The GNU Debugger

The GNU project debugger, allows you to see what is going on "inside" another program while it executes, or what a program was doing at the moment it crashed.

Project website: https://www.sourceware.org/gdb/

Customization

There is two main project that enhance the user experience when using GDB: - GEF: https://github.com/hugsy/gef - pwndbg: https://github.com/pwndbg/pwndbg/

Common Commands

  • gdb ./your_binary - Start GDB with your program to analyse.
  • gdb --pid {your_pid} - Allow you to attach GDB to a running process.
  • run - Execute the program under gdb.
  • break {location} (shortcut: b) - Set a breakpoint at the desired location.
  • hbreak {location} - Set a hardware breakpoint at desired location.
  • delete {breakpoint number} - Remove a said breakpoint.
  • clear - Delete all breakpoints.
  • enable {breakpoint number} - Enable a disabled breakpoint.
  • disable {breakpoint number} - Disable a breakpoint.
  • next - Go to the next function
  • step (shortcut: si) - Go to the next instruction.
  • continue - Continue normal execution until breakpoint/end of program.
  • finish - Continue until the current function returns.
  • disassemble {function} (shortcut: disas) - Show disassembly of a function.
  • info {something} - Allows you to show info about various things such as:
    • breakpoints- Print info about the break and watch points.
    • locals - Print the local variables in the current stack frame.
    • registers - Display the content of the registers.
    • args - Print the arguments to the function of the current stack frame.
  • backtrace (shortcut: bt) - Show call stack trace.
  • frame {frame number} - Select the stack frame.
  • watch {where} - Set a new watchpoint.
  • break/watch {where} if {condition} - Break/watch at a said location if the condition is met
    • The conditions can be almost any C expressions that evaluate to true or false.
  • condition {breakpoint number} {condition} - Set the condition of an existing breakpoint or watchpoint.
  • print/format {something} - Print content of variable or memory location-register.
  • display/format {something} - Print the information after each stepping instruction.
  • threads {thread number} - Select the thread to look at.

Common concepts

  • Watchpoints: A watchpoint stops your program whenever the value of a variable or expression changes.
  • Stacktrace/Backtrace: A stacktrace in GDB shows the chain of function calls that led to the current execution point, aiding debugging.
  • Frame: A frame is one function call’s slice of the stack, holding its locals, arguments, and where it returns to.
  • Hardware vs Software Breakpoint: Software breakpoints insert a trap instruction into code in memory; hardware breakpoints use CPU debug registers, so they work on read-only code like ROM.