Questions about this topic? Sign up to ask in the talk tab.
Difference between revisions of "Gdb"
From NetSec
| Line 3: | Line 3: | ||
It is a powerful tool to disassemble and view the memory of process, files and core dumps. | It is a powerful tool to disassemble and view the memory of process, files and core dumps. | ||
| + | To view the stack trace, run: | ||
| + | |||
| + | <pre> | ||
bt | bt | ||
| + | </pre> | ||
| + | |||
| + | To view all registers: | ||
| + | <pre> | ||
i r | i r | ||
| − | frame { | + | or |
| + | info registers | ||
| + | </pre> | ||
| + | |||
| + | Select a stack frame to inspect: | ||
| + | <pre> | ||
| + | frame {0,} | ||
| + | </pre> | ||
| + | |||
| + | List the source code (if you have imported debugging symbols only | ||
| + | <pre> | ||
list + | list + | ||
list - | list - | ||
list | list | ||
| + | </pre> | ||
| + | |||
| + | Print/inspect memory regions: | ||
| + | <pre> | ||
print <variable> | print <variable> | ||
| − | x/ | + | (print 200 bytes) x/200bx <variable> |
| − | x/ | + | (print 200 words) x/200wx $rip |
| − | x/ | + | (print 200 bytes => int => ascii) x/200xc $rip |
| − | + | </pre> | |
| + | |||
| + | Print all variables in program (requires debugging symbols) | ||
| + | <pre> | ||
info variables | info variables | ||
| + | </pre> | ||
{{expand}} | {{expand}} | ||
[[Category:Reverse Engineering]] | [[Category:Reverse Engineering]] | ||
Revision as of 05:49, 30 August 2015
GDB is a bash debugger for ELF binaries.
It is a powerful tool to disassemble and view the memory of process, files and core dumps.
To view the stack trace, run:
bt
To view all registers:
i r or info registers
Select a stack frame to inspect:
frame {0,}
List the source code (if you have imported debugging symbols only
list + list - list
Print/inspect memory regions:
print <variable> (print 200 bytes) x/200bx <variable> (print 200 words) x/200wx $rip (print 200 bytes => int => ascii) x/200xc $rip
Print all variables in program (requires debugging symbols)
info variables
| This article contains too little information, it should be expanded or updated. |
|---|
Things you can do to help:
|
