gef v2024.01 released: Multi-Architecture GDB Enhanced Features for Exploiters & Reverse-Engineers

by do son · Published April 8, 2019 · Updated January 14, 2024

GEF – GDB Enhanced Features

GEF is a kick-ass set of commands for X86, ARM, MIPS, PowerPC and SPARC to make GDB cool again for exploit dev. It is aimed to be used mostly by exploiters and reverse-engineers, to provide additional features to GDB using the Python API to assist during the process of dynamic analysis and exploit development.

It has full support for both Python2 and Python3 indifferently (as more and more distros start pushing gdb compiled with Python3 support).

Feature

One single GDB script.
Entirely OS Agnostic, NO dependencies: GEF is battery-included and is installable in 2 seconds (unlike PwnDBG).
Fast limiting the number of dependencies and optimizing code to make the commands as fast as possible (unlike PwnDBG).
Provides more than 50 commands to drastically change your experience in GDB.
Easily extendable to create other commands by providing more comprehensible layout to GDB Python API.
Works consistently on both Python2 and Python3.
Built around an architecture abstraction layer, so all commands work in any GDB-supported architecture such as x86-32/64, ARMv5/6/7, AARCH64, SPARC, MIPS, PowerPC, etc. (unlike PEDA)
Suited for real-life apps debugging, exploit development, just as much as CTF (unlike PEDA or PwnDBG)

Changelog v2024.01

install curl coverage.yml by @therealdreg in #997
gef-remote: Fix issue with remote path having a space by @Grazfather in #998
Tiny cleanup by @Grazfather in #994
Let GefSetting write hooks see value by @Grazfather in #1000
Fix gdb.execute not quoting paths by @Grazfather in #999
Do not quote paths when running ‘source’ by @Grazfather in #1005
show basename in source: split line by @bartman in #1017
[Installers] Use latest tag, not main by @hugsy in #1007
Reorder reset_arch: param forced, elf header, gdb conf by @josx in #1004
Run validate CI step with Python 3.11 by @Grazfather in #1022
[target-remote] Basic support for the target remote command by @ValekoZ in #1020
Coverage workflow should only be triggered by pull_request by @hugsy in #1023
Dump memory usage when listing arenas, and add summary option in heap chunks command. by @r12f in #1024
Memory map provider by @Grazfather in #1003
Fix clear-screen timing when showing context by @r12f in #1026
Add min-size and max-size filter to heap chunks command by @r12f in #1025
Add c++ symbol support in xinfo. by @r12f in #1028
Add config to override libc version. by @r12f in #1027
Add option to resolve type when dumping heap summary. by @r12f in #1030
Rename _target to debug_target for building test cases. by @r12f in #1031
gef.sh: Fix which: command not found by @osalbahr in #1032
[docs] document conditional context panes by @Ordoviz in #1035
support 64 bit retval for stub by @Angelo942 in #1034
Add count option in heap chunks command to limit the number of chunks to process / output. by @r12f in #1029
correct parsing in gdb_get_location_from_symbol by @Angelo942 in #1037
Migrate tests to RPyC by @hugsy in #1040
Remove old context_times script + tuneup by @Grazfather in #1042
Update rpyc example in docs/testing.md by @hugsy in #1041

Installation

# via the install script
$ wget -q -O- https://github.com/hugsy/gef/raw/master/gef.sh | sh

Then just start playing (for local files):

$ gdb -q /path/to/my/bin
gef➤  gef help
Or (for remote debugging):

remote:~ $ gdbserver 0.0.0.0:1234 /path/to/file
Running as PID: 666
And:

local:~ $ gdb -q
gef➤  gef-remote -t your.ip.address:1234 -p 666

# manually
$ wget -O ~/.gdbinit-gef.py -q https://github.com/hugsy/gef/raw/master/gef.py
$ echo source ~/.gdbinit-gef.py >> ~/.gdbinit