mirror of
https://github.com/hugsy/gef.git
synced 2026-10-11 21:49:56 +00:00
[Docs] Use only absolute URLs to githubusercontent instead
This commit is contained in:
hugsy
@@ -10,4 +10,4 @@ The command `canary` does not take any arguments.
|
||||
gef➤ canary
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -10,7 +10,7 @@ To view all settings for all commands loaded:
|
||||
gef➤ gef config
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
Or to get one setting value:
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
## Command `context`
|
||||
|
||||
|
||||
|
||||
|
||||
`gef` (not unlike `PEDA` or `fG! famous gdbinit`) provides comprehensive context menu when hitting a
|
||||
breakpoint.
|
||||
@@ -123,7 +123,7 @@ gef➤ gef config context.redirect /dev/pts/0
|
||||
```
|
||||
|
||||
Enjoy:
|
||||
|
||||
|
||||
|
||||
To go back to normal, remove the value:
|
||||
|
||||
|
||||
@@ -20,4 +20,4 @@ instruction), but we want to have the Carry flag set, simply go with:
|
||||
gef➤ flags -ZERO +CARRY
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -12,4 +12,4 @@ It will perform the following actions:
|
||||
header, set a breakpoint and run. This case should never fail if the ELF binary has a valid
|
||||
structure.
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -28,4 +28,4 @@ gef➤ r
|
||||
If a potentially insecure entry is found, the breakpoint will trigger, stop the process execution,
|
||||
display the reason for trigger and the associated context.
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -38,7 +38,7 @@ Process /tmp/default.out created; pid = 258932
|
||||
Listening on port 1234
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
On the client, when the original `gdb` would use `target remote`, GEF's syntax is roughly similar
|
||||
(shown running in debug mode for more verbose output, but you don't have to):
|
||||
@@ -75,12 +75,12 @@ Reading /lib64/ld-linux-x86-64.so.2 from remote target...
|
||||
|
||||
And finally breaking into the program, showing the current context:
|
||||
|
||||
|
||||
|
||||
|
||||
You will also notice the prompt has changed to indicate the debugging mode is now "remote". Besides
|
||||
that, all of GEF features are available:
|
||||
|
||||
|
||||
|
||||
|
||||
#### `remote-extended`
|
||||
|
||||
|
||||
@@ -11,7 +11,7 @@ gef➤ got [--all] [filters]
|
||||
|
||||
`--all` Print the GOT for all shared objects in addition to the executable file
|
||||
|
||||
|
||||
|
||||
|
||||
The applied filter partially matches the name of the functions, so you can do something like this.
|
||||
|
||||
@@ -21,7 +21,7 @@ gef➤ got print
|
||||
gef➤ got read
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
Example of multiple partial filters:
|
||||
|
||||
@@ -29,7 +29,7 @@ Example of multiple partial filters:
|
||||
gef➤ got str get
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
```text
|
||||
gef➤ got --all str get
|
||||
|
||||
@@ -33,12 +33,12 @@ The following settings are accepted:
|
||||
- `check_null_free`: to break execution when a free(NULL) is encountered (disabled by default);
|
||||
- `check_double_free`: to break execution when a double free is encountered;
|
||||
|
||||
|
||||
|
||||
|
||||
- `check_weird_free`: to execution when `free()` is called against a non-tracked pointer;
|
||||
- `check_uaf`: to break execution when a possible Use-after-Free condition is found.
|
||||
|
||||
|
||||
|
||||
|
||||
Just like the format string vulnerability helper, the `heap-analysis-helper` can fail to detect
|
||||
complex heap scenarios and/or provide some false positive alerts. Each finding must of course be
|
||||
@@ -57,7 +57,7 @@ gef➤ gef config heap-analysis-helper.check_uaf False
|
||||
Then `gef` will not notify you of any inconsistency detected, but simply display a clear message
|
||||
when a chunk is allocated/freed.
|
||||
|
||||
|
||||
|
||||
|
||||
To get information regarding the currently tracked chunks, use the `show` subcommand:
|
||||
|
||||
@@ -65,4 +65,4 @@ To get information regarding the currently tracked chunks, use the `show` subcom
|
||||
gef➤ heap-analysis-helper show
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -46,7 +46,7 @@ Displays all the chunks from the `heap` section of the current arena.
|
||||
gef➤ heap chunks
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
To select from which arena to display chunks either use the `heap set-arena` command or provide the
|
||||
base address of the other arena like this:
|
||||
@@ -55,7 +55,7 @@ base address of the other arena like this:
|
||||
gef➤ heap chunks [arena_address]
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
In order to display the chunks of all the available arenas at once use
|
||||
|
||||
@@ -63,7 +63,7 @@ In order to display the chunks of all the available arenas at once use
|
||||
gef➤ heap chunks -a
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
Because usually the heap chunks are aligned to a certain number of bytes in memory GEF automatically
|
||||
re-aligns the chunks data start addresses to match Glibc's behavior. To be able to view unaligned
|
||||
@@ -76,7 +76,7 @@ To get a higher level overview of the chunks you can use the `--summary` flag to
|
||||
gef➤ heap chunks --summary
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
Sometimes, multiple types of objects could have the same size, hence it might not be enough only
|
||||
knowing the chunk size when debugging issues like memory leaks. GEF supports using the vtable to
|
||||
@@ -87,7 +87,7 @@ with the `--summary` flag.
|
||||
gef➤ heap chunks --summary --resolve
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
Heap chunk command also supports filtering chunks by their size. To do so, simply provide the
|
||||
`--min-size` or `--max-size` argument:
|
||||
@@ -96,7 +96,7 @@ Heap chunk command also supports filtering chunks by their size. To do so, simpl
|
||||
gef➤ heap chunks --min-size 16 --max-size 32
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
The range is inclusive, so the above command will display all chunks with size >=16 and <=32.
|
||||
|
||||
@@ -107,7 +107,7 @@ of the chunks in the output:
|
||||
gef➤ heap chunks --count 1
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
### `heap chunk` command
|
||||
|
||||
@@ -118,7 +118,7 @@ the user memory pointer of the chunk to show the information related to a specif
|
||||
gef➤ heap chunk [address]
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
Because usually the heap chunks are aligned to a certain number of bytes in memory GEF automatically
|
||||
re-aligns the chunks data start addresses to match Glibc's behavior. To be able to view unaligned
|
||||
@@ -145,7 +145,7 @@ Multi-threaded programs have different arenas, and the knowledge of the `main_ar
|
||||
`gef` therefore provides the `arena` sub-commands to help you list all the arenas allocated in your
|
||||
program **at the moment you call the command**.
|
||||
|
||||
|
||||
|
||||
|
||||
### `heap set-arena` command
|
||||
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
As long as the 'memory' section is enabled in your context layout (which it is by default), you can
|
||||
register addresses, lengths, and grouping size.
|
||||
|
||||
|
||||
|
||||
|
||||
_Note_: this command **should NOT** be mistaken with the [GDB `watch`
|
||||
command](https://sourceware.org/gdb/current/onlinedocs/gdb/Set-Watchpoints.html) meant to set
|
||||
@@ -38,7 +38,7 @@ gef ➤ memory watch $_got()+0x18 5
|
||||
|
||||
Which, when the `context` is displayed, will show something like:
|
||||
|
||||
|
||||
|
||||
|
||||
### Removing a watch
|
||||
|
||||
|
||||
@@ -110,7 +110,7 @@ gef➤ dt person_t
|
||||
By providing an address or a GDB symbol, `gef` will apply this user-defined structure to the
|
||||
specified address:
|
||||
|
||||
|
||||
|
||||
|
||||
This means that we can now create very easily new user-defined structures
|
||||
|
||||
@@ -120,7 +120,7 @@ For a full demo, watch the following tutorial:
|
||||
|
||||
Additionally, if you have successfully configured your IDA settings, you can also directly import
|
||||
the structure(s) that was(were) reverse-engineered in IDA directly in your GDB session:
|
||||
 - (see `gef-extras/ida-rpyc`,
|
||||
 - (see `gef-extras/ida-rpyc`,
|
||||
which is the new improved version of `ida-interact`)
|
||||
|
||||
#### Dynamic `ctypes.Structure`-like classes
|
||||
|
||||
@@ -29,4 +29,4 @@ gef➤ scan stack libc
|
||||
To check mappings without a path associated, an address range (start-end) can be used. Note that
|
||||
ranges don't include whitespaces.
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -7,7 +7,7 @@ memory layout. The command `search-pattern`, alias `grep`, aims to be straight-f
|
||||
gef➤ search-pattern MyPattern
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
It will provide an easily understandable to spot occurrences of the specified pattern, including the
|
||||
section it/they was/were found, and the permission associated to that section.
|
||||
@@ -19,7 +19,7 @@ starts with `0x` and is a valid hex address. For example:
|
||||
gef➤ search-pattern 0x4005f6
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
The `search-pattern` command can also be used as a way to search for cross-references to an address.
|
||||
For this reason, the alias `xref` also points to the command `search-pattern`. Therefore the
|
||||
|
||||
@@ -23,8 +23,8 @@ Patching `fork()` calls:
|
||||
|
||||
* Without stub:
|
||||
|
||||
|
||||
|
||||
|
||||
* With stub:
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -10,7 +10,7 @@ Those commands will check whether GDB is being spawn from inside a `tmux` (resp.
|
||||
and if so, will split the pane vertically, and configure the context to be redirected to the new
|
||||
pane, looking something like:
|
||||
|
||||
|
||||
|
||||
|
||||
To set it up, simply enter
|
||||
|
||||
|
||||
@@ -11,9 +11,9 @@ until the value provided as argument.
|
||||
gef> trace-run <address_of_last_instruction_to_trace>
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
By using the script `ida_color_gdb_trace.py` on the text file generated, it will color the path
|
||||
taken:
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
`vmmap` displays the target process's entire memory space mapping.
|
||||
|
||||
|
||||
|
||||
|
||||
Interestingly, it helps finding secret gems: as an aware reader might have seen, memory mapping
|
||||
differs from one architecture to another (this is one of the main reasons I started `GEF` in a first
|
||||
|
||||
@@ -4,4 +4,4 @@
|
||||
filter by pattern given in argument. For example, if you only want to show the code sections (i.e.
|
||||
`.text`):
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
`xinfo` displays all the information known to `gef` about the specific address given as argument:
|
||||
|
||||
|
||||
|
||||
|
||||
**Important note** : For performance reasons, `gef` caches certain results. `gef` will try to
|
||||
automatically refresh its own cache to avoid relying on obsolete information of the debugged
|
||||
|
||||
+1
-1
@@ -19,7 +19,7 @@ Once in GEF, the configuration settings can be set/unset/modified by the
|
||||
[command `gef config`](/docs/commands/config.md). Without argument the command
|
||||
will simply dump all known settings:
|
||||
|
||||
|
||||
|
||||
|
||||
To update, follow the syntax
|
||||
|
||||
|
||||
+3
-3
@@ -87,7 +87,7 @@ Some interesting plugins highly recommended too:
|
||||
- [!exploitable](https://github.com/jfoote/exploitable/)
|
||||
- [Voltron](https://github.com/snare/voltron)
|
||||
|
||||
|
||||
|
||||
Src: [@rick2600: terminator + gdb + gef + voltron cc: @snare @_hugsy_](https://twitter.com/rick2600/status/775926070566490113)
|
||||
|
||||
## I want to contribute, where should I head first?
|
||||
@@ -107,7 +107,7 @@ unexpected behavior.
|
||||
In most locations, Python exceptions will be properly intercepted. If not, `gef` wraps all commands
|
||||
with a generic exception handler, to disturb as little as possible your debugging session. If it
|
||||
happens, you'll only get to see a message like this:
|
||||
|
||||
|
||||
|
||||
By switching to debug mode, `gef` will give much more information:
|
||||
|
||||
@@ -115,7 +115,7 @@ By switching to debug mode, `gef` will give much more information:
|
||||
gef➤ gef config gef.debug 1
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
If you think fixing it is in your skills, then send a [Pull
|
||||
Request](https://github.com/hugsy/gef/pulls) with your patched version, explaining your bug, and
|
||||
|
||||
+1
-1
@@ -10,7 +10,7 @@ process of dynamic analysis and exploit development.
|
||||
It requires Python 3, but [`gef-legacy`](https://github.com/hugsy/gef-legacy) can be used if Python
|
||||
2 support is needed.
|
||||
|
||||
|
||||
|
||||
|
||||
## GDB Made Easy
|
||||
|
||||
|
||||
@@ -5,4 +5,4 @@
|
||||
|
||||
---
|
||||
|
||||
|
||||
|
||||
|
||||
+11
-11
@@ -25,51 +25,51 @@ Currently `GEF` supports the following architectures:
|
||||
To this day, GDB doesn't come with a hexdump-like view. Well `GEF` fixes that for you via the
|
||||
`hexdump` command:
|
||||
|
||||
|
||||
|
||||
|
||||
### Dereferencing data or registers
|
||||
|
||||
No more endless manual pointer dereferencing `x/x` style. Just use `dereference` for that. Or for a
|
||||
comprehensive view of the registers, `registers` might become your best friend:
|
||||
|
||||
|
||||
|
||||
|
||||
### Heap analysis
|
||||
|
||||
#### Detailed view of Glibc Chunks
|
||||
|
||||
|
||||
|
||||
|
||||
#### Automatic detection of UaF during runtime
|
||||
|
||||
|
||||
|
||||
|
||||
### Display ELF information
|
||||
|
||||
#### ELF structure
|
||||
|
||||
|
||||
|
||||
|
||||
#### Security settings
|
||||
|
||||
|
||||
|
||||
|
||||
### Automatic vulnerable string detection
|
||||
|
||||
|
||||
|
||||
|
||||
### Code emulation with Unicorn-Engine (x86-64)
|
||||
|
||||
|
||||
|
||||
|
||||
### Comprehensive address space layout display
|
||||
|
||||
|
||||
|
||||
|
||||
### Defining arbitrary custom structures
|
||||
|
||||
|
||||
|
||||
|
||||
### Highlight custom strings
|
||||
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user