach­-on­-fork
Display the current setting value.
gdb$ info inferiors
List all processes under GDB's control. (On Mac OS X: info files)
 

GDB: Memory

Memory Images
gdb program -c dumpf­ile
Debug program using a memory dump file, image­file.
gdb$ generate-core-file
(not in Mac OS X) Dump the debuggee process memory to disk.
Reading Disass­embly and Memory
gdb$ set disass­emb­ly-­flavor intel
Use the modern syntax for x86-64 assembly. This is not the default.
gdb$ set disass­emb­le-­nex­t-line on
Disassemble the next instru­ction every time GDB stops. You want to turn this on.
gdb$ x/4i 0x0000­1234
Disassemble (eXamine) the first 4 instru­ctions at address 0x0000­1234.
gdb$ x/32i $rip
Disassemble the first 32 instru­ctions starting at the current instru­ction ($RIP on x86-64).
gdb$ x/32i $rip-16
Same command, but attempting to disass­emble both forward and backward from the current instru­ction.
gdb$ info address symbo­lname
Display the address in memory of a given symbol, specified by name.
gdb$ info symbol 0x0000­1234
Displays the symbol name (if any), executable segment, and executable module associated with the given address.
gdb$ x/1s 0x0000­1234
Display one null-t­erm­inated string at address 0x0000­1234.
gdb$ x/8xb 0x0000­1234
Display 8 heXade­cimal Bytes of memory starting at address 0x0000­1234.
gdb$ info registers
Display the value of the regular CPU registers.
gdb$ info all-re­gis­ters
Display the value of all CPU registers including floati­ng-­point and vector registers. Does not include special Machine Specific Registers (MSRs).
gdb$ find start­_ad­dress, dista­nce, value [, anoth­er_­value, ...]
(not in Mac OS X) Search memory for a value, given a starting point and a search distan­ce/­offset.
gdb$ info shared
Display info about all of the executable modules of the debuggee (name, load address, file path, etc.).
gdb$ info functions
Display all of the function symbols available and their associated addresses.
gdb$ info variables
Display all of the variable symbols available and their associated addresses.

GDB: Advanced

Anti-Anti Debugg­ing
gdb$ handle signal [keyw­ord­s...]
(Untested) might bypass except­ion­-based anti-d­ebu­gging
gdb$ catch syscall ptrace
(Untested) Use this breakpoint to return 0 (set $rax = 0; continue), should bypass ptrace() checking by the debuggee.

Download the Closed-source Debugging with GDB Cheat Sheet

3 Pages
//media.cheatography.com/storage/thumb/fristle_closed-source-debugging-with-gdb.750.jpg

PDF (recommended)

Alternative Downloads

Share This Cheat Sheet!

 

Comments

victor victor, 12:19 17 Feb 15

This is really great and pretty complete. Thanks for sharing! I am printing this and putting on my desk

Add a Comment

Your Comment

Please enter your name.

    Please enter your email address

      Please enter your Comment.

          Related Cheat Sheets

          oAuth End Points Cheat Sheet
          Object Oriented Design Cheat Sheet