> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/binary-exp/toolkit/cheatsheets/02-gdb-pwndbg-cheatsheet.md). # GDB + pwndbg + peda Cheatsheet ## ─── INSTALLATION ───────────────────────────────────────────────────────────── ```bash # pwndbg git clone https://github.com/pwndbg/pwndbg cd pwndbg && ./setup.sh # peda git clone https://github.com/longld/peda.git ~/peda echo "source ~/peda/peda.py" >> ~/.gdbinit # pwndbg + GEF together: use gdbinit selector ``` *** ## ─── STARTUP ────────────────────────────────────────────────────────────────── ```bash gdb ./vuln gdb -q ./vuln # quiet mode gdb -q ./vuln --args arg1 arg2 # with arguments gdb -q -ex 'b main' -ex 'r' ./vuln # with commands # With pwntools p = gdb.debug('./vuln', ''' set follow-fork-mode child break main continue ''') ``` *** ## ─── EXECUTION CONTROL ──────────────────────────────────────────────────────── ``` r / run Start program r < input.txt Run with stdin from file r <<< $(python3 -c "...") Run with python-generated input c / continue Continue until next breakpoint ni / nexti Next instruction (step over calls) si / stepi Step instruction (step into calls) fin / finish Run until current function returns kill Kill running process q / quit Exit GDB ``` *** ## ─── BREAKPOINTS ────────────────────────────────────────────────────────────── ``` b main Break at function b *0x401234 Break at address b *main+0x10 Break at offset from symbol b vuln.c:42 Break at source line b puts Break at library function tb *0x401234 Temporary breakpoint (hit once) rb printf Regex breakpoint (all printf variants) info b / info breakpoints List breakpoints d 1 Delete breakpoint 1 d Delete all breakpoints disable 1 Disable breakpoint 1 enable 1 Enable breakpoint 1 condition 1 $rax == 0 Conditional breakpoint commands 1 Run commands when bp 1 hits > print $rax > continue > end watch *0x601040 Watchpoint: break on write to addr rwatch *0x601040 Break on read awatch *0x601040 Break on read or write ``` *** ## ─── REGISTERS ──────────────────────────────────────────────────────────────── ``` info registers All registers info registers rax rip rsp Specific registers p $rax Print register p/x $rax Print as hex p/d $rax Print as decimal set $rax = 0x1337 Set register value # pwndbg shortcuts regs Colored register view ``` *** ## ─── MEMORY EXAMINATION ─────────────────────────────────────────────────────── ``` # Syntax: x/[count][format][size] address # format: x(hex) d(dec) s(string) i(instr) c(char) b(binary) # size: b(byte) h(half/2B) w(word/4B) g(giant/8B) x/gx $rsp 1 qword hex at rsp x/20gx $rsp 20 qwords hex at rsp x/4wx 0x601040 4 dwords at address x/s 0x601234 As string x/10i $rip 10 instructions at rip x/i $rip Current instruction p *(long *)0x601040 Dereference pointer p (char *)0x601040 Print as string # pwndbg extras hexdump $rsp 64 Hex + ASCII dump telescope $rsp 20 Follow pointer chains stack 20 20 entries above rsp ``` *** ## ─── DISASSEMBLY ────────────────────────────────────────────────────────────── ``` disas main Disassemble main disas 0x401000, 0x401100 Disassemble range disas /m main With source lines disas /r main With raw bytes set disassembly-flavor intel Intel syntax (preferred) set disassembly-flavor att AT&T syntax # pwndbg nearpc 10 10 instructions around PC context Full context view (regs+stack+disasm) ``` *** ## ─── STACK ──────────────────────────────────────────────────────────────────── ``` info frame Current frame info (saved rip, rbp) bt / backtrace Call stack frame 2 Switch to frame 2 up / down Navigate frames # pwndbg stack 30 Show 30 stack entries telescope $rsp 20 Follow pointer chains from rsp ``` *** ## ─── SEARCHING MEMORY ───────────────────────────────────────────────────────── ``` # pwndbg search -x "/bin/sh" Search all memory for bytes search -t str "password" Search for string search -8 0xdeadbeef Search for 8-byte value find 0x400000, 0x500000, "/bin/sh" GDB built-in find # Find ROP gadgets rop --grep "pop rdi" pwndbg rop search # Find writable sections vmmap Memory map with permissions ``` *** ## ─── HEAP (pwndbg) ──────────────────────────────────────────────────────────── ``` heap All heap chunks heap -v Verbose bins All bin contents (tcache, fast, small...) tcache Tcache state fastbins Fastbin chains smallbins Smallbin chains largebins Largebin chains unsortedbin Unsorted bin malloc_chunk 0x602010 Inspect specific chunk vis_heap_chunks Visual heap layout arena Main arena state ``` *** ## ─── FORMAT STRING DEBUGGING ────────────────────────────────────────────────── ``` # Find your buffer on the stack while stopped at printf x/30gx $rsp Examine stack # Look for your input pattern (AAAA = 0x4141414141414141) # Find canary (ends in 00) # Usually at fixed offset from saved rbp canary pwndbg: print canary ``` *** ## ─── GOT/PLT (pwndbg) ──────────────────────────────────────────────────────── ``` got Show GOT entries + resolved addresses plt Show PLT entries x/gx &puts@got.plt Examine GOT entry for puts ``` *** ## ─── USEFUL TRICKS ──────────────────────────────────────────────────────────── ```bash # Disable ASLR for this GDB session set disable-randomization on (default in GDB) # Bypass ASLR to get consistent addresses set disable-randomization off # to test ASLR behavior # Avoid stepping into libc set step-mode on # Save output to file set logging on set logging file gdb.log # Script GDB from command line gdb -q -ex 'r < /dev/null' -ex 'bt' -ex 'q' ./vuln # Core dump analysis gdb ./vuln core bt x/20gx $rsp # pwndbg: show context on every stop context-config ``` *** ## ─── COMMON DEBUGGING WORKFLOW ─────────────────────────────────────────────── ```bash # 1. Check protections checksec --file=./vuln # 2. Disassemble main and vuln functions gdb ./vuln > set disassembly-flavor intel > disas main > disas vuln # 3. Find overflow offset > r <<< $(python3 -c "from pwn import *; sys.stdout.buffer.write(cyclic(200))") > cyclic -l $rsp # or: cyclic_find() # 4. Set breakpoint before return, inspect stack > b *vuln+0x50 > r <<< $(python3 -c "print('A'*72 + 'BBBBBBBB')") > x/4gx $rsp # should see 0x4242424242424242 at rsp after ret # 5. Find gadgets > rop --grep "pop rdi" # 6. Test exploit > r < <(python3 exploit.py) ``` *** ## ─── .gdbinit TEMPLATE ──────────────────────────────────────────────────────── ``` set disassembly-flavor intel set pagination off set confirm off set print pretty on # Auto-run commands on attach define hook-stop context end ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://alham-rizvi.gitbook.io/alhamrizvi/binary-exp/toolkit/cheatsheets/02-gdb-pwndbg-cheatsheet.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.