GDB + pwndbg

Debug & exploit binaries — breakpoints, memory exam, checksec & cyclic

GDB + pwndbg Cheat Sheet

GDB is the GNU debugger; pwndbg is a plugin that adds exploit-development context (registers, stack, disassembly, heap, ROP). Together they're the standard setup for binary exploitation and reversing. For authorized testing only.

1. Start & attach

gdb ./binary                  # load a binary
gdb ./binary core             # load with a core dump
gdb -p <pid>                  # attach to a running process
gdb --args ./binary arg1 arg2 # pass program arguments
gdb -q ./binary               # quiet (no banner)

Install pwndbg, then it auto-loads via ~/.gdbinit. Confirm with pwndbg at the prompt.

2. Running & stepping

Command	Short	Action
`run`	`r`	Start the program
`run < input.txt`		Run with stdin redirected
`continue`	`c`	Resume
`next`	`n`	Step over (source line)
`step`	`s`	Step into
`nexti`	`ni`	Step over one instruction
`stepi`	`si`	Step into one instruction
`finish`	`fin`	Run until current function returns
`start`		Break at `main` and run
`kill`	`k`	Stop the program

3. Breakpoints & watchpoints

break main                    # b main
break *0x401136               # break at an address
break file.c:42               # break at a source line
tbreak main                   # one-shot breakpoint
break func if $rdi == 0       # conditional
info breakpoints              # list (i b)
delete 2                      # remove breakpoint 2
disable 2 / enable 2
watch var                     # break when var is written
rwatch var                    # ... read
awatch var                    # ... read or write

4. Examining memory (`x`)

x/NFU address        N=count  F=format  U=unit

Formats: x hex  d dec  u uns  s string  i instr  c char  a addr  f float
Units:   b byte  h half(2)  w word(4)  g giant(8)

x/16xw $rsp          # 16 words of the stack as hex
x/20i $rip           # 20 instructions at the program counter
x/s 0x402004         # C string at address
x/8xb $rax           # 8 bytes
x/4xg $rsp           # 4 quadwords (64-bit)

5. Registers, stack & values

info registers       # i r   — all registers
p $rax               # print a register
p/x $rsp             # in hex
p $eflags
set $rip = 0x401000  # change a register
p (char*)0x402004    # cast + print
p &var               # address of a symbol
p sizeof(struct s)

6. Disassembly & source

disassemble main     # disas main
disassemble          # current function
disassemble 0x401000,0x401050
set disassembly-flavor intel    # Intel syntax (vs att)
info functions       # list functions
info line *0x401136
layout asm           # TUI: assembly view
layout regs          # TUI: registers

7. pwndbg essentials

context              # redraw regs / code / stack / backtrace
ctx                  # alias for context

# Memory layout & protections
vmmap                # process memory map (like /proc/pid/maps)
checksec             # NX, PIE, RELRO, Canary, Fortify

# Search
search "flag"        # search all memory for a string
search -t bytes 0xdeadbeef
search -p heap       # pointers into the heap

# Stack & registers in one view
stack 20             # dump 20 stack slots
telescope $rsp 20    # recursive pointer follow
regs

# Disasm / decompile helpers
nearpc               # disassemble around $pc
u main               # disassemble a function (pwndbg)

8. Heap analysis (pwndbg)

heap                 # walk the heap chunks
heap -v              # verbose
bins                 # tcache / fast / unsorted / small / large bins
fastbins
tcachebins
top_chunk
malloc_chunk <addr>  # parse a chunk header
vis_heap_chunks      # visualize heap layout
arena                # main_arena info

9. Exploit-dev helpers (pwndbg)

cyclic 200           # generate a De Bruijn pattern
cyclic -l 0x6161616c # find the offset of a value in the pattern
# (after a crash) cyclic -l $rsp    finds the overflow offset

rop --grep "pop rdi" # search ROP gadgets
ropgadget            # full gadget dump
got                  # GOT entries
plt                  # PLT entries
dt "struct name"     # dump a struct type
p2p <start> <end>    # pointer-to-pointer chains
canary               # locate the stack canary value
aslr                 # show/toggle ASLR for the debuggee

10. Find a buffer-overflow offset (end to end)

gdb -q ./vuln
pwndbg> cyclic 200                 # copy the pattern
pwndbg> run                        # paste pattern as input → crash
pwndbg> cyclic -l $rsp             # or -l 0x6161616c from the faulting value
# prints: Found at offset 72  → 72 bytes to reach the return address
pwndbg> checksec                   # confirm NX / PIE / canary before building the chain
pwndbg> rop --grep "pop rdi ; ret"

11. Tips

set follow-fork-mode child to debug a forked child; set detach-on-fork off to hold both.
set $rip = ADDR jumps execution; combine with breakpoints to test gadgets fast.
Disable ASLR locally with pwndbg> aslr off (or setarch -R) for stable addresses while developing.
define macros in ~/.gdbinit to script repetitive setups; gdb -x script.gdb.
Pipe a payload: run < <(python3 -c 'import sys; sys.stdout.buffer.write(b"A"*72+...)').

Authorized testing only. Practice on the AYSEC challenges. Pair with Ghidra for static analysis of the same binary.