Gdb

GDB

GNU debugger enhanced with pwndbg or GEF — the primary dynamic analysis tool for ELF binaries.

Installation

# GDB
sudo apt-get install -y gdb

# pwndbg (recommended for RE/malware)
git clone https://github.com/pwndbg/pwndbg ~/pwndbg
cd ~/pwndbg && ./setup.sh

# OR GEF (lighter)
bash -c "$(curl -fsSL https://gef.blah.cat/sh)"

# OR portable pwndbg tarball (no git needed)
# Download from https://github.com/pwndbg/pwndbg/releases
tar -xf pwndbg_*.tar.xz
./pwndbg/bin/pwndbg ./binary

Quick Start

# Open binary
gdb -q ./binary

# With pwndbg:
pwndbg> start            # Run to main
pwndbg> disass main      # Disassemble main
pwndbg> info functions   # List all functions
pwndbg> context          # Show registers, code, stack, backtrace

Essential Commands

Navigation and Execution

Breakpoints

Inspection

Memory and Data

Breakpoint snapshot campaign

Use snapshots when exploitability depends on runtime frame layout, allocator history, or a library call's internal path.

1. Break at the exact call instruction, function entry, return instruction, and epilogue/pivot.
2. At each stop, record rip, general registers, bt, mappings, and bounded memory windows around rsp, rbp, inputs, outputs, and write targets.
3. Give each snapshot a stage and attempt ID; keep all stages from one PID together.
4. Compare the pre-call and post-return snapshots byte-for-byte.
5. Continue to the next consumer of the modified state. A correct write that is never consumed is not an exploitable chain.

Minimal command block:

set pagination off
set logging file snapshot.log
set logging overwrite off
set logging enabled on
printf "\n=== attempt-03 stage-trigger-pre ===\n"
info inferior
info registers
bt
info proc mappings
x/32gx $rsp
x/16gx $rbp-0x40
x/64bx <input-address>
x/64bx <target-address>

Use a watchpoint on the exact target after the first snapshot. Re-capture registers, backtrace, and both memory windows on every write. Snapshot the real final call site; a smaller test case may select a different algorithm or stack frame.

For allocator integrity failures, stop at the comparison that rejects the list instead of recording only malloc_printerr or SIGABRT. Dump the victim, fd, bk, bin sentinel, tcache entry, and normalized request size. Step backward through the last allocation/free transition to identify which automatic metadata write broke reciprocity.

When a clean-process trigger works but the full exploit fails, run the complete payload and break before every helper allocation introduced by the trigger. Compare arena and tcache state against the clean trigger; this is the composability gate.

Malware Analysis Workflows

Anti-debug bypass (ptrace)

# Most Linux malware uses ptrace(PTRACE_TRACEME) to detect debuggers
catch syscall ptrace
run
# When caught:
set $rax = 0           # Fake success
continue

Anti-debug bypass (/proc/self/status)

# Malware reads TracerPid from /proc/self/status
catch syscall openat
run
# When openat for /proc/self/status is caught, let it proceed
# and break on read to patch the result

Unpacking in memory

# Break when malware changes memory permissions (RWX = unpacked code)
catch syscall mprotect
run
# When hit: check arguments
x/s $rdi     # address
p/x $rsi     # length
p/x $rdx     # prot flags (7 = RWX)
# After mprotect returns, dump the unpacked region:
dump binary memory unpacked.bin $rdi ($rdi + $rsi)

Network activity tracing

break connect
break send
break recv
break sendto
break getaddrinfo
run
# On hit:
bt                     # See call chain
x/s $rdi              # Examine args

Full execution trace (pwndbg)

# Trace all calls with arguments
pwndbg> set logging on
pwndbg> break *entry_point
pwndbg> commands
> silent
> bt 1
> continue
> end
pwndbg> run

Python Scripting

# GDB Python API — run with: gdb -q -x script.py ./binary
import gdb

class MalwareTracer(gdb.Breakpoint):
    def __init__(self, func):
        super().__init__(func, gdb.BP_BREAKPOINT)
        self.func = func
        self.silent = True

    def stop(self):
        frame = gdb.selected_frame()
        rdi = int(frame.read_register("rdi"))
        rsi = int(frame.read_register("rsi"))
        print(f"[TRACE] {self.func}(rdi=0x{rdi:x}, rsi=0x{rsi:x})")
        return False  # Don't stop, just log

for f in ["connect", "send", "recv", "write", "execve", "mprotect"]:
    try:
        MalwareTracer(f)
    except Exception:
        pass

gdb.execute("run")

pwndbg-specific Commands

GEF-specific Commands

Resources