GDB Cheat Sheet (GNU Debugger)

GDB: analyze binaries, debug crashes, build/verify exploits. Pair with pwndbg/GEF for exploit Dev.

Basic Starts

• Run a binary in gdb gdb ./vuln
• Run with arguments gdb -q --args ./vuln arg1 arg2
• Run / restart run / r
• Continue after break continue / c
• Step into / step over / finish function step/s, next/n, finish
• Quit quit / q

Breakpoints

• Break at function break main / b main
• Break at address b *0x4006e0
• Conditional break break main if $eax == 0
• List / delete breakpoints info break → delete <n>

Registers & Memory

• Show registers info registers / i r
• Read memory at address x/20x $sp (hex dump) / x/40wx $sp / x/s (string) / x/i (instruction)
• Print value print $eax / p/x $rsp (hex)
• Show stack x/30gx $rsp (64-bit words)

Disassembly

• Disassemble current function disassemble main / disassemble $pc
• Show current instruction x/i $pc
• Step by instruction stepi / si

Exploitation Helpers

• Set a register set $eax = 0
• Set eip/rip to an address set $rip = 0x4011f0
• Jump to call a shellcode-location: set $pc = <addr>
• Call a function from gdb call system("/bin/sh") (if symbols and exec context allow)
• Continue to a specific address until *0x...
• Show GOT/PLT entries info functions / info symbol <addr>
• context (with pwndbg/GEF) shows regs, stack, code at once

Analyzing Crashes (fuzzing output)

• Check crash reason info registers, x/i $pc after segfault
• Find offset of controlled data: use cyclic pattern (pwntools):

  # generate pattern
  from pwn import cyclic; print(cyclic(200))
  

  # then in gdb after crash: find pattern offset
  cyclic_find(A)
  

• checksec (GEF) / in pwndbg checksec — shows NX/PIE/Canary/RELRO setup

Common Flags to Remember

• gdb -q quiet; -ex <gdbcmd> run command at start
• set pagination off → avoid paging in pipelines gdb -batch -ex "..." ./bin
• set disassembly-flavor intel → intel syntax
• set follow-fork-mode child for forking servers

Pwndbg / GEF Quick Lists

• checksec protection info
• vmmap memory map (find NX regions)
• search-pattern /bin/sh (pwndbg) / rop (GEF ROPgadget with pwndbg/ropper)
• ropper --file ./vuln --search "pop rdi" (external)

Tips

• If symbols stripped, use info functions + strings -t x to map addresses.
• For remote exploitation, debug locally with the same libc — pwninit/ldd check.