Getting started
Basic usage
-
Start a binary with gdb
gdb /path/to/binary
-
Set a breakpoint
break function_name
Or to break on a memory address:
break *0x09319b91
-
Run the binary
run
Troubleshoot a crash
-
Start a binary with gdb (see above)
-
Wait for the crash
-
Do a backtrace
bt
Restart a running program from the beginning
Just type run
again
Variables
Built-in variables
- Stack:
$sp
or$esp
- Program counter:
$pc
- This points to the memory address of the current instruction
Registers
Show all the registers
info registers
Functions
Show the parameters of a function
If you don’t have debugging symbols
-
Open the binary with Ghidra
-
Go to the top of the function
-
In the Listing look at the parameters, e.g.
wchar_t * Stack[0x8]:4 param_2
- Parameter is 4 bytes long, on the stack at position 0x8
-
In Ghidra, copy the memory address
-
In gdb, set a breakpoint for the address
-
Examine the stack, e.g.
x/wx $sp+0x8
-
Print the value at that address
In our example above, to print a
wchar_t
, use this function: https://stackoverflow.com/a/1406427/399105
Breakpoints
ⓘ If you use start
instead of run
, gdb may automatically break if it finds a main
function, even if no break point was created
Create a breakpoint
break function_name
Or to break on a memory address:
break *0x09319b91
List breakpoints
info break
Delete breakpoint
Use the breakpoint number (see List breakpoints) to delete a specific breakpoint, e.g.
delete 2
Delete all breakpoints
delete
Printing
Integer
Print the value of an unsigned integer:
p (unsigned int)0x00003266
Or to print a memory address:
print *(int*)($sp+0xc)
Byte
Print a byte
x/xw $sp+0x10
Print 5 bytes
x/5xw $sp
String
Print a string:
x/s 0xde7f322c