gdb

gdb (the GNU Debugger) is the standard debugger for C, C++, and other compiled languages on Linux and UNIX-like systems. It runs programs under controlled conditions — breakpoints, watchpoints, single-stepping, register and memory inspection — making it the workhorse of exploit development, crash triage, and reverse engineering. Canonical documentation is the GDB User Manual at sourceware.org.

Startup

gdb                   # Run; use `file` command to load $OBJECT
gdb $OBJECT           # Debug $OBJECT
gdb $OBJECT $COREDUMP # Analyze a core dump
gdb $OBJECT $PID      # Attach to running process $PID

Attaching to a live process requires ptrace permissions (/proc/sys/kernel/yama/ptrace_scope on hardened systems). See the manual’s Starting and Attach sections.¹²

General commands

set args                     # Set program arguments
show args                    # Show program arguments
run                          # Run the program
run < file                   # Run with stdin from file
set follow-exec-mode new     # Follow exec() into the new image
set write on                 # Allow patching the executable in memory
continue                     # Continue until next breakpoint
finish                       # Run until current frame returns
source FILE                  # Read commands from script file
shell [cmd]                  # Run cmd in a shell
display /5i $eip             # Auto-display 5 instructions at $eip on stop
undisplay <n>                # Remove auto-display expression n
info functions               # List all functions
info variables               # List all variables
info registers               # List general-purpose registers
info all-registers           # List all registers (incl. FPU/SIMD)
info display                 # List auto-display expressions
backtrace                    # Backtrace of all stack frames
where                        # Alias for backtrace
set disassembly-flavor intel # Intel syntax instead of AT&T
define hook-stop             # Run commands whenever execution stops

hook-stop (and hook-<cmd> / hookpost-<cmd> generally) is how exploit developers print context — registers, stack top, next instructions — automatically at every stop, a poor-man’s pwndbg/gef before those plugins existed. Register inspection and disassembly details: Registers, Machine Code.³⁴

Breakpoints

info breakpoints              # List all breakpoints
break [func]                  # Break on function name
break *[addr]                 # Break at absolute address
delete [bnum]                 # Delete breakpoint bnum
break [func] if [cond]        # Conditional breakpoint
ignore [bnum] [count]         # Skip breakpoint count times
condition [bnum] $eax == 0x22 # Attach a condition to breakpoint bnum
condition [bnum]              # Remove the condition

Conditional breakpoints on register values are invaluable when hunting where user input lands in memory. Full reference: Breakpoints, Watchpoints, and Catchpoints.⁵

Watchpoints

info watchpoints           # List all watchpoints
watch variable==value      # Break when variable is written with value
watch $eax == 0x0000ffaa   # Break when register becomes value
rwatch *[addr]             # Break on read of memory location
awatch *[addr]             # Break on read or write

Hardware watchpoints let the CPU trap on access to an address without single-stepping — the fast way to find who writes the byte that corrupts your buffer.⁶

Exploit-development context

gdb is where memory-corruption bugs are actually understood: overflowing a stack buffer, watching the saved return address get clobbered, and calculating offsets all happen interactively under the debugger. For the defensive view of the bug class see OWASP: Buffer Overflow;⁷ for a language where the class is designed away — except across the JNI boundary — see java. Native crashes in JNI libraries loaded by a JVM can be debugged by attaching gdb to the Java process, bridging java’s memory-safety perimeter. Scripting gdb in Python (gdb -x, the Python API) underpins modern extensions like pwndbg and gef.

Sources

• GDB Manual — Starting your Program
• GDB Manual — Debugging an Already-running Process (Attach)
• GDB Manual — Breakpoints, Watchpoints, and Catchpoints
• GDB Manual — Setting Watchpoints
• GDB Manual — Backtraces
• GDB Manual — Registers
• GDB Manual — Source and Machine Code
• OWASP — Buffer Overflow

Related: java, java-rmi-exploitation, finger

Footnotes

1. GDB Manual — Starting your Program ↩

2. GDB Manual — Debugging an Already-running Process (Attach) ↩

3. GDB Manual — Registers ↩

4. GDB Manual — Source and Machine Code ↩

5. GDB Manual — Breakpoints, Watchpoints, and Catchpoints ↩

6. GDB Manual — Setting Watchpoints ↩

7. OWASP — Buffer Overflow ↩