{"id":3300,"date":"2021-07-23T08:27:06","date_gmt":"2021-07-23T06:27:06","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=3300"},"modified":"2021-07-31T15:07:19","modified_gmt":"2021-07-31T13:07:19","slug":"gdb","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=3300","title":{"rendered":"gdb"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Gen\u00ader\u00adal pur\u00adpose debugger.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Hint<\/em>: gbd dis\u00adables <span class=\"caps\">ASRL<\/span> by default.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Commands<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Gen\u00ader\u00adal<\/strong><ul><li><code>set disassembly-flavor intel\/att<\/code><\/li><\/ul><\/li><li><strong>Process han\u00addling<\/strong><ul><li><code>run<\/code> runs a pro\u00adgramm with\u00adout parameters<\/li><li><code>run `python -c 'print(\"a\")'<\/code>\u2018 runs a pro\u00adgram with a parameter<\/li><li><code>run &lt; &lt;(python -c 'print(\"a\")'<\/code>) runs a pro\u00adgram and enters the giv\u00aden string into&nbsp;<span class=\"caps\">STDIN<\/span><\/li><li><code>c<\/code> continue<\/li><li><code>si<\/code> step one instruction<\/li><\/ul><\/li><li>Break\u00adpoints<ul><li><code>break $f<\/code> or <code>break *$address<\/code><\/li><li><code>del breakpoints<\/code><\/li><li><code>info breakpoints<\/code><\/li><\/ul><\/li><li>Dis\u00adas\u00adsem\u00adbling<ul><li><code>disass &lt;$function | $address&gt; <\/code>dis\u00adas\u00adsem\u00adbles a func\u00adtion or mem\u00ado\u00adry address<ul><li>shows with para\u00adme\u00adter <code>-r <\/code>the opcodes<\/li><\/ul><\/li><li><code>print<\/code> or <code>info<\/code> prints con\u00adtent of reg\u00adis\u00adters and variables<ul><li><code>info func<\/code> shows all functions<\/li><\/ul><\/li><li><code>x\/$numi $address<\/code> prints $num entries from address $address on<ul><li><code>x\/32wx $esp-32 <\/code>(x86) or <code>x\/32gw $rsp-32 <\/code>(x64) for show\u00ading the mem\u00ado\u00adry at the stack pointer.<ul><li><strong>Impor\u00adtant<\/strong>: remem\u00adber to decrese the address from the stack point\u00ader because the stack is above&nbsp;it\u2026<\/li><\/ul><\/li><li><code>x\/32s $esp-32 <\/code>(x86) or <code>x\/32s $rsp-32 <\/code>(x64) for show\u00ading the mem\u00ado\u00adry at the stack point\u00ader <em>as strings<\/em>.<\/li><\/ul><\/li><li><code>backtrace<\/code> prints the return pointer<\/li><li><code>info functions<\/code> shows all functions<\/li><li><code>bt<\/code> back\u00adtrace \u2014 Shows where the cur\u00adrent address is references.<\/li><\/ul><\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Peda<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/longld\/peda\">Peda<\/a> is a exten\u00adsion for gdb which pro\u00advides use\u00adful addi\u00adtion\u00adal commands.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><em>Gen\u00ader\u00adal information<\/em><ul><li><code>checksec<\/code> prints the secu\u00adri\u00adty options<\/li><li><code>aslr<\/code> prints whether aslr is active<\/li><\/ul><\/li><li>(Cross-) ref\u00ader\u00adenc\u00ading<ul><li><code>xrefs $function<\/code> shows all ref\u00ader\u00adences to the giv\u00aden function.<ul><li>Note that gdb\u2019s <code>bt<\/code> shows ref\u00ader\u00adences to an address and Peda\u2019s <code>xrefs<\/code> to a func\u00adtion (=start address of a function)<\/li><\/ul><\/li><\/ul><\/li><li>Pay\u00adload creation<ul><li><code>pattern_create n<\/code> cre\u00adats a string pat\u00adtern like msfvenom<\/li><li><code>jmpcall<\/code> search\u00ades for jmp&nbsp;calls<\/li><\/ul><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Gen\u00ader\u00adal pur\u00adpose debug\u00adger. Hint: gbd dis\u00adables <span class=\"caps\">ASRL<\/span> by default.&nbsp; Com\u00admands Gen\u00ader\u00adal set dis\u00adas\u00adsem\u00adbly-fla\u00advor intel\/att Process han\u00addling run runs a pro\u00adgramm with\u00adout para\u00adme\u00adters run \u2018python \u2011c \u2018print(\u201ca\u201d)\u2019\u2018 runs a pro\u00adgram with a para\u00adme\u00adter run &lt; &lt;(python \u2011c \u2018print(\u201ca\u201d)\u2019) runs a pro\u00adgram and enters the giv\u00aden string into&nbsp;<span class=\"caps\">STDIN<\/span> c con\u00adtin\u00adue si step one instruc\u00adtion Break\u00adpoints break $f [\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[355],"tags":[415,424,409],"class_list":["post-3300","post","type-post","status-publish","format-standard","hentry","category-reverse-engineering","tag-gdb","tag-peda","tag-reverse-engineering"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/3300","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3300"}],"version-history":[{"count":8,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/3300\/revisions"}],"predecessor-version":[{"id":3379,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/3300\/revisions\/3379"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3300"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3300"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3300"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}