Using “gdb”

date: 2022-07-10

Startup

gdb                   # Run; use file command to load $OBJECT
gdb $OBJECT           # Debug $OBJECT
gdb $OBJECT $COREDUMP # Analyze $COREDUMP
gdb $OBJECT $PID      # Attach to running process $PID

General Commands

set args                     # Set program arguments
show args                    # Show program arguments
run                          # Run the program
run < file                   # Run with input from file
set follow-exec-mode new/sam # Set debugger response to exec call
set write                    # Set write into executables
set write off                # Unset write int oexecutables 
continue                     # Continue running until break
finish                       # Exec until current stack frame ends
source FILE                  # Read commands from script file
shell [cmd]                  # Run cmd in a shell
display /5i $eip             # Display $eip when execution stops
undisplay <expr #>           # Undisplay expression number
info functions               # List all the functions
info variables               # List all the variables
info registers               # List most common registers
info all-registers           # List all registers
info display                 # Print list of displayed expressions
backtrace                    # Print backtrace of all stack frames
where                        # Same as backtrace
set disassembly-flavor intel # Set disassembly style to intel/att
define hook-[cmd]            # Actions to execute before command
define hooopost-[cmd]        # Actions to execute after command
define hook-stop             # Actions to execute when execution stops

Breakpoints

info breakpoints              # List all breakpoints
break [func]                  # Break function name
break *[addr]                 # Break at address
delete [bnum]                 # Delete breakpoint bnum
break if [cond]               # Break if condition
ignore [bnum] [count]         # Ignore breakpoint bnum count times
condition [bnum] $eax == 0x22 # Add condition for breakpoint 1
condition [bnum]              # Delete condition for breakpoint 1

Watchpoints

info watchpoints         # List all the watchpoint
watch variable==value    # Break when variable equals ..
watch $eax == 0x0000ffaa # Break when register equals ..
rwatch *[addr]           # Break on read memory location
awatch *[addr]           # Break on read/write memory location