GDB

Reverse Engineering

Intermediatelow risk

GDB is the GNU Project debugger. It allows you to see what is going on inside another program while it executes or what it was doing at the moment it crashed.

Installation

sudo apt install gdb

Basic Syntax

gdb [options] <binary>

Quick Facts

Full Name

GNU Debugger

License

GPL

Language

C/C++

Platforms

Linux, macOS, Windows (MinGW)

Category

Debugger

Created By

GNU Project

Tool Overview

GDB is the GNU Project debugger, the standard debugger for Linux systems. It allows you to see what is happening inside a program while it executes.

GDB supports breakpoint debugging, memory inspection, stack traces, and variable examination. It works with C, C++, Rust, Go, and many other languages.

GDB is essential for reverse engineering dynamic analysis. Plugins like PEDA and GEF enhance it with exploit development features and better visualizations.

Common Commands

gdb ./programLoad an executable into GDB for debugging

gdb --args ./program arg1 arg2Load a program together with its command-line arguments

gdb -p 1234Attach GDB to an already running process by PID

gdb ./program coreDebug a program using a saved core dump file

gdb -q ./programStart GDB quietly, suppressing the banner text

gdb -batch -ex run -ex bt ./programRun scripted commands non-interactively then exit

runStart execution of the loaded program (alias: r)

break mainSet a breakpoint at the function main (alias: b)

break file.c:42Set a breakpoint at a specific source file and line

continueResume execution until the next breakpoint (alias: c)

nextStep over the next source line without entering calls (alias: n)

stepStep into the next source line, entering function calls (alias: s)

stepiStep a single machine instruction (alias: si)

finishRun until the current function returns

backtracePrint the current call stack (alias: bt)

Step-by-Step Guide

1Attach the debugger to your target program
2Establish a stopping point at a key function
3Initiate execution
4Advance through the program one instruction at a time
5Inspect the contents of memory blocks and CPU registers
6Resume normal execution when analysis is complete

Warnings

Active debugging can cause the target application to behave unpredictably or crash
Plugins like PEDA or GEF are highly recommended for a better experience
Do not debug processes you do not own

Use Cases

Crash Analysis

Debug segmentation faults and crashes.

Malware Debugging

Analyze malware behavior at runtime.

Exploit Development

Develop and test exploits with PEDA/GEF.

Binary Analysis

Step through compiled code to understand logic.

Key Features

Breakpoints: Set breakpoints by function or address.
Memory Inspect: Examine memory and registers.
Remote Debug: Debug remote targets via gdbserver.
Scriptable: Python scripting support.
Plugins: GEF, PEDA, pwndbg enhancements.

Related Tools

Ghidra

Reverse Engineering

GUI reverse engineering framework.

Frequently Asked Questions

What is GDB used for?

GDB is used for debugging programs and binaries. It lets you inspect memory, set breakpoints, step through code, and analyze crashes.

Is GDB useful for reverse engineering?

Yes, GDB is essential for dynamic analysis in reverse engineering. It allows you to debug malware and analyze binary behavior at runtime.

What are GDB plugins?

Plugins like PEDA, GEF, and pwndbg enhance GDB with better interfaces, exploit development tools, and visual memory layouts.

Can GDB debug remote targets?

Yes, GDB supports remote debugging via gdbserver for debugging programs on other machines or embedded devices.

Output Explanation

The console displays the live state of the program, including memory addresses, register values, and the current assembly instruction being processed.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.