Appendix G: GDB Command Reference

This appendix covers GDB commands used throughout this book, organized by task. All commands work with standard GDB; commands specific to the pwndbg plugin are marked (pwndbg).

GDB can be launched with: gdb ./binary or gdb -q ./binary (quiet mode, suppresses banner).

Starting and Controlling Execution

Breakpoints and Watchpoints

Examining Registers

pwndbg display: The pwndbg plugin automatically displays registers at each prompt with color-coding (changed registers highlighted in red).

Examining Memory

x Format Specifiers

Disassembly

Stack Inspection

Process Information

Symbols and Source

Scripting and Automation

GDB supports Python scripting and a built-in scripting language.

Init File

Create ~/.gdbinit for persistent settings:

set disassembly-flavor intel
set pagination off
set print pretty on
set print array on

Simple Script

# In GDB or a .gdb file:
define hook-stop
    x/5i $pc
    x/8gx $rsp
end

Python Scripting

# Access from GDB: (gdb) python print(gdb.selected_frame().pc())
import gdb

class PrintStack(gdb.Command):
    def __init__(self):
        super().__init__("print-stack", gdb.COMMAND_USER)

    def invoke(self, arg, from_tty):
        sp = gdb.parse_and_eval("$rsp")
        for i in range(8):
            addr = int(sp) + i * 8
            val = gdb.inferiors()[0].read_memory(addr, 8)
            print(f"[RSP+{i*8:3d}] = {int.from_bytes(val, 'little'):#018x}")

PrintStack()

pwndbg-Specific Commands

Remote Debugging

Debug with GDB Server (typical for embedded or QEMU)

# On the target (or in QEMU):
gdbserver :1234 ./binary

# In GDB on the host:
(gdb) target remote localhost:1234
(gdb) continue

Debug Linux Kernel with QEMU

# QEMU with GDB stub:
qemu-system-x86_64 -kernel bzImage -append "nokaslr" -s -S

# In GDB:
(gdb) file vmlinux
(gdb) target remote :1234
(gdb) break start_kernel
(gdb) continue

Common Exploit Development Workflows

Find return address on stack

(gdb) break *main+offset    # break at get_name or vulnerable function
(gdb) run
(gdb) x/20gx $rsp           # examine stack: look for return address
(gdb) x/2gx $rbp            # [rbp] = saved rbp, [rbp+8] = return address

Confirm overflow offset with cyclic pattern (pwndbg)

(gdb) cyclic 100
aaaaaaaabaaaaaaacaaaaa...
(gdb) run < <(cyclic 100)   # pipe cyclic input to program
Program received signal SIGSEGV
RIP = 0x6161616162616161
(gdb) cyclic -l 0x6161616162616161
72

Find function address for ret2win

(gdb) info functions win
0x0000000000401160  win
(gdb) disassemble win
# verify it reads flag.txt

Examine canary value

(gdb) break *vulnerable_function+3   # just after canary read in prologue
(gdb) run
(gdb) x/gx $rbp-8                   # show canary on stack
0x7fffffffe408: 0x4cd8b2e5f70a2300  # low byte is 0x00 (null byte)
(gdb) x/gx fs:0x28                  # show TLS canary (should match)

Trace execution with SIGSEGV analysis

(gdb) run
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7a12345 in ?? ()
(gdb) x/i $rip          # what instruction caused the fault?
(gdb) info registers    # what register values?
(gdb) backtrace         # what is the call chain?
(gdb) x/20gx $rsp       # what is on the stack?

.gdbinit Template for Exploit Development

set disassembly-flavor intel
set pagination off
set follow-fork-mode child
define hook-stop
    echo \n[Registers]\n
    info registers rax rbx rcx rdx rsi rdi rsp rbp rip
    echo \n[Stack]\n
    x/10gx $rsp
    echo \n[Instructions]\n
    x/5i $rip
end