GEF (GDB Enhanced Features) is a comprehensive GDB plugin that extends debugging capabilities with security-focused commands, improved visualization, and exploit development tools. It provides better context awareness, memory analysis, and vulnerability detection than standard GDB.
GEF is designed for:
- Binary exploitation and reverse engineering
- Security vulnerability identification
- Exploit development and testing
- Memory corruption vulnerability analysis
- Advanced debugging workflows
- GDB 8.0 or later
- Python 3.6+
- Linux/Unix system
- Git (for cloning)
# Clone GEF repository
git clone https://github.com/hugsy/gef.git ~/gef
# Add to GDB initialization
echo "source ~/gef/gef.py" >> ~/.gdbinit
# Verify installation
gdb -q
# You should see GEF banner at startup
# Direct download and install
curl -L https://github.com/hugsy/gef/raw/main/gef.py -o ~/gef.py
echo "source ~/gef.py" >> ~/.gdbinit
# Optional: Create GEF config file
cat > ~/.gef.rc << 'EOF'
# GEF configuration
gef config gef.tempdir /tmp/gef
gef config theme elegant
gef config readline.history 10000
EOF
| Command | Purpose | Example |
|---|
gef help | Show all GEF commands | gef> gef help |
gef version | Display GEF version | gef> gef version |
gef config | Manage GEF settings | gef> gef config |
gef set | Change GEF configuration | gef> gef set theme light |
checksec | Analyze binary security protections | gef> checksec |
vmmap | Display virtual memory layout | gef> vmmap |
hex-dump | Show hex dump of memory | gef> hex-dump <address> |
| Command | Description |
|---|
context | Display full execution context (register, stack, code) |
context args | Show function arguments |
context code | Display assembly code near current position |
context memory | Show memory content and access |
context stack | Display stack content with analysis |
context registers | Show register values with interpretation |
# Full context display
gdb ./binary
(gdb) break main
(gdb) run
(gdb) context # Shows all: registers, stack, code
# Display only specific context
(gdb) context code # Only show assembly
(gdb) context stack # Only show stack
(gdb) context registers # Only show registers
# Show all registers with values
(gdb) registers
# Display register with pointer dereferencing
(gdb) reg rax
(gdb) reg rdi $rax
# Analyze register content
(gdb) p/x $rax
(gdb) p/d $rbx
(gdb) p/s $rcx
| Command | Purpose |
|---|
memory | Analyze memory regions |
memory watch | Monitor memory changes |
memory search | Find patterns in memory |
memory dereference | Follow pointer chains |
memory alignment | Check memory alignment |
# Display stack with context
(gdb) stack 20 # Show 20 stack entries
(gdb) dereference $rsp 10 # Dereference stack pointers
# Find stack canary value
(gdb) stack canary
# Monitor stack changes
(gdb) watch $rsp
# Search for specific bytes in memory
(gdb) search "A8 4A"
# Dump memory range as hex
(gdb) hex-dump <start_address> <size>
# Display memory as string
(gdb) memory read <address> 256
# Find writable memory sections
(gdb) memory regions
| Command | Description |
|---|
disas <function> | Disassemble function with GEF enhancement |
disas <addr>, <addr> | Disassemble memory range |
disas /m <function> | Disassembly with source code |
set disassembly-flavor intel | Use Intel syntax |
set disassembly-flavor att | Use AT&T syntax |
# Disassemble main function
(gdb) disas main
# Disassemble specific address range
(gdb) disas *0x08048400, *0x08048500
# Show source code with assembly
(gdb) disas /m vulnerable_function
# Follow execution flow
(gdb) disas $rip, $rip+50
# Search for ROP gadgets (requires ROPgadget)
(gdb) rop
# Filter gadget results
(gdb) rop --filter "pop|ret"
(gdb) rop --search "mov rax"
# Find one-gadget exploits
(gdb) one-gadget
# 1. Identify useful registers
(gdb) context registers
# 2. Search for loading gadgets
(gdb) rop --search "mov rdi"
# 3. Find system call gadgets
(gdb) rop --search "syscall"
# 4. Locate return gadgets
(gdb) rop --filter "ret"
# Analyze format string vulnerability
(gdb) fmtstr <address> <offset>
# Detect format string read
(gdb) fmtstr_read <address> <offset>
# Detect format string write
(gdb) fmtstr_write <address> <offset> <value>
# Create overflow pattern
(gdb) pattern <size> # Generate pattern inline
(gdb) pattern create <size> # Save to file
# Example: 100-byte pattern
(gdb) pattern create 100 /tmp/pattern.txt
# Find offset of value in pattern
(gdb) pattern offset <value>
# Practical overflow test
(gdb) break vulnerable_function
(gdb) run < /tmp/pattern.txt
# (binary crashes)
(gdb) pattern offset <crash_value>
# Display heap information
(gdb) heap
# Show heap chunks
(gdb) heap chunks
# Analyze heap bins
(gdb) heap bins
# Detect heap corruption
(gdb) heap validate
# Show heap statistics
(gdb) heap stats
# Monitor allocations
(gdb) break malloc
(gdb) run
(gdb) heap # Show initial heap state
# Step through allocations
(gdb) continue
(gdb) heap chunks # Show chunk layout
# Detect use-after-free
(gdb) watch <pointer>
| Command | Purpose |
|---|
break <location> | Set standard breakpoint |
break <location> if <condition> | Conditional breakpoint |
tbreak <location> | Temporary breakpoint |
rbreak <pattern> | Set breakpoint on pattern match |
watch <expression> | Break on variable change |
awatch <expression> | Break on variable access/write |
# Break on specific condition
(gdb) break malloc if $arg0 > 4096
# Break when register has value
(gdb) break *0x08048400 if $eax == 0x41414141
# Monitor stack pointer changes
(gdb) watch $rsp
# Hardware watchpoint
(gdb) awatch <address>
# Break on pattern in memory
(gdb) break *malloc if strncmp($arg0, "AAAA", 4) == 0
# Trace execution
(gdb) trace-instruction on
(gdb) run
(gdb) trace-instruction off
# Step and display context
(gdb) si # Step one instruction
(gdb) ni # Step over instruction
(gdb) continue # Continue execution
# Patch memory at runtime
(gdb) set {unsigned int}<address> = 0x90909090
# Write byte sequence
(gdb) set {unsigned char}<address> = 0x90
# Verify patch
(gdb) x/i <address>
# Patch and test exploit
(gdb) set {void *}<rip> = 0x<gadget_address>
# Display function arguments (x86-64)
(gdb) info args
# Examine first argument (rdi)
(gdb) p/x $rdi
# Second argument (rsi)
(gdb) p/x $rsi
# Third argument (rdx)
(gdb) p/x $rdx
# Examine string argument
(gdb) p/s (char*)$rdi
# Full security check
(gdb) checksec
# Output shows:
# - Canary (stack canary)
# - Fortify (source fortification)
# - NX (no-execute bit)
# - PIE (position independent executable)
# - RELRO (relocation read-only)
# - ASLR (address space layout randomization)
# Disable ASLR
(gdb) set disable-randomization on
# Verify ASLR disabled
(gdb) vmmap
(gdb) break main
(gdb) run
# Check consistent addresses
(gdb) info proc mappings
# Print structure at address
(gdb) p *(struct_type *)<address>
# Display array elements
(gdb) p array[0]@10 # Print first 10 elements
# Inspect linked list
(gdb) p *node->next
# Deep structure analysis
(gdb) p *((struct_type *)<address>)->member
# Find symbol address
(gdb) info address <symbol>
# List all symbols
(gdb) info symbols
# Search for function
(gdb) info functions <pattern>
# List variables
(gdb) info variables
# Enable logging
(gdb) set logging on
(gdb) set logging file /tmp/gdb.log
# Verify logging
(gdb) run
(gdb) context
# Disable logging
(gdb) set logging off
# View log
!cat /tmp/gdb.log
# Execute command and save output
(gdb) set logging overwrite on
(gdb) shell echo "Starting exploit test" >> /tmp/test.log
(gdb) disas main >> /tmp/disas.txt
(gdb) set logging off
# Create script with GEF commands
cat > /tmp/exploit_script.gdb << 'EOF'
file ./vulnerable
break main
run
context
vmmap
checksec
break vulnerable_function
continue
stack 20
hex-dump $rsp 100
rop --search "pop rdi"
quit
EOF
# Execute script
gdb -x /tmp/exploit_script.gdb
# Python commands in GDB
(gdb) python
print(gdb.selected_frame().architecture().registers())
end
# Execute Python script
(gdb) source /tmp/custom_gef.py
# 1. Load binary and analyze security
gdb ./vulnerable
(gdb) checksec # Check protections
(gdb) vmmap # View memory layout
# 2. Locate vulnerability
(gdb) disas main
(gdb) break vulnerable_func
(gdb) run "AAAA"
# 3. Crash analysis
(gdb) context # Full execution context
(gdb) p/x $rax # Examine registers
(gdb) hex-dump $rsp 100 # Show stack
# 4. Calculate offset
(gdb) pattern create 500
(gdb) run < /tmp/pattern.txt
(gdb) pattern offset <crash>
# 5. Find gadgets
(gdb) rop --search "pop rdi"
# 6. Build and test exploit
(gdb) p/x &system_function
(gdb) p/x &exit_function
| Setting | Purpose | Example |
|---|
theme | Color theme (light/dark) | gef config theme light |
tempdir | Temporary directory | gef config gef.tempdir /tmp/gef |
max-display-items | Max items to show | gef config max-display-items 50 |
readline.history | Command history size | gef config readline.history 10000 |
# List all GEF settings
(gdb) gef config
# Set individual options
(gdb) gef set theme light
(gdb) gef set max-display-items 100
# Save configuration
(gdb) gef save # Saves to ~/.gef.rc
# Find gadgets with ROPgadget
ropgadget --binary ./vulnerable --search "pop rdi"
# Search in GEF
(gdb) rop --binary ./vulnerable
# Find existing exploits
(gdb) shell searchsploit -t <vulnerability>
# Analyze found exploit
(gdb) shell cat /usr/share/exploitdb/exploits/linux/local/12345.py
- Use context frequently: Display context regularly to maintain situational awareness
- Enable ASLR protection: Only disable ASLR when necessary for debugging
- Save terminal output: Use
set logging on for exploitation walkthroughs
- Test locally first: Always test exploits locally before deployment
- Monitor memory changes: Use watchpoints for heap vulnerability debugging
- Document gadgets: Save ROP gadget searches for reference
- Use conditional breakpoints: Break only on interesting conditions
- Verify exploits: Test multiple times to ensure reliability
# 1. Run with ASAN/UBSAN
ASAN_OPTIONS=verbosity=1 ./vulnerable
# 2. Attach GEF for deeper analysis
gdb -p <pid>
(gdb) context
(gdb) vmmap
# 1. Analyze binary structure
(gdb) checksec
(gdb) disas main
(gdb) info functions
# 2. Follow execution
(gdb) break <function>
(gdb) run
(gdb) disas /m <function>
# 1. Identify vulnerability
(gdb) break vulnerable_func
(gdb) run <payload>
# 2. Analyze crash
(gdb) context
(gdb) pattern offset <value>
# 3. Develop exploit
(gdb) rop --search "gadgets"
(gdb) p/x <function_address>
| Issue | Solution |
|---|
| GEF not loading | Check ~/.gdbinit contains source ~/gef/gef.py |
| Python errors | Ensure Python 3.6+ and GDB with Python support |
| Slow performance | Reduce max-display-items or use specific context commands |
| Memory access errors | Enable set disable-randomization on |
| ROPgadget not found | Install with pip install ropgadget |
GEF enhances GDB with powerful security-focused debugging capabilities:
- Enhanced context display for better understanding of program state
- Security protection analysis (ASLR, DEP, canaries, PIE)
- Memory and heap analysis for corruption vulnerability detection
- ROP gadget finding for code reuse exploitation
- Automated pattern generation for overflow detection
- Integration with security tools (ROPgadget, Exploit-DB)
Combine GEF with vulnerability scanning tools and manual analysis for comprehensive binary exploitation and reverse engineering capabilities.
