GDB (GNU Debugger)

Getting started

Basic usage

Start a binary with gdb
```
gdb /path/to/binary
```
Set a breakpoint
```
break function_name
```
Or to break on a memory address:
```
break *0x09319b91
```
Run the binary
```
run
```

Troubleshoot a crash

Start a binary with gdb (see above)
Wait for the crash
Do a backtrace
```
bt
```

Restart a running program from the beginning

Just type run again

Variables

Built-in variables

Stack: $sp or $esp
Program counter: $pc
- This points to the memory address of the current instruction

Registers

Show all the registers

info registers

Functions

Show the parameters of a function

If you don’t have debugging symbols

Open the binary with Ghidra
Go to the top of the function
In the Listing look at the parameters, e.g.
```
wchar_t *    Stack[0x8]:4    param_2
```
- Parameter is 4 bytes long, on the stack at position 0x8
In Ghidra, copy the memory address
In gdb, set a breakpoint for the address
Examine the stack, e.g.
```
x/wx $sp+0x8
```
Print the value at that address

In our example above, to print a wchar_t, use this function: https://stackoverflow.com/a/1406427/399105

Breakpoints

ⓘ If you use start instead of run, gdb may automatically break if it finds a main function, even if no break point was created

Create a breakpoint

break function_name

Or to break on a memory address:

break *0x09319b91

List breakpoints

info break

Delete breakpoint

Use the breakpoint number (see List breakpoints) to delete a specific breakpoint, e.g.

delete 2

Delete all breakpoints

delete

Printing

Integer

Print the value of an unsigned integer:

p (unsigned int)0x00003266

Or to print a memory address:

print *(int*)($sp+0xc)

Byte

Print a byte

x/xw $sp+0x10

Print 5 bytes

x/5xw $sp

String

Print a string:

x/s 0xde7f322c

My wiki