This ticket is a small FAQ about the GDB debugger; it it’s strongly inspired from the chapter 2 of Hacking: the art of exploitation (2-end edition) book.
How to pass arguments to the debugged program
Use the command run <program_arguments> which will (re)run the program to be debugged.
How to add a breakpoint
Use the command break with different parameters:
break <line_number>
break <filename>:<line_number>
break <function>
break <filename>:<function>
How to set the disassembly syntax
The disassembly syntax can be set to Intel by typing:
set disassembly syntax_flavor or set dis syntax_favor
where syntax flavor can be intel or att (the default).
If you want that this parameter to be applied to all of your executions of GDB, then create a .gdbinit file in your home directory and add the previous line.
How to disassembly the debugged code
Use the command disassemble (or short disass) with parameters:
disass <file_name>:<function>
disass <function>
dissass <start_address>, <end_address>
dissass <start_address>, +<length>
Use the /m flag if you want to print mixed source+disassembly code.
How to examine the memory content
Use the command x which is the short for examine.
The examine command expects 2 arguments: the location of the memory to examine and how to display that memory content.
x/nfu <address>
- n is how many memory units to print (default to 1).
- f is format character. He are some common format letter:
- o – display in octal.
- x – display in hexadecimal.
- u – display in base 10.
- t – display in binary.
- i – display the memory as disassembled assembly language instructions.
- c – automatically lookup a byte on the ASCII table. (should be used with b unit).
- s – display an entire string of character data.
- u is unit. It can be :
- b – byte.
- h – half word (2 bytes).
- w – word (4 bytes) – default.
- g – giant word (8 bytes).
How to get information about registers
Use the command info registers <register_name> or short i r <register_name>. register_name may be any register name valid on the machine.
GDB has four “standard” register names that are available (in expressions) on most machines–whenever they do not conflict with an architecture’s canonical mnemonics for registers. The register names $pc and $sp are used for the program counter register and the stack pointer. $fp is used for a register that contains a pointer to the current stack frame, and $ps is used for a register that contains the processor status.
How to list the content of source code
Use the command list (abbreviated l) with different parameters:
list <filename>:<function>
list <filename>:<line_number>
By default GDB prints 10 code lines; the number of lines to print can be modified using the set listsize count command.
How to inspect the content of the stack
Use the command backtrace (abbreviated bt) with different parameters:
backtrace – print the entire stack.
backtrace n – print the first n entries of the stack.
backtrace -n – print the last n entries of the stack.
backtrace full – print the local variables contained in each stack frame.
Adventures in the programming jungle 