gdb help
A few gdb notes that should help with the zoo-escape and buffer-overflow projects.
TL;DR: useful gdb commands for the zoo homework
| layout asm | Switch to assembly view |
| r | Run the zoo from the beginning |
| r passcodes.txt | Run the zoo with passcodes.txt as an argument |
| c | Continue the program to the next breakpoint |
| Ctrl-L | Clean up the display when output messes it up |
| x/1ss addr | View a null-terminated string |
| x/20xw $rsp | View the top of the stack |
| i r rsp eax | View more than one register |
| si | Step into a function call |
| ni | Step over a function call |
| si or ni | Step over one non-call instruction |
More detailed lists of useful techniques are shown below.
Miscellaneous
| $ gcc -g ... | include symbols (e.g., function & variable names) in the executable |
| $ gdb executable | run gdb on the specified executable |
| $ gdb sourcefile.c | nope; doesn't work |
| (gdb) [Enter] | run the previous command again |
| (gdb) [Ctrl-L] | clean up the "layout" display when it gets corrupted |
| (gdb) help name-of-command | get help |
NOTE: Everything from here on down is entered at the (gdb) prompt.
Look at code
| list | View code near wherever you last left off |
| list 10,20 | View lines 10-20 |
| list something.c:10,20 | View lines 10-20 of something.c |
| layout src | 2-panel display, C on top and (gdb) prompt on bottom |
| layout asm | 2-panel display, assembly on top |
| [up/down arrow keys] | in 2-panel display, scroll the top panel |
Breakpoints
| br 73 | Set a breakpoint at line 73 of the C source code |
| br zoo.c:73 | Set a breakpoint at line 73 of the C source code in the file zoo.c |
| clear zoo.c:73 | Get rid of the breakpoint at line 73 of the C source code in the file zoo.c |
| br *0x403444 | Set a breakpoint at the instruction at address 0x403444 (the * is essential!) |
| maintenance info breakpoints | Show all breakpoints |
| main i br | Show all breakpoints |
Running & stepping through code
| run | Start the program from beginning |
| r | Start the program from beginning |
| r [args...] | Include command-line arguments |
| continue | Continue execution from a breakpoint |
| c | Continue execution from a breakpoint |
| stepi | Execute one instruction (step into function calls) |
| si | Execute one instruction (step into function calls) |
| nexti | Execute one instruction (step over function calls) |
| ni | Execute one instruction (step over function calls) |
| finish | Step out of the current function |
| fi | Step out of the current function |
Examining registers
| info reg | View all register contents |
| i r | View all register contents |
| i r rax rbx | View the contents of the specified registers |
| i r eax | View the contents of the specified register |
| i r eflags | View which bits are set in the EFLAGS register |
Examining memory
x/nfu addr allows us to examine memory starting at addr. Here:
- n = number of chunks of memory to examine
- f = the format in which to display the chunks
- u = the size unit of each chunk
It also lets you do x/nuf addr, but the number always has to come first.
Do help x to get the possible values of f and u.
| x/1ss addr | View a null-terminated string |
| x/5xw addr | View the 5 4-byte words starting at addr in hexadecimal |
| x/5xg addr | View the 5 8-byte "giant" words starting at addr |