GDB with GEF / PEDA / pwndbg

GDB is the standard Linux debugger. CTF-focused plugins - GEF, PEDA, and pwndbg - add heap visualization, ROP gadget finding, pattern creation, and color-coded output.

GDB Plugin Comparison

Installation

bash -c "$(curl -fsSL https://gef.blah.cat/sh)"
# Or manually:
wget -O ~/.gdbinit-gef.py https://gef.blah.cat/py
echo "source ~/.gdbinit-gef.py" >> ~/.gdbinit

Exploit Workflow

gdb -q ./vuln
(gdb) checksec          # check protections
(gdb) info functions    # list functions
(gdb) disassemble main  # read main

(gdb) pattern create 200
# Send pattern as input → crash
(gdb) pattern search $rsp
# [+] Found at offset 72

(gdb) break *0x401234
(gdb) run
(gdb) x/20gx $rsp        # stack
(gdb) vmmap              # library addresses
(gdb) info proc mappings # libc base

# In pwntools:
p = gdb.debug('./vuln', gdbscript='''
break *0x401234
continue
''')

GDB Command Reference

Reading Library Addresses

# After breaking inside the binary:
info proc mappings          # show all mapped libraries
vmmap libc                  # libc range specifically

# Calculate function address from base:
python print(hex(0x7ffff7c00000 + 0x4f3d5))  # libc_base + offset

Checklist

• Install GEF: bash -c "$(curl -fsSL https://gef.blah.cat/sh)"
• checksec - check protections immediately
• pattern create + pattern search - find overflow offset
• vmmap - find library base addresses after ASLR
• heap chunks / heap bins - for heap challenges
• x/s address - view strings at pointers
• watch - detect when a value changes
• gdb.debug() in pwntools for combined debugging/exploiting

Last updated on Aug 1, 2025