Show Menu

Closed-source Debugging with GDB Cheat Sheet by

A reference to the arcane syntax of the Gnu Debugger, GDB. This cheat sheet is tailored for a reverse-engineering audience.

GDB: Launching

Launching GDB
gdb programfile
Start GDB ready to launch and debug progr­amfile
gdb --args program arg1 arg2
Start GDB as above but supplying command line arguments to the target process.
gdb -p pid
Attach GDB to a running target process.
Selecting the Start of Debugg­ing
gdb$ start
Run the debuggee and break at main() (if it exists).
gdb$ attach pid
Attach GDB to a running target process.
(gdb) attach
--waitfor proce­ss-­name
(Mac OS X only) Wait for a process to launch and immedi­ately attach to it.
Adding a shim
gdb$ set exec-w­rapper env 'LD_PR­ELO­AD=­li­bfo­'
The dynamic library file libfo­ will be loaded into the address space of the debuggee.
gdb$ set logging file filen­ame
The default logfile is gdb.txt but you can use this to change it.
gdb$ set logging overwrite off
The default is on, which overwrites the existing log file.
gdb$ set logging on
Turns on logging.
gdb$ echo comme­nt\n
With logging on, this will add a comment to the logfile.

GDB: Execution

Displaying the Call Stack
gdb$ bt
Show the list of stack frames (BackT­race).
gdb$ bt full
Show the list of stack frames with the local variables of each.
gdb$ info frame
Show saved stack pointer, call address, etc. for the selected stack frame.
gdb$ frame number
Select stack frame number number (and crashed GDB 6.3.50 on OS X).
Controlling Execut­ion
si [count]
Step-into (one or count instru­ction forward).
ni [count]
Step-over (one or count instru­ction, stepping over function calls).
return [value]
Immedi­ately return from the current function, optionally setting the return value.
Stop after finishing execution of the current function.
Any time GDB is stopped, this will continue normal execution.

GDB: Enviro­nment

gdb$ show env
Display the debuggee's current enviro­nment variables.
gdb$ set env varna­me­=v­alue
Set an enviro­nment variable.
gdb$ unset env varname
Delete an enviro­nment variable.
gdb$ show args
Display the comman­d-line arguments of the debuggee process.
gdb$ set args arg1 arg2
Set the comman­d-line arguments to the debuggee process.
gdb$ shell command
Run shell commands (useful commands may include "ps -e", etc.)
gdb$ pwd | cd
These two commands can can show or change the working directory of GDB (useful for logging, etc.).

GDB: Breakp­oints

Managing Breakp­oints
gdb$ set breakpoint pending on
Bypasses the warning about breakp­oints in modules that aren't loaded yet.
gdb$ break funct­ion
Sets a breakpoint at function if ("pe­ndi­ng" off) or when ("pe­nding on") a symbol by that name exists.
gdb$ break *0x000­01234
Sets a breakpoint at address 0x0000­1234.
gdb$ break 0x000­01234 if symbo­l=­=s­ome­value*
This is an example of the condit­ional breakpoint syntax.
gdb$ catch syscall name
Stop when the syscall name is called. Omit name to stop on every syscall. Instead of name, you can also specify a syscall by number.
gdb$ catch load
(not in Mac OS X) Stop when the debuggee loads any dynamic library. Also: catch unload.
gdb$ info break
List all breakp­oints and watchp­oints.
gdb$ clear [brea­kpo­int­id]
Deletes one or all existing breakp­oints. Without this cheat sheet, the user would be forced to guess what is being cleared.
gdb$ disable [brea­kpo­int­id]
Disables one or all breakp­oints.
Managing Watchp­oints (Data Breakp­oin­ts)
gdb$ watch *0x123­45678 [mask 0xffff­ff00]
Break on any change to the 24 most signif­icant bits of a 32-bit value at address 0x1234­5678.
gdb$ awatch *0x123­45678
Like watch, but also stops on any write or read accesses to the given address.
gdb$ rwatch *0x123­45678
Like watch, but only stops on read accesses.

GDB: Concur­rency

Multithreaded Debugg­ing
gdb$ info threads
List the threads of the target process.
gdb$ thread threa­dID
Attach GDB to the thread threa­dID.
gdb$ set non-stop on
Only the debugged thread is halted in GDB, the rest continue to run non-stop (unless they are blocking on the thread being debugged).
gdb$ set scheduler-locking on
Only the debugged thread will run when the debuggee is resumed.
gdb$ set schedu­ler­-lo­cking step
Only the debugged thread will step when being step-d­ebu­gged.
gdb$ show schedu­ler­-lo­cking
Display the current setting value.
Multiprocess Debugg­ing
gdb$ set follow­-fo­rk-mode child
GDB will detach at a fork() and attach to the new process.
gdb$ set follow­-fo­rk-mode parent
(Default) GDB will not detach at a fork().
gdb$ show follow­-fo­rk-­mode
Display the current setting value.
gdb$ set follow­-ex­ec-mode new
GDB will detach at an exec() and attach to the new process.
gdb$ set follow­-ex­ec-mode same
(Default) GDB will not detach at an exec().
gdb$ show follow­-ex­ec-­mode
Display the current setting value.
gdb$ set detach­-on­-fork off
GDB will not detach at a fork() and will also attach to the child process (both will be debugged).
gdb$ show detach­-on­-fork
Display the current setting value.
gdb$ info inferiors
List all processes under GDB's control. (On Mac OS X: info files)

GDB: Memory

Memory Images
gdb program -c dumpf­ile
Debug program using a memory dump file, image­file.
gdb$ generate-core-file
(not in Mac OS X) Dump the debuggee process memory to disk.
Reading Disass­embly and Memory
gdb$ set disass­emb­ly-­flavor intel
Use the modern syntax for x86-64 assembly. This is not the default.
gdb$ set disass­emb­le-­nex­t-line on
Disassemble the next instru­ction every time GDB stops. You want to turn this on.
gdb$ x/4i 0x0000­1234
Disassemble (eXamine) the first 4 instru­ctions at address 0x0000­1234.
gdb$ x/32i $rip
Disassemble the first 32 instru­ctions starting at the current instru­ction ($RIP on x86-64).
gdb$ x/32i $rip-16
Same command, but attempting to disass­emble both forward and backward from the current instru­ction.
gdb$ info address symbo­lname
Display the address in memory of a given symbol, specified by name.
gdb$ info symbol 0x0000­1234
Displays the symbol name (if any), executable segment, and executable module associated with the given address.
gdb$ x/1s 0x0000­1234
Display one null-t­erm­inated string at address 0x0000­1234.
gdb$ x/8xb 0x0000­1234
Display 8 heXade­cimal Bytes of memory starting at address 0x0000­1234.
gdb$ info registers
Display the value of the regular CPU registers.
gdb$ info all-re­gis­ters
Display the value of all CPU registers including floati­ng-­point and vector registers. Does not include special Machine Specific Registers (MSRs).
gdb$ find start­_ad­dress, dista­nce, value [, anoth­er_­value, ...]
(not in Mac OS X) Search memory for a value, given a starting point and a search distan­ce/­offset.
gdb$ info shared
Display info about all of the executable modules of the debuggee (name, load address, file path, etc.).
gdb$ info functions
Display all of the function symbols available and their associated addresses.
gdb$ info variables
Display all of the variable symbols available and their associated addresses.

GDB: Advanced

Anti-Anti Debugg­ing
gdb$ handle signal [keyw­ord­s...]
(Untested) might bypass except­ion­-based anti-d­ebu­gging
gdb$ catch syscall ptrace
(Untested) Use this breakpoint to return 0 (set $rax = 0; continue), should bypass ptrace() checking by the debuggee.


This is really great and pretty complete. Thanks for sharing! I am printing this and putting on my desk

Add a Comment

Your Comment

Please enter your name.

    Please enter your email address

      Please enter your Comment.

          Related Cheat Sheets

          oAuth End Points Cheat Sheet
          ISTQB Test Automation Engineering Cheat Sheet