\documentclass[10pt,a4paper]{article} % Packages \usepackage{fancyhdr} % For header and footer \usepackage{multicol} % Allows multicols in tables \usepackage{tabularx} % Intelligent column widths \usepackage{tabulary} % Used in header and footer \usepackage{hhline} % Border under tables \usepackage{graphicx} % For images \usepackage{xcolor} % For hex colours %\usepackage[utf8x]{inputenc} % For unicode character support \usepackage[T1]{fontenc} % Without this we get weird character replacements \usepackage{colortbl} % For coloured tables \usepackage{setspace} % For line height \usepackage{lastpage} % Needed for total page number \usepackage{seqsplit} % Splits long words. %\usepackage{opensans} % Can't make this work so far. Shame. Would be lovely. \usepackage[normalem]{ulem} % For underlining links % Most of the following are not required for the majority % of cheat sheets but are needed for some symbol support. \usepackage{amsmath} % Symbols \usepackage{MnSymbol} % Symbols \usepackage{wasysym} % Symbols %\usepackage[english,german,french,spanish,italian]{babel} % Languages % Document Info \author{fristle} \pdfinfo{ /Title (closed-source-debugging-with-gdb.pdf) /Creator (Cheatography) /Author (fristle) /Subject (Closed-source Debugging with GDB Cheat Sheet) } % Lengths and widths \addtolength{\textwidth}{6cm} \addtolength{\textheight}{-1cm} \addtolength{\hoffset}{-3cm} \addtolength{\voffset}{-2cm} \setlength{\tabcolsep}{0.2cm} % Space between columns \setlength{\headsep}{-12pt} % Reduce space between header and content \setlength{\headheight}{85pt} % If less, LaTeX automatically increases it \renewcommand{\footrulewidth}{0pt} % Remove footer line \renewcommand{\headrulewidth}{0pt} % Remove header line \renewcommand{\seqinsert}{\ifmmode\allowbreak\else\-\fi} % Hyphens in seqsplit % This two commands together give roughly % the right line height in the tables \renewcommand{\arraystretch}{1.3} \onehalfspacing % Commands \newcommand{\SetRowColor}[1]{\noalign{\gdef\RowColorName{#1}}\rowcolor{\RowColorName}} % Shortcut for row colour \newcommand{\mymulticolumn}[3]{\multicolumn{#1}{>{\columncolor{\RowColorName}}#2}{#3}} % For coloured multi-cols \newcolumntype{x}[1]{>{\raggedright}p{#1}} % New column types for ragged-right paragraph columns \newcommand{\tn}{\tabularnewline} % Required as custom column type in use % Font and Colours \definecolor{HeadBackground}{HTML}{333333} \definecolor{FootBackground}{HTML}{666666} \definecolor{TextColor}{HTML}{333333} \definecolor{DarkBackground}{HTML}{25C3DB} \definecolor{LightBackground}{HTML}{F1FBFC} \renewcommand{\familydefault}{\sfdefault} \color{TextColor} % Header and Footer \pagestyle{fancy} \fancyhead{} % Set header to blank \fancyfoot{} % Set footer to blank \fancyhead[L]{ \noindent \begin{multicols}{3} \begin{tabulary}{5.8cm}{C} \SetRowColor{DarkBackground} \vspace{-7pt} {\parbox{\dimexpr\textwidth-2\fboxsep\relax}{\noindent \hspace*{-6pt}\includegraphics[width=5.8cm]{/web/www.cheatography.com/public/images/cheatography_logo.pdf}} } \end{tabulary} \columnbreak \begin{tabulary}{11cm}{L} \vspace{-2pt}\large{\bf{\textcolor{DarkBackground}{\textrm{Closed-source Debugging with GDB Cheat Sheet}}}} \\ \normalsize{by \textcolor{DarkBackground}{fristle} via \textcolor{DarkBackground}{\uline{cheatography.com/5574/cs/1012/}}} \end{tabulary} \end{multicols}} \fancyfoot[L]{ \footnotesize \noindent \begin{multicols}{3} \begin{tabulary}{5.8cm}{LL} \SetRowColor{FootBackground} \mymulticolumn{2}{p{5.377cm}}{\bf\textcolor{white}{Cheatographer}} \\ \vspace{-2pt}fristle \\ \uline{cheatography.com/fristle} \\ \end{tabulary} \vfill \columnbreak \begin{tabulary}{5.8cm}{L} \SetRowColor{FootBackground} \mymulticolumn{1}{p{5.377cm}}{\bf\textcolor{white}{Cheat Sheet}} \\ \vspace{-2pt}Published 2nd May, 2013.\\ Updated 12th May, 2016.\\ Page {\thepage} of \pageref{LastPage}. \end{tabulary} \vfill \columnbreak \begin{tabulary}{5.8cm}{L} \SetRowColor{FootBackground} \mymulticolumn{1}{p{5.377cm}}{\bf\textcolor{white}{Sponsor}} \\ \SetRowColor{white} \vspace{-5pt} %\includegraphics[width=48px,height=48px]{dave.jpeg} Measure your website readability!\\ www.readability-score.com \end{tabulary} \end{multicols}} \begin{document} \raggedright \raggedcolumns % Set font size to small. Switch to any value % from this page to resize cheat sheet text: % www.emerson.emory.edu/services/latex/latex_169.html \footnotesize % Small font. \begin{multicols*}{3} \begin{tabularx}{5.377cm}{x{2.4885 cm} x{2.4885 cm} } \SetRowColor{DarkBackground} \mymulticolumn{2}{x{5.377cm}}{\bf\textcolor{white}{GDB: Launching \{\{fa-rocket\}\}}} \tn % Row 0 \SetRowColor{LightBackground} \mymulticolumn{2}{x{5.377cm}}{\{\{ac\}\}{\bf{Launching GDB}}} \tn % Row Count 1 (+ 1) % Row 1 \SetRowColor{white} \{\{bt\}\}\{\{nobreak\}\}`gdb {\emph{programfile}}` & \{\{bt\}\}Start GDB ready to launch and debug {\emph{programfile}} \tn % Row Count 4 (+ 3) % Row 2 \SetRowColor{LightBackground} `gdb -{}-args {\emph{program arg1 arg2}}` & Start GDB as above but supplying command line arguments to the target process. \tn % Row Count 8 (+ 4) % Row 3 \SetRowColor{white} `gdb -p {\emph{pid}}` & Attach GDB to a running target process. \tn % Row Count 10 (+ 2) % Row 4 \SetRowColor{LightBackground} \mymulticolumn{2}{x{5.377cm}}{\{\{ac\}\}\{\{bt\}\}{\bf{Selecting the Start of Debugging}}} \tn % Row Count 11 (+ 1) % Row 5 \SetRowColor{white} \{\{bt\}\}`{\emph{gdb\$}} start` & \{\{bt\}\}Run the debuggee and break at {\emph{main()}} (if it exists). \tn % Row Count 14 (+ 3) % Row 6 \SetRowColor{LightBackground} `{\emph{gdb\$}} attach {\emph{pid}}` & Attach GDB to a running target process. \tn % Row Count 16 (+ 2) % Row 7 \SetRowColor{white} `(gdb) attach \{\{nl\}\}-{}-waitfor {\emph{process-name}}` & (Mac OS X only) Wait for a process to launch and immediately attach to it. \tn % Row Count 20 (+ 4) % Row 8 \SetRowColor{LightBackground} \mymulticolumn{2}{x{5.377cm}}{\{\{ac\}\}\{\{bt\}\}{\bf{Adding a shim}}} \tn % Row Count 21 (+ 1) % Row 9 \SetRowColor{white} \{\{bt\}\}`{\emph{gdb\$}} set exec-wrapper env 'LD\_PRELOAD={\emph{libfoo.so}}'` & \{\{bt\}\}The dynamic library file {\emph{libfoo.so}} will be loaded into the address space of the debuggee. \tn % Row Count 26 (+ 5) % Row 10 \SetRowColor{LightBackground} \mymulticolumn{2}{x{5.377cm}}{\{\{ac\}\}\{\{bt\}\}{\bf{Logging}}} \tn % Row Count 27 (+ 1) % Row 11 \SetRowColor{white} \{\{bt\}\}`{\emph{gdb\$}} set logging file {\emph{filename}}` & \{\{bt\}\}The default logfile is gdb.txt but you can use this to change it. \tn % Row Count 31 (+ 4) \end{tabularx} \par\addvspace{1.3em} \vfill \columnbreak \begin{tabularx}{5.377cm}{x{2.4885 cm} x{2.4885 cm} } \SetRowColor{DarkBackground} \mymulticolumn{2}{x{5.377cm}}{\bf\textcolor{white}{GDB: Launching \{\{fa-rocket\}\} (cont)}} \tn % Row 12 \SetRowColor{LightBackground} `{\emph{gdb\$}} set logging overwrite off` & The default is on, which overwrites the existing log file. \tn % Row Count 3 (+ 3) % Row 13 \SetRowColor{white} `{\emph{gdb\$}} set logging on` & Turns on logging. \tn % Row Count 5 (+ 2) % Row 14 \SetRowColor{LightBackground} `{\emph{gdb\$}} echo {\emph{comment\textbackslash{}n}}` & With logging on, this will add a comment to the logfile. \tn % Row Count 8 (+ 3) \hhline{>{\arrayrulecolor{DarkBackground}}--} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{5.377cm}{x{1.84149 cm} x{3.13551 cm} } \SetRowColor{DarkBackground} \mymulticolumn{2}{x{5.377cm}}{\bf\textcolor{white}{GDB: Execution \{\{fa-gears\}\}}} \tn % Row 0 \SetRowColor{LightBackground} \mymulticolumn{2}{x{5.377cm}}{\{\{ac\}\}{\bf{Displaying the Call Stack}}} \tn % Row Count 1 (+ 1) % Row 1 \SetRowColor{white} \{\{bt\}\}`{\emph{gdb\$}} bt` & \{\{bt\}\}Show the list of stack frames (BackTrace). \tn % Row Count 3 (+ 2) % Row 2 \SetRowColor{LightBackground} `{\emph{gdb\$}} bt full` & Show the list of stack frames with the local variables of each. \tn % Row Count 6 (+ 3) % Row 3 \SetRowColor{white} `{\emph{gdb\$}} info frame` & Show saved stack pointer, call address, etc. for the selected stack frame. \tn % Row Count 9 (+ 3) % Row 4 \SetRowColor{LightBackground} `{\emph{gdb\$}} frame {\emph{number}}` & Select stack frame number {\emph{number}} (and crashed GDB 6.3.50 on OS X). \tn % Row Count 12 (+ 3) % Row 5 \SetRowColor{white} \mymulticolumn{2}{x{5.377cm}}{\{\{ac\}\}\{\{bt\}\}{\bf{Controlling Execution}}} \tn % Row Count 13 (+ 1) % Row 6 \SetRowColor{LightBackground} \{\{bt\}\}`si {[}{\emph{count}}{]}` & \{\{bt\}\}Step-into (one or {\emph{count}} instruction forward). \tn % Row Count 16 (+ 3) % Row 7 \SetRowColor{white} `ni {[}{\emph{count}}{]}` & Step-over (one or {\emph{count}} instruction, stepping over function calls). \tn % Row Count 19 (+ 3) % Row 8 \SetRowColor{LightBackground} `return {[}{\emph{value}}{]}` & Immediately return from the current function, optionally setting the return value. \tn % Row Count 23 (+ 4) % Row 9 \SetRowColor{white} `finish` & Stop after finishing execution of the current function. \tn % Row Count 26 (+ 3) % Row 10 \SetRowColor{LightBackground} `continue` & Any time GDB is stopped, this will continue normal execution. \tn % Row Count 29 (+ 3) \hhline{>{\arrayrulecolor{DarkBackground}}--} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{5.377cm}{X} \SetRowColor{DarkBackground} \mymulticolumn{1}{x{5.377cm}}{\bf\textcolor{white}{GDB: Environment \{\{fa-wrench\}\}}} \tn % Row 0 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} show env`} \tn % Row Count 1 (+ 1) % Row 1 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Display the debuggee's current environment variables.} \tn % Row Count 3 (+ 2) % Row 2 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} set env {\emph{varname}}={\emph{value}}`} \tn % Row Count 4 (+ 1) % Row 3 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Set an environment variable.} \tn % Row Count 5 (+ 1) % Row 4 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} unset env {\emph{varname}}`} \tn % Row Count 6 (+ 1) % Row 5 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Delete an environment variable.} \tn % Row Count 7 (+ 1) % Row 6 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} show args`} \tn % Row Count 8 (+ 1) % Row 7 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Display the command-line arguments of the debuggee process.} \tn % Row Count 10 (+ 2) % Row 8 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} set args {\emph{arg1}} {\emph{arg2}}`} \tn % Row Count 11 (+ 1) % Row 9 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Set the command-line arguments to the debuggee process.} \tn % Row Count 13 (+ 2) % Row 10 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} shell {\emph{command}}`} \tn % Row Count 14 (+ 1) % Row 11 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Run shell commands (useful commands may include "ps -e", etc.)} \tn % Row Count 16 (+ 2) % Row 12 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} pwd | cd`} \tn % Row Count 17 (+ 1) % Row 13 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}These two commands can can show or change the working directory of GDB (useful for logging, etc.).} \tn % Row Count 20 (+ 3) \hhline{>{\arrayrulecolor{DarkBackground}}-} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{5.377cm}{X} \SetRowColor{DarkBackground} \mymulticolumn{1}{x{5.377cm}}{\bf\textcolor{white}{GDB: Breakpoints \{\{fa-bullseye\}\}}} \tn % Row 0 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ac\}\}{\bf{Managing Breakpoints}}} \tn % Row Count 1 (+ 1) % Row 1 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{bt\}\}`{\emph{gdb\$}} set breakpoint pending on`} \tn % Row Count 2 (+ 1) % Row 2 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Bypasses the warning about breakpoints in modules that aren't loaded yet.} \tn % Row Count 4 (+ 2) % Row 3 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} break {\emph{function}}`} \tn % Row Count 5 (+ 1) % Row 4 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Sets a breakpoint at {\emph{function}} {\bf{{\emph{if}}}} ("pending" off) or {\bf{{\emph{when}}}} ("pending on") a symbol by that name exists.} \tn % Row Count 8 (+ 3) % Row 5 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} break *0x00001234`} \tn % Row Count 9 (+ 1) % Row 6 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Sets a breakpoint at address 0x00001234.} \tn % Row Count 10 (+ 1) % Row 7 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} break {\emph{0x00001234 if }}symbol{\emph{==}}somevalue*`} \tn % Row Count 12 (+ 2) % Row 8 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}This is an example of the conditional breakpoint syntax.} \tn % Row Count 14 (+ 2) % Row 9 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} catch syscall {\emph{name}}`} \tn % Row Count 15 (+ 1) % Row 10 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Stop when the syscall {\emph{name}} is called. Omit {\emph{name}} to stop on every syscall. Instead of name, you can also specify a syscall by number.} \tn % Row Count 18 (+ 3) % Row 11 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} catch load`} \tn % Row Count 19 (+ 1) % Row 12 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}(not in Mac OS X) Stop when the debuggee loads any dynamic library. Also: catch unload.} \tn % Row Count 21 (+ 2) % Row 13 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} info break`} \tn % Row Count 22 (+ 1) % Row 14 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}List all breakpoints and watchpoints.} \tn % Row Count 23 (+ 1) % Row 15 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} clear {[}{\emph{breakpointid}}{]}`} \tn % Row Count 24 (+ 1) % Row 16 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Deletes one or all existing breakpoints. Without this cheat sheet, the user would be forced to guess what is being cleared.} \tn % Row Count 27 (+ 3) % Row 17 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} disable {[}{\emph{breakpointid}}{]}`} \tn % Row Count 28 (+ 1) % Row 18 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Disables one or all breakpoints.} \tn % Row Count 29 (+ 1) % Row 19 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{} \tn % Row Count 29 (+ 0) % Row 20 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ac\}\}\{\{bt\}\}{\bf{Managing Watchpoints (Data Breakpoints)}}} \tn % Row Count 31 (+ 2) \end{tabularx} \par\addvspace{1.3em} \vfill \columnbreak \begin{tabularx}{5.377cm}{X} \SetRowColor{DarkBackground} \mymulticolumn{1}{x{5.377cm}}{\bf\textcolor{white}{GDB: Breakpoints \{\{fa-bullseye\}\} (cont)}} \tn % Row 21 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{bt\}\}`{\emph{gdb\$}} watch *0x12345678 {[}mask 0xffffff00{]}`} \tn % Row Count 1 (+ 1) % Row 22 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Break on any {\bf{change}} to the 24 most significant bits of a 32-bit value at address 0x12345678.} \tn % Row Count 4 (+ 3) % Row 23 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} awatch *0x12345678`} \tn % Row Count 5 (+ 1) % Row 24 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Like watch, but also stops on {\bf{any}} write or read accesses to the given address.} \tn % Row Count 7 (+ 2) % Row 25 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} rwatch *0x12345678`} \tn % Row Count 8 (+ 1) % Row 26 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Like watch, but only stops on read accesses.} \tn % Row Count 9 (+ 1) \hhline{>{\arrayrulecolor{DarkBackground}}-} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{5.377cm}{X} \SetRowColor{DarkBackground} \mymulticolumn{1}{x{5.377cm}}{\bf\textcolor{white}{GDB: Concurrency \{\{fa-navicon\}\}}} \tn % Row 0 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ac\}\}\{\{bt\}\}{\bf{Multithreaded Debugging}}} \tn % Row Count 1 (+ 1) % Row 1 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{bt\}\}`{\emph{gdb\$}} info threads`} \tn % Row Count 2 (+ 1) % Row 2 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}List the threads of the target process.} \tn % Row Count 3 (+ 1) % Row 3 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} thread {\emph{threadID}}`} \tn % Row Count 4 (+ 1) % Row 4 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Attach GDB to the thread {\emph{threadID}}.} \tn % Row Count 5 (+ 1) % Row 5 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} set non-stop on`} \tn % Row Count 6 (+ 1) % Row 6 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Only the debugged thread is halted in GDB, the rest continue to run non-stop (unless they are blocking on the thread being debugged).} \tn % Row Count 9 (+ 3) % Row 7 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{nobreak\}\}`{\emph{gdb\$}} set scheduler-locking on`} \tn % Row Count 10 (+ 1) % Row 8 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Only the debugged thread will run when the debuggee is resumed.} \tn % Row Count 12 (+ 2) % Row 9 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} set scheduler-locking step`} \tn % Row Count 13 (+ 1) % Row 10 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Only the debugged thread will step when being step-debugged.} \tn % Row Count 15 (+ 2) % Row 11 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} show scheduler-locking`} \tn % Row Count 16 (+ 1) % Row 12 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Display the current setting value.} \tn % Row Count 17 (+ 1) % Row 13 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{} \tn % Row Count 17 (+ 0) % Row 14 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ac\}\}\{\{bt\}\}{\bf{Multiprocess Debugging}}} \tn % Row Count 18 (+ 1) % Row 15 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{bt\}\}`{\emph{gdb\$}} set follow-fork-mode child`} \tn % Row Count 19 (+ 1) % Row 16 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}GDB will detach at a fork() and attach to the new process.} \tn % Row Count 21 (+ 2) % Row 17 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} set follow-fork-mode parent`} \tn % Row Count 22 (+ 1) % Row 18 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}(Default) GDB will not detach at a fork().} \tn % Row Count 23 (+ 1) % Row 19 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} show follow-fork-mode`} \tn % Row Count 24 (+ 1) % Row 20 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Display the current setting value.} \tn % Row Count 25 (+ 1) % Row 21 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} set follow-exec-mode new`} \tn % Row Count 26 (+ 1) % Row 22 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}GDB will detach at an exec() and attach to the new process.} \tn % Row Count 28 (+ 2) % Row 23 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} set follow-exec-mode same`} \tn % Row Count 29 (+ 1) % Row 24 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}(Default) GDB will not detach at an exec().} \tn % Row Count 30 (+ 1) \end{tabularx} \par\addvspace{1.3em} \vfill \columnbreak \begin{tabularx}{5.377cm}{X} \SetRowColor{DarkBackground} \mymulticolumn{1}{x{5.377cm}}{\bf\textcolor{white}{GDB: Concurrency \{\{fa-navicon\}\} (cont)}} \tn % Row 25 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} show follow-exec-mode`} \tn % Row Count 1 (+ 1) % Row 26 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Display the current setting value.} \tn % Row Count 2 (+ 1) % Row 27 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} set detach-on-fork off`} \tn % Row Count 3 (+ 1) % Row 28 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}GDB will not detach at a fork() and will {\bf{also}} attach to the child process (both will be debugged).} \tn % Row Count 6 (+ 3) % Row 29 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} show detach-on-fork`} \tn % Row Count 7 (+ 1) % Row 30 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Display the current setting value.} \tn % Row Count 8 (+ 1) % Row 31 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} info inferiors`} \tn % Row Count 9 (+ 1) % Row 32 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}List all processes under GDB's control. (On Mac OS X: `info files`)} \tn % Row Count 11 (+ 2) \hhline{>{\arrayrulecolor{DarkBackground}}-} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{5.377cm}{X} \SetRowColor{DarkBackground} \mymulticolumn{1}{x{5.377cm}}{\bf\textcolor{white}{GDB: Memory \{\{fa-search\}\}}} \tn % Row 0 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ac\}\}{\bf{Memory Images}}} \tn % Row Count 1 (+ 1) % Row 1 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{bt\}\}`gdb {\emph{program}} -c {\emph{dumpfile}}`} \tn % Row Count 2 (+ 1) % Row 2 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Debug {\emph{program}} using a memory dump file, {\emph{imagefile}}.} \tn % Row Count 4 (+ 2) % Row 3 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{nobreak\}\}`{\emph{gdb\$}} generate-core-file`} \tn % Row Count 5 (+ 1) % Row 4 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}(not in Mac OS X) Dump the debuggee process memory to disk.} \tn % Row Count 7 (+ 2) % Row 5 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ac\}\}\{\{bt\}\}{\bf{Reading Disassembly and Memory}}} \tn % Row Count 8 (+ 1) % Row 6 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{bt\}\}`{\emph{gdb\$}} set disassembly-flavor intel`} \tn % Row Count 9 (+ 1) % Row 7 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Use the modern syntax for x86-64 assembly. This is not the default.} \tn % Row Count 11 (+ 2) % Row 8 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} set disassemble-next-line on`} \tn % Row Count 12 (+ 1) % Row 9 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Disassemble the next instruction every time GDB stops. You want to turn this on.} \tn % Row Count 14 (+ 2) % Row 10 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} x/4i 0x00001234`} \tn % Row Count 15 (+ 1) % Row 11 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Disassemble (eXamine) the first 4 instructions at address 0x00001234.} \tn % Row Count 17 (+ 2) % Row 12 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} x/32i \$rip`} \tn % Row Count 18 (+ 1) % Row 13 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Disassemble the first 32 instructions starting at the current instruction (\$RIP on x86-64).} \tn % Row Count 20 (+ 2) % Row 14 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} x/32i \$rip-16`} \tn % Row Count 21 (+ 1) % Row 15 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Same command, but attempting to disassemble both forward and backward from the current instruction.} \tn % Row Count 24 (+ 3) % Row 16 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} info address {\emph{symbolname}}`} \tn % Row Count 25 (+ 1) % Row 17 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Display the address in memory of a given symbol, specified by name.} \tn % Row Count 27 (+ 2) % Row 18 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} info symbol 0x00001234`} \tn % Row Count 28 (+ 1) % Row 19 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Displays the symbol name (if any), executable segment, and executable module associated with the given address.} \tn % Row Count 31 (+ 3) \end{tabularx} \par\addvspace{1.3em} \vfill \columnbreak \begin{tabularx}{5.377cm}{X} \SetRowColor{DarkBackground} \mymulticolumn{1}{x{5.377cm}}{\bf\textcolor{white}{GDB: Memory \{\{fa-search\}\} (cont)}} \tn % Row 20 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} x/1s 0x00001234`} \tn % Row Count 1 (+ 1) % Row 21 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Display one null-terminated string at address 0x00001234.} \tn % Row Count 3 (+ 2) % Row 22 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} x/8xb 0x00001234`} \tn % Row Count 4 (+ 1) % Row 23 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Display 8 heXadecimal Bytes of memory starting at address 0x00001234.} \tn % Row Count 6 (+ 2) % Row 24 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} info registers`} \tn % Row Count 7 (+ 1) % Row 25 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Display the value of the regular CPU registers.} \tn % Row Count 9 (+ 2) % Row 26 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} info all-registers`} \tn % Row Count 10 (+ 1) % Row 27 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Display the value of all CPU registers including floating-point and vector registers. Does not include special Machine Specific Registers (MSRs).} \tn % Row Count 14 (+ 4) % Row 28 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} find {\emph{start\_address}}, {\emph{distance}}, {\emph{value}} {[}, {\emph{another\_value}}, ...{]}`} \tn % Row Count 16 (+ 2) % Row 29 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}(not in Mac OS X) Search memory for a value, given a starting point and a search distance/offset.} \tn % Row Count 19 (+ 3) % Row 30 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} info shared`} \tn % Row Count 20 (+ 1) % Row 31 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Display info about all of the executable modules of the debuggee (name, load address, file path, etc.).} \tn % Row Count 23 (+ 3) % Row 32 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} info functions`} \tn % Row Count 24 (+ 1) % Row 33 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Display all of the function symbols available and their associated addresses.} \tn % Row Count 26 (+ 2) % Row 34 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} info variables`} \tn % Row Count 27 (+ 1) % Row 35 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\}Display all of the variable symbols available and their associated addresses.} \tn % Row Count 29 (+ 2) \hhline{>{\arrayrulecolor{DarkBackground}}-} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{5.377cm}{X} \SetRowColor{DarkBackground} \mymulticolumn{1}{x{5.377cm}}{\bf\textcolor{white}{GDB: Advanced \{\{fa-graduation-cap\}\}}} \tn % Row 0 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ac\}\}{\bf{Anti-Anti Debugging}}} \tn % Row Count 1 (+ 1) % Row 1 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{\{\{bt\}\}`{\emph{gdb\$}} handle {\emph{signal}} {\emph{{[}keywords...{]}}}`} \tn % Row Count 2 (+ 1) % Row 2 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\} (Untested) might bypass exception-based anti-debugging} \tn % Row Count 4 (+ 2) % Row 3 \SetRowColor{white} \mymulticolumn{1}{x{5.377cm}}{`{\emph{gdb\$}} catch syscall ptrace`} \tn % Row Count 5 (+ 1) % Row 4 \SetRowColor{LightBackground} \mymulticolumn{1}{x{5.377cm}}{\{\{ar\}\} (Untested) Use this breakpoint to return 0 (set \$rax = 0; continue), should bypass ptrace() checking by the debuggee.} \tn % Row Count 8 (+ 3) \hhline{>{\arrayrulecolor{DarkBackground}}-} \end{tabularx} \par\addvspace{1.3em} % That's all folks \end{multicols*} \end{document}