> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/exploit-development/cheatsheets/sof.md).

# GDB + GEF Full Cheatsheet — Exploit Development & OSED

> **GEF** = GDB Enhanced Features — the standard plugin for exploit dev\
> Install: `bash -c "$(curl -fsSL https://gef.blah.cat/sh)"`\
> Load: auto-loads on GDB start after install

***

## Table of Contents

1. [GDB Basics](#1-gdb-basics)
2. [Starting & Running](#2-starting--running)
3. [Breakpoints](#3-breakpoints)
4. [Stepping & Continuing](#4-stepping--continuing)
5. [Examining Memory](#5-examining-memory)
6. [Registers](#6-registers)
7. [Stack Inspection](#7-stack-inspection)
8. [Searching Memory](#8-searching-memory)
9. [Disassembly](#9-disassembly)
10. [GEF Commands](#10-gef-commands)
11. [Pattern / Offset Finding](#11-pattern--offset-finding)
12. [ROP & Gadgets](#12-rop--gadgets)
13. [Heap Inspection (GEF)](#13-heap-inspection-gef)
14. [Scripting GDB with Python](#14-scripting-gdb-with-python)
15. [PWNDBG Alternative Commands](#15-pwndbg-alternative-commands)
16. [.gdbinit Config](#16-gdbinit-config)
17. [Quick Reference Card](#17-quick-reference-card)

***

## 1. GDB Basics

```bash
# Launch GDB
gdb ./binary                    # open binary
gdb ./binary core               # open with core dump
gdb -p 1234                     # attach to PID
gdb --args ./binary arg1 arg2   # with arguments
gdb -q ./binary                 # quiet (no banner)
gdb -batch -ex "run" ./binary   # non-interactive

# Inside GDB
(gdb) help                      # help menu
(gdb) help breakpoints          # help for category
(gdb) quit  /  q                # exit
(gdb) shell <cmd>               # run shell command
(gdb) set pagination off        # disable --More-- prompts
(gdb) set confirm off           # disable y/n confirms
```

***

## 2. Starting & Running

```bash
# Set arguments
(gdb) set args arg1 arg2 arg3
(gdb) set args "hello world" "test"

# Run
(gdb) run                       # run with set args
(gdb) run arg1 arg2             # run with args inline
(gdb) run < input.txt           # stdin from file
(gdb) run $(python3 -c "print('A'*300)")   # inline payload

# Restart
(gdb) run                       # re-run (restarts)
(gdb) start                     # run and break at main()

# Environment
(gdb) set environment VAR=value
(gdb) unset environment VAR
(gdb) show environment

# Working directory
(gdb) set cwd /path/to/dir
```

***

## 3. Breakpoints

```bash
# Set breakpoints
(gdb) break main                # break at function name
(gdb) break *0x08048456         # break at address
(gdb) break vuln.c:42           # break at file:line
(gdb) break +5                  # break 5 lines forward
(gdb) break *main+20            # break at main+20 bytes

# Conditional breakpoints
(gdb) break *0x08048456 if $eax == 0
(gdb) break malloc if size > 1000

# Temporary breakpoint (auto-deletes after hit)
(gdb) tbreak main

# List breakpoints
(gdb) info breakpoints          # or: i b

# Delete breakpoints
(gdb) delete 1                  # delete breakpoint #1
(gdb) delete                    # delete all
(gdb) clear main                # clear at function

# Enable / Disable
(gdb) disable 2
(gdb) enable 2

# Watchpoints (break on memory change)
(gdb) watch *0x0804c020         # break when address written
(gdb) rwatch *0x0804c020        # break when address read
(gdb) awatch *0x0804c020        # break on read or write

# Catchpoints
(gdb) catch syscall             # break on any syscall
(gdb) catch syscall read        # break on read() syscall
(gdb) catch throw               # break on C++ exception
```

***

## 4. Stepping & Continuing

```bash
# Continue execution
(gdb) continue                  # or: c  — run until next breakpoint
(gdb) continue 3                # continue, ignore next 3 breakpoints

# Step (source level)
(gdb) step                      # or: s  — step INTO function calls
(gdb) next                      # or: n  — step OVER function calls
(gdb) step 5                    # step 5 times
(gdb) next 5                    # next 5 times

# Step (instruction level)
(gdb) stepi                     # or: si — step one INSTRUCTION (into)
(gdb) nexti                     # or: ni — step one INSTRUCTION (over)
(gdb) stepi 10                  # step 10 instructions

# Finish
(gdb) finish                    # run until current function returns
(gdb) return                    # force return from current function
(gdb) return 0                  # force return with value 0

# Until
(gdb) until 42                  # run until line 42
(gdb) until *0x08048500         # run until address

# Jump (change EIP/RIP directly)
(gdb) jump *0x08048456          # jump to address (dangerous)
(gdb) set $eip = 0x08048456     # same effect
```

***

## 5. Examining Memory

```bash
# x command: x/[count][format][size] address
# Format: x=hex, d=decimal, s=string, i=instruction, c=char, b=binary
# Size:   b=byte(1), h=halfword(2), w=word(4), g=giant(8)

# Read hex
(gdb) x/wx 0x0804c020           # 1 word (4 bytes) hex
(gdb) x/4wx $esp                # 4 words from ESP
(gdb) x/20wx $esp               # 20 words from ESP
(gdb) x/40wx $ebp-0x100         # 64 words from EBP-256

# Read bytes
(gdb) x/16bx 0x0804c020         # 16 bytes hex
(gdb) x/32bx $eip               # 32 bytes at EIP

# Read string
(gdb) x/s 0xbffff123            # null-terminated string
(gdb) x/s $esp                  # string at ESP
(gdb) x/5s 0xbffff000           # 5 strings

# Read instructions (disassemble)
(gdb) x/10i $eip                # 10 instructions at EIP
(gdb) x/20i main                # 20 instructions at main
(gdb) x/i 0x08048456            # 1 instruction at address

# Useful combos for exploit dev
(gdb) x/40wx $esp               # dump stack (most common)
(gdb) x/s *((char**)$esp)       # dereference ESP as string pointer
(gdb) x/wx $ebp+4               # return address
(gdb) x/wx $ebp+8               # first function argument

# Print (formatted output)
(gdb) print $eax                # value of EAX
(gdb) print/x $eax              # EAX in hex
(gdb) print/d $eax              # EAX as decimal
(gdb) print (char*)0xbffff123   # cast and print as string
(gdb) print *0x0804c020         # dereference address
(gdb) print &variable_name      # address of variable

# Display (auto-print after each step)
(gdb) display $eax
(gdb) display/x $eip
(gdb) display/10i $eip          # show next 10 instructions always
(gdb) undisplay 1               # remove display #1
(gdb) info display
```

***

## 6. Registers

```bash
# Show all registers
(gdb) info registers            # or: i r
(gdb) info registers eax ebx   # specific registers
(gdb) info all-registers        # including FPU, SSE

# Show specific
(gdb) print $eax
(gdb) print/x $esp
(gdb) print/x $eip

# Set register value
(gdb) set $eax = 0
(gdb) set $eip = 0x08048456
(gdb) set $esp = $esp - 4

# x86 registers quick reference
# EIP — instruction pointer (what executes next)
# ESP — stack pointer (top of stack)
# EBP — base pointer (current frame base)
# EAX — return value / accumulator
# EBX, ECX, EDX, ESI, EDI — general purpose
# EFLAGS — status flags (ZF, CF, SF, OF)

# EFLAGS inspection
(gdb) print $eflags
# or in GEF: shown automatically in context

# x86-64 equivalents
# RAX RBX RCX RDX RSI RDI RSP RBP RIP
# R8–R15 (additional 64-bit registers)
```

***

## 7. Stack Inspection

```bash
# Dump raw stack
(gdb) x/40wx $esp               # 40 words up from ESP
(gdb) x/40wx $esp-0x20          # include below ESP too

# Show stack frame info
(gdb) info frame                # current frame details
(gdb) info locals               # local variables (if debug info)
(gdb) info args                 # function arguments (if debug info)

# Backtrace (call stack)
(gdb) backtrace                 # or: bt
(gdb) backtrace 5               # last 5 frames only
(gdb) backtrace full            # include local variables

# Frame navigation
(gdb) frame 0                   # innermost frame
(gdb) frame 2                   # frame #2
(gdb) up                        # go up one frame
(gdb) down                      # go down one frame

# Finding return address manually
(gdb) x/wx $ebp+4               # saved EIP (return address)
(gdb) x/wx $ebp                 # saved EBP

# GEF context shows stack automatically:
# gef> context stack             # just stack pane
# gef> context                   # full context (regs+stack+code)
```

***

## 8. Searching Memory

```bash
# find command: find start, end, pattern
(gdb) find 0x08048000, 0x08049000, "hello"       # search for string
(gdb) find $esp, $esp+500, 0x41414141            # search for DWORD
(gdb) find /b $esp, $esp+1000, 0x90              # search for byte
(gdb) find /w 0x08048000, 0x0804ffff, 0xffe4     # JMP ESP opcode

# Search for string in all mapped memory
(gdb) find /b 0x00000000, 0xffffffff, "W00T"

# GEF: grep (better search)
gef> grep "W00TW00T"                             # search all memory
gef> grep "\xff\xe4"                             # search for JMP ESP
gef> grep -X "\xff\xe4"                          # hex pattern search

# Find JMP ESP (0xff 0xe4) in loaded libraries
gef> grep "\xff\xe4"
# or
(gdb) find /b 0x7c800000, 0x7c900000, 0xff, 0xe4

# Search for string "/bin/sh"
(gdb) find /b &system, +9999999, "/bin/sh"

# GEF: search-pattern
gef> search-pattern 0x41414141
gef> search-pattern "AAAA"
gef> search-pattern "\x90\x90\x90\x90"
```

***

## 9. Disassembly

```bash
# Disassemble
(gdb) disassemble main              # disassemble function
(gdb) disassemble 0x08048456        # disassemble at address
(gdb) disassemble 0x08048456, 0x08048480   # address range
(gdb) disas main                    # shorthand

# Set disassembly flavor
(gdb) set disassembly-flavor intel  # Intel syntax (recommended)
(gdb) set disassembly-flavor att    # AT&T syntax (default)

# Disassemble with source (needs debug symbols)
(gdb) disassemble /s main
(gdb) disassemble /m main

# Show next instructions at EIP
(gdb) x/20i $eip
(gdb) x/20i main+10

# GEF context shows disassembly automatically
gef> context code                   # just the code pane
gef> context                        # full context

# GEF: disassemble with extra features
gef> capstone-disassemble $eip 20   # uses Capstone engine
gef> cs-dis $eip 20                 # shorthand
```

***

## 10. GEF Commands

### Context Display

```bash
gef> context                    # full dashboard: regs + stack + code + trace
gef> context regs               # just registers
gef> context stack              # just stack
gef> context code               # just disassembly
gef> context trace              # just backtrace

# Configure context
gef> gef config context.layout "regs stack code"
gef> gef config context.nb_lines_stack 10
gef> gef config context.nb_lines_code 12
```

### Memory Commands

```bash
gef> xinfo 0x0804c020           # detailed info about address (perms, section)
gef> vmmap                      # virtual memory map (all mappings)
gef> vmmap stack                # filter to stack region
gef> vmmap heap                 # filter to heap region
gef> vmmap libc                 # filter to libc
gef> memory watch 0x0804c020 4 byte    # watch 4 bytes at address
gef> memory list                # list watched regions
```

### Process Info

```bash
gef> process-search vuln        # find processes by name
gef> got                        # show GOT table entries
gef> plt                        # show PLT entries
gef> elf-info                   # ELF header info
gef> checksec                   # show all protections
gef> aslr                       # show ASLR status
gef> pie                        # show PIE status
```

### checksec Output Explained

```
gef> checksec
[*] /home/user/vuln
    Canary:                        No   ← stack cookie present?
    NX:                            No   ← DEP/NX enabled?
    PIE:                           No   ← position-independent exec?
    Fortify:                       No   ← _FORTIFY_SOURCE?
    RelRO:                         No   ← GOT read-only?
```

### Heap Commands (GEF)

```bash
gef> heap chunks                # list all heap chunks
gef> heap bins                  # show free bins (fast, unsorted, etc.)
gef> heap arenas                # show malloc arenas
gef> heap chunk 0x804b000       # inspect specific chunk
gef> heap-analysis-helper       # monitor malloc/free calls
```

### Format & Display

```bash
gef> hexdump byte $esp 64       # hex dump 64 bytes from ESP
gef> hexdump word $esp 32       # hex dump 32 words from ESP
gef> hexdump dword $esp 20      # hex dump 20 dwords
gef> dereference $esp 20        # dereference 20 stack entries (with arrows)
gef> dereference $esp           # same as context stack

# Print with GEF
gef> p/x $eax
gef> p (char*)$eax              # cast to string
```

### Tracing

```bash
gef> trace-run                  # trace execution (records instructions)
gef> entry-break                # break at binary entry point
gef> goto 0x08048456            # jump to address
```

***

## 11. Pattern / Offset Finding

```bash
# GEF built-in pattern (de Bruijn sequence)
gef> pattern create 200         # create 200-byte pattern
gef> pattern create 200 -n 8    # 8-byte chunks (64-bit)

# After crash, find offset:
gef> pattern search $eip        # search for EIP value in pattern
gef> pattern search 0x41386141  # search for specific value
gef> pattern search $esp        # find ESP offset too

# Example workflow:
gef> pattern create 500
# copy output, send as input to program
gef> run <pattern>
# program crashes
gef> pattern search $eip
# [+] Searching for '0x41386141'
# [+] Found at offset 76 (little-endian search)

# Alternative: Metasploit pattern in GDB
(gdb) run $(python3 -c "
import subprocess
r = subprocess.run(['/usr/share/metasploit-framework/tools/exploit/pattern_create.rb', '-l', '500'], capture_output=True, text=True)
print(r.stdout.strip(), end='')
")
```

***

## 12. ROP & Gadgets

```bash
# GEF: ROP gadget search
gef> rop                        # list ROP gadgets in binary
gef> rop --grep "pop eax"       # filter gadgets
gef> rop --grep "jmp esp"       # find JMP ESP
gef> rop --grep "pop rdi"       # find pop rdi (64-bit)
gef> rop --grep "ret"           # find plain RET gadgets

# Specific gadget types
gef> rop --grep "xchg.*esp"     # stack pivot gadgets
gef> rop --grep "pop.*pop.*ret" # pop/pop/ret for SEH
gef> rop --grep "mov.*esp"      # ESP manipulation

# ROPgadget (external, run in shell)
(gdb) shell ROPgadget --binary /path/to/binary --rop
(gdb) shell ROPgadget --binary /path/to/lib.so --rop --badbytes "000a0d"

# Find specific opcode bytes (e.g., JMP ESP = \xff\xe4)
gef> grep "\xff\xe4"

# Inspect gadget
(gdb) x/3i 0x08048abc           # show 3 instructions at gadget

# Check if address has bad chars
(gdb) shell python3 -c "
addr = 0x625011af
bad  = [0x00, 0x0a, 0x0d]
ba   = addr.to_bytes(4, 'little')
for b in bad:
    if b in ba:
        print(f'BAD: 0x{b:02x} in address')
        break
else:
    print('Address is clean')
"
```

***

## 13. Heap Inspection (GEF)

```bash
# Heap overview
gef> heap chunks                # all allocated/free chunks
gef> heap bins                  # tcache, fast, unsorted, small, large bins
gef> heap bins fast             # just fastbins
gef> heap bins tcache           # just tcache (glibc 2.26+)
gef> heap bins unsorted         # unsorted bin

# Chunk inspection
gef> heap chunk 0x555555758260  # show chunk header + data
# Output:
# Chunk(addr=0x555555758260, size=0x20, flags=PREV_INUSE)

# Arena info
gef> heap arenas                # main arena + thread arenas

# Trace allocations (set before run)
gef> heap-analysis-helper
gef> run
# Prints each malloc() / free() call with size and address

# Find chunk containing address
gef> heap find-fake-fast 0x7fffffffe000

# tcache poisoning check
gef> heap bins tcache           # look for corrupted fd pointers
```

***

## 14. Scripting GDB with Python

```python
# Run inline Python in GDB
(gdb) python print("hello from python")
(gdb) python gdb.execute("info registers")

# Read register value
(gdb) python print(hex(int(gdb.parse_and_eval("$eip"))))

# Read memory
(gdb) python
>inf = gdb.selected_inferior()
>mem = inf.read_memory(0x08048000, 16)
>print(bytes(mem).hex())
>end

# GDB Python script file
# save as gdb_script.py:
import gdb

class MyBreakpoint(gdb.Breakpoint):
    def stop(self):
        eip = int(gdb.parse_and_eval("$eip"))
        esp = int(gdb.parse_and_eval("$esp"))
        print(f"[*] EIP: {eip:#010x}  ESP: {esp:#010x}")
        return False  # don't stop, just log

MyBreakpoint("*0x08048456")
gdb.execute("continue")

# Load: (gdb) source gdb_script.py
```

### Useful GDB Python Snippets

```python
# Dump stack to file
(gdb) python
>inf = gdb.selected_inferior()
>esp = int(gdb.parse_and_eval("$esp"))
>data = bytes(inf.read_memory(esp, 256))
>open("/tmp/stack_dump.bin", "wb").write(data)
>print(f"Stack dumped from {esp:#x}")
>end

# Find pattern in memory
(gdb) python
>import re
>inf = gdb.selected_inferior()
>mem = bytes(inf.read_memory(0x08048000, 0x1000))
>pos = mem.find(b'\xff\xe4')   # JMP ESP
>if pos >= 0:
>    print(f"Found JMP ESP at: {0x08048000 + pos:#010x}")
>end

# Auto-continue on breakpoint with logging
(gdb) commands 1
>silent
>printf "Hit BP: EIP=%x EAX=%x\n", $eip, $eax
>continue
>end
```

***

## 15. PWNDBG Alternative Commands

> pwndbg is an alternative to GEF. Commands differ — reference for when you encounter it.

```bash
# Context
pwndbg> context                 # similar to GEF context
pwndbg> regs                    # registers only
pwndbg> stack 20                # stack dump, 20 entries
pwndbg> disasm                  # disassembly

# Memory
pwndbg> vmmap                   # memory mappings
pwndbg> search -x "\xff\xe4"   # search for bytes
pwndbg> search -s "W00T"       # search for string
pwndbg> hexdump $esp            # hex dump

# Heap
pwndbg> heap                    # heap overview
pwndbg> bins                    # free bins
pwndbg> malloc_chunk 0xaddr    # inspect chunk

# Exploit
pwndbg> checksec                # protections
pwndbg> got                     # GOT table
pwndbg> plt                     # PLT table
pwndbg> cyclic 200              # create pattern
pwndbg> cyclic -l 0x41386141   # find offset
pwndbg> rop                     # ROP gadgets
pwndbg> canary                  # show stack canary value
pwndbg> telescope $esp 20      # dereference chain (like GEF dereference)
```

***

## 16. .gdbinit Config

Save to `~/.gdbinit`:

```bash
# ~/.gdbinit — quality of life settings

# Intel syntax (essential for exploit dev)
set disassembly-flavor intel

# No pagination
set pagination off

# No confirmations
set confirm off

# History
set history save on
set history size 10000
set history filename ~/.gdb_history

# Print arrays/strings nicely
set print array on
set print pretty on
set print elements 0

# Disable ASLR (per-session, not system-wide)
set disable-randomization on

# Follow child on fork
set follow-fork-mode child
set detach-on-fork off

# Load GEF (if installed)
source ~/.gdbinit-gef.py

# Useful aliases
define stack
    x/40wx $esp
end

define regs
    info registers
end

define ctx
    context
end

# Break and dump at address
define bpx
    break *$arg0
    commands $brknum
    silent
    context
    continue
    end
end
```

***

## 17. Quick Reference Card

```
══════════════════════════════════════════════════════════════════
GDB + GEF QUICK REFERENCE
══════════════════════════════════════════════════════════════════

LAUNCH
  gdb ./binary                    open binary
  gdb -q ./binary                 quiet mode
  gdb -p PID                      attach to process
  gdb ./binary core               open core dump

RUN
  run / r                         run (uses set args)
  run arg1 arg2                   run with args
  run $(python3 -c "...")          run with generated input
  start                           run and break at main

BREAKPOINTS
  b main          b *0x08048456   set breakpoint
  b *main+20      b file.c:42     set breakpoint
  tbreak *addr                    temporary breakpoint
  i b                             list breakpoints
  delete N                        delete breakpoint N
  watch *0xaddr                   break on memory write

STEPPING
  c                               continue
  s / si                          step (into) / stepi
  n / ni                          next (over) / nexti
  finish                          run to end of function
  until *0xaddr                   run to address

REGISTERS
  i r                             show all registers
  p/x $eax                        print EAX in hex
  set $eip = 0x08048456           set register

MEMORY EXAMINE  (x/[N][f][s] addr)
  x/40wx $esp                     40 words hex from ESP
  x/20bx $eip                     20 bytes hex from EIP
  x/10i $eip                      10 instructions at EIP
  x/s 0xbffff123                  string at address
  x/wx $ebp+4                     return address

STACK
  x/40wx $esp                     raw stack dump
  info frame                      current frame info
  bt                              backtrace
  frame N                         switch to frame N

SEARCH
  find /b addr, addr+N, byte      search bytes
  gef> grep "\xff\xe4"            search all memory (GEF)
  gef> search-pattern "AAAA"      search all memory (GEF)

DISASSEMBLY
  disas main                      disassemble function
  x/20i $eip                      instructions at EIP
  set disassembly-flavor intel    Intel syntax

GEF ESSENTIALS
  gef> context                    full dashboard
  gef> checksec                   show protections
  gef> vmmap                      memory map
  gef> got                        GOT table
  gef> heap chunks                heap overview
  gef> heap bins                  free bins
  gef> dereference $esp 20        dereferenced stack
  gef> xinfo 0xaddr               address details
  gef> rop --grep "pop eax"       find gadgets

PATTERN (GEF)
  gef> pattern create 500         create pattern
  gef> pattern search $eip        find EIP offset after crash

EXPLOIT DEV WORKFLOW
  1. gef> checksec                → note protections
  2. gef> vmmap                   → find non-ASLR modules
  3. gef> pattern create 500      → generate cyclic pattern
  4. run <pattern>                → crash binary
  5. gef> pattern search $eip     → find offset
  6. gef> grep "\xff\xe4"         → find JMP ESP
  7. gef> rop --grep "pop eax"    → find ROP gadgets
  8. x/40wx $esp                  → verify stack layout

SHORTCUTS
  Ctrl+C                          interrupt running program
  Ctrl+L                          clear screen
  Enter                           repeat last command
  Tab                             autocomplete
  Up/Down                         command history
══════════════════════════════════════════════════════════════════
```

***

## Common Exploit Dev Workflows in GDB+GEF

### Workflow 1: Find overflow offset

```bash
gdb -q ./vuln
gef> pattern create 500
# [+] Generating a pattern of 500 bytes (n=4)
# aaaabaaa...
gef> run aaaabaaa...           # paste pattern
# Program received signal SIGSEGV
gef> pattern search $eip
# [+] Found at offset 76
```

### Workflow 2: Verify control

```bash
gef> run $(python3 -c "print('A'*76 + 'B'*4 + 'C'*100)")
# EIP = 42424242  ✓
# ESP points to CCCC region  ✓
gef> x/20wx $esp               # verify shellcode landing zone
```

### Workflow 3: Find JMP ESP address

```bash
gef> vmmap                     # identify non-ASLR modules
gef> grep "\xff\xe4"           # find JMP ESP bytes
# [+] 0x625011af — 0x625011b1 →  "\xff\xe4" in essfunc.dll
(gdb) x/2i 0x625011af          # confirm: JMP ESP
```

### Workflow 4: Verify bad characters

```bash
# Send all bytes 0x01-0xff after EIP
gef> run $(python3 -c "
import sys
buf = b'A'*76 + b'B'*4
buf += bytes(range(1, 256))
sys.stdout.buffer.write(buf)
")
# After crash:
gef> hexdump byte $esp 255     # look for breaks in sequence
```

### Workflow 5: Inspect SEH chain

```bash
# After crash with SEH overflow:
gef> grep "ExceptionList"      # or manually:
(gdb) x/wx fs:0                # TEB → SEH chain head
# Walk the chain:
(gdb) x/2wx 0x0012ffb0         # [next_seh][seh_handler]
```

### Workflow 6: ROP chain debugging

```bash
# Set breakpoint at start of ROP chain (your JMP ESP or pivot)
gef> b *0x625011af
gef> run <exploit>
# Hit breakpoint — now step through ROP
gef> si                        # step one instruction (through gadget)
gef> context                   # see current state
gef> si                        # next gadget
# Repeat — watch EIP walk through gadget addresses
# Watch registers getting set up for API call
```

***

*For authorized lab environments, CTF challenges, and OSED/EXP-301 exam preparation.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/exploit-development/cheatsheets/sof.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.