Table of contents

• GDB
  • Basic commands
    • Debug
    • Run
    • Attach an existing process
    • Disassemble
    • Breakpoint
    • Display content
    • Display information
    • Step in program
    • Step in one instruction
    • Continue
    • Display memory locations
    • No debugging symbols
  • Symbol File
    • List the source file
    • Show all sources
    • List all the functions from the binary
    • Print variables
      • Global and static variables
      • Local variables
    • Copy symbols file from a binary to a separate file
    • Remove symbols file from a binary
    • Adding debug symbols to a binary
      • Within GDB
      • Add it in the binary itself
    • Dump the symbols to a file
    • List symbols from object files
      • Symbol types
    • NM interesting flags
      • Sorted symbols
      • External symbols
      • Symbol size
  • Strace
  • Compiling
    • 32
    • 64
  • Core dumps
    • Enable core dumps
    • Disable core dumps
  • Breakpoints
    • Basic usage
    • List breakpoints
    • Disable breakpoint
    • Enable breakpoint
    • Delete breakpoint
  • Modifying Registers And Memory
    • Get variable type
    • Modifying a variable
    • Modifying a register
    • Show registers
    • Watch a variable

GDB

Basic commands

Debug

gdb <FILE>

Run

r <ARGS>

OR

run <ARGS>

Attach an existing process

gdb -p <PID>

Disassemble

disas <FUNCTION_NAME>

Breakpoint

break <FUNCTION>

OR

break <ADDRESS>

Display content

print <NAME>

Display information

info <NAME>

Step in program

step

Step in one instruction

stepi

Continue

continue
c

Display memory locations

x/<NUMBER_OF_UNITS><DATA_TYPE><LOCATION_NAME>

Help for more infos :

help x

Example :

# Displays 20 words starting from where ESI points to
x/20w $esi

# Displays 10 instructions starting from where EIP points to
x/10i $eip

No debugging symbols

Recompiled with the right flag to add them to the binary.

gcc -ggdb <FILE>.c -o <FILE>

Popular debug symbol file type :

• DWARF 2
• COFF
• XCOFF
• Stabs

Symbol File

List the source file

Need the source code !

list

OR

list <LINE_NUMBER>

Show all sources

info sources

List all the functions from the binary

info functions

Print variables

Global and static variables

info variables

Local variables

info scope <FUNCTION>

Copy symbols file from a binary to a separate file

objcopy --only-keep-debug <BINARY> <SYMBOLS_FILE>

# Within GDB
maint print symbols <SYMBOLS_FILE>

Remove symbols file from a binary

strip --strip-debug <BINARY>

OR

# Remove unneded
strip --strip-debug --strip-unneeded <BINARY>

Adding debug symbols to a binary

Within GDB

symbol-file <SYMBOL_FILE>

Add it in the binary itself

objcopy --add-gnu-debuglink=<SYMBOLS_FILE> <BINARY>

Dump the symbols to a file

maint print symbols <SYMBOLS_FILE>

List symbols from object files

nm <BINARY>

Symbol types

If lowercase, the symbol is usually local; if uppercase, the symbol is global (external).

To see the list of all symbol types use :

man nm

Example

nm example_binary

NM interesting flags

Sorted symbols

nm -n <BINARY>

External symbols

nm -g <BINARY>

Symbol size

nm -s <BINARY>

Strace

Traces all systems calls made by a program

# Normal usage
strace <BINARY>

# Filter by syscalls
strace -e write,mmap,ect <BINARY>

# Running process
strace -p <PID>

# Statistics about syscalls
strace -c <BINARY>

Compiling

32

gcc -m32 <FILE>.c -o <FILE>

64

gcc <FILE>.c -o <FILE>

Core dumps

Enable core dumps

ulimit -S -c unlimited

Disable core dumps

ulimit -S -c 0

Breakpoints

Basic usage

break <FUNCTION>
b <FUNCTION>

OR

break *<ADDRESS>
b *<ADDRESS>

OR

break <LINE_NUMBER>
b <LINE_NUMBER>

List breakpoints

info breakpoints
info b
i b

Disable breakpoint

disable <BREAKNPOINT_NUMBER>

Enable breakpoint

enable <BREAKNPOINT_NUMBER>

Delete breakpoint

delete <BREAKNPOINT_NUMBER>

Modifying Registers And Memory

Get variable type

whatis <VARIABLE_NAME>

Modifying a variable

set <VARIABLE_NAME> = <VALUE>
set <FUNCTION_NAME>::<VARIABLE_NAME> = <VALUE>

# For a string (size of string + 1 for \0)
set {char[5]} p = "test"

Modifying a register

set <REGISTER> = <VALUE>

# Example
set $eip = 0x56556244

Show registers

info registers
i r

Watch a variable

A watchpoint stops execution of your program whenever the value of an expression changes.

watch <VARIABLE_NAME>