mirror of
https://github.com/hugsy/gef.git
synced 2026-10-11 21:49:56 +00:00
[Docs] Move imgur images to local docs folder (#1210)
## Description Imgur is blocked in UK since September 2025 (see #1200) Move imgur hosted images to local folder instead. Fixes #1200
This commit is contained in:
crazy hugsy
@@ -1,2 +1,8 @@
|
||||
# https://help.github.com/articles/dealing-with-line-endings/
|
||||
* text eol=lf
|
||||
*.png diff=none binary
|
||||
*.jpg diff=none binary
|
||||
*.jpeg diff=none binary
|
||||
*.gif diff=none binary
|
||||
*.svg diff=none binary
|
||||
*.webp diff=none binary
|
||||
|
||||
@@ -17,7 +17,7 @@ jobs:
|
||||
runs-on: ubuntu-24.04
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
uses: actions/checkout@v6.0.1
|
||||
- name: Setup
|
||||
run: |
|
||||
export NEEDRESTART_MODE=n
|
||||
@@ -44,7 +44,7 @@ jobs:
|
||||
echo "score_diff=${score_diff}" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Post results
|
||||
uses: actions/github-script@v7
|
||||
uses: actions/github-script@v8.0.0
|
||||
with:
|
||||
script: |
|
||||
const old_score = ${{ steps.get_coverage.outputs.current_score }};
|
||||
|
||||
@@ -18,6 +18,6 @@ jobs:
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@v6.0.1
|
||||
- run: |
|
||||
docker run -v ${PWD}:/gef ${{ matrix.variants.os }}:${{ matrix.variants.version }} "bash /gef/tests/extended/${{ matrix.variants.os }}.sh"
|
||||
|
||||
@@ -13,7 +13,7 @@ jobs:
|
||||
runs-on: ubuntu-latest
|
||||
if: github.event.repository.fork == false
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- uses: actions/checkout@v6.0.1
|
||||
with:
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
- name: Install pre-requisite
|
||||
|
||||
@@ -23,7 +23,7 @@ jobs:
|
||||
discord:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- uses: actions/checkout@v6.0.1
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
|
||||
@@ -32,7 +32,7 @@ jobs:
|
||||
shell: bash
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@v6.0.1
|
||||
|
||||
- name: Install python and toolchain
|
||||
run: |
|
||||
|
||||
@@ -10,10 +10,10 @@ jobs:
|
||||
name: Check formatting
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- uses: actions/setup-python@v5.1.0
|
||||
- uses: actions/checkout@v6.0.1
|
||||
- uses: actions/setup-python@v6.2.0
|
||||
with:
|
||||
python-version: "3.8"
|
||||
python-version: "3.10"
|
||||
- uses: pre-commit/[email protected]
|
||||
|
||||
docs_link_check:
|
||||
@@ -23,11 +23,25 @@ jobs:
|
||||
contents: read
|
||||
steps:
|
||||
- name: checkout
|
||||
uses: actions/checkout@v4.1.6
|
||||
uses: actions/checkout@v6.0.1
|
||||
- name: Restore lychee cache
|
||||
id: restore-cache
|
||||
uses: actions/cache/restore@v4
|
||||
with:
|
||||
path: .lycheecache
|
||||
key: cache-lychee-${{ github.sha }}
|
||||
restore-keys: cache-lychee-
|
||||
- name: Check links
|
||||
uses: lycheeverse/lychee-action@v2.0.2
|
||||
uses: lycheeverse/lychee-action@v2.7.0
|
||||
env:
|
||||
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
|
||||
with:
|
||||
args: --exclude-mail --accept=401 --no-progress --exclude 'https://cs.github.com/hugsy/gef\?q=.*' 'docs/**/*.md'
|
||||
args: --exclude-mail --accept=401 --no-progress --exclude 'https://cs.github.com/hugsy/gef\?q=.*' '**/*.md'
|
||||
fail: false
|
||||
workingDirectory: docs/
|
||||
- name: Save lychee cache
|
||||
uses: actions/cache/save@v4
|
||||
if: always()
|
||||
with:
|
||||
path: .lycheecache
|
||||
key: ${{ steps.restore-cache.outputs.cache-primary-key }}
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
<p align="center">
|
||||
<img src="https://i.imgur.com/o0L8lPN.png" alt="logo"/>
|
||||
<img src="assets/images/logo.png" alt="logo"/>
|
||||
</p>
|
||||
|
||||
<p align="center">
|
||||
@@ -39,7 +39,7 @@ $ gdb -q
|
||||
|
||||
You can immediately see that GEF is correctly installed by launching GDB:
|
||||
|
||||
|
||||
|
||||
|
||||
A few of `GEF` features include:
|
||||
|
||||
@@ -73,8 +73,8 @@ try to reach out for help on the Discord channel or submit an issue.
|
||||
|
||||
## Current status
|
||||
|
||||
| Documentation |License | Compatibility | CI Tests (`main`) |
|
||||
|:---:|:---:|:---|--|
|
||||
| Documentation | License | Compatibility | CI Tests (`main`) |
|
||||
| :--------------------------------------------------------------------------------------------------------------------------------------------------------------: | :----------------------------------------------------------------------------------------------------------------------------------------: | :-------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| [](https://github.com/hugsy/gef/actions/workflows/generate-docs.yml) | [](https://github.com/hugsy/gef/blob/main/LICENSE) | [](https://github.com/hugsy/gef/) | [](https://github.com/hugsy/gef/actions/workflows/tests.yml) |
|
||||
|
||||
## Contribute
|
||||
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
After Width: | Height: | Size: 129 KiB |
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -10,4 +10,4 @@ The command `canary` does not take any arguments.
|
||||
gef➤ canary
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -10,7 +10,7 @@ To view all settings for all commands loaded:
|
||||
gef➤ gef config
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
Or to get one setting value:
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
## Command `context`
|
||||
|
||||
|
||||
|
||||
|
||||
`gef` (not unlike `PEDA` or `fG! famous gdbinit`) provides comprehensive context menu when hitting a
|
||||
breakpoint.
|
||||
@@ -123,7 +123,7 @@ gef➤ gef config context.redirect /dev/pts/0
|
||||
```
|
||||
|
||||
Enjoy:
|
||||
|
||||
|
||||
|
||||
To go back to normal, remove the value:
|
||||
|
||||
|
||||
@@ -20,4 +20,4 @@ instruction), but we want to have the Carry flag set, simply go with:
|
||||
gef➤ flags -ZERO +CARRY
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -12,4 +12,4 @@ It will perform the following actions:
|
||||
header, set a breakpoint and run. This case should never fail if the ELF binary has a valid
|
||||
structure.
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -28,4 +28,4 @@ gef➤ r
|
||||
If a potentially insecure entry is found, the breakpoint will trigger, stop the process execution,
|
||||
display the reason for trigger and the associated context.
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -38,7 +38,7 @@ Process /tmp/default.out created; pid = 258932
|
||||
Listening on port 1234
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
On the client, when the original `gdb` would use `target remote`, GEF's syntax is roughly similar
|
||||
(shown running in debug mode for more verbose output, but you don't have to):
|
||||
@@ -75,12 +75,12 @@ Reading /lib64/ld-linux-x86-64.so.2 from remote target...
|
||||
|
||||
And finally breaking into the program, showing the current context:
|
||||
|
||||
|
||||
|
||||
|
||||
You will also notice the prompt has changed to indicate the debugging mode is now "remote". Besides
|
||||
that, all of GEF features are available:
|
||||
|
||||
|
||||
|
||||
|
||||
#### `remote-extended`
|
||||
|
||||
|
||||
@@ -11,7 +11,7 @@ gef➤ got [--all] [filters]
|
||||
|
||||
`--all` Print the GOT for all shared objects in addition to the executable file
|
||||
|
||||
|
||||
|
||||
|
||||
The applied filter partially matches the name of the functions, so you can do something like this.
|
||||
|
||||
@@ -21,7 +21,7 @@ gef➤ got print
|
||||
gef➤ got read
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
Example of multiple partial filters:
|
||||
|
||||
@@ -29,7 +29,7 @@ Example of multiple partial filters:
|
||||
gef➤ got str get
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
```text
|
||||
gef➤ got --all str get
|
||||
|
||||
@@ -33,12 +33,12 @@ The following settings are accepted:
|
||||
- `check_null_free`: to break execution when a free(NULL) is encountered (disabled by default);
|
||||
- `check_double_free`: to break execution when a double free is encountered;
|
||||
|
||||
|
||||
|
||||
|
||||
- `check_weird_free`: to execution when `free()` is called against a non-tracked pointer;
|
||||
- `check_uaf`: to break execution when a possible Use-after-Free condition is found.
|
||||
|
||||
|
||||
|
||||
|
||||
Just like the format string vulnerability helper, the `heap-analysis-helper` can fail to detect
|
||||
complex heap scenarios and/or provide some false positive alerts. Each finding must of course be
|
||||
@@ -57,7 +57,7 @@ gef➤ gef config heap-analysis-helper.check_uaf False
|
||||
Then `gef` will not notify you of any inconsistency detected, but simply display a clear message
|
||||
when a chunk is allocated/freed.
|
||||
|
||||
|
||||
|
||||
|
||||
To get information regarding the currently tracked chunks, use the `show` subcommand:
|
||||
|
||||
@@ -65,4 +65,4 @@ To get information regarding the currently tracked chunks, use the `show` subcom
|
||||
gef➤ heap-analysis-helper show
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -46,7 +46,7 @@ Displays all the chunks from the `heap` section of the current arena.
|
||||
gef➤ heap chunks
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
To select from which arena to display chunks either use the `heap set-arena` command or provide the
|
||||
base address of the other arena like this:
|
||||
@@ -55,7 +55,7 @@ base address of the other arena like this:
|
||||
gef➤ heap chunks [arena_address]
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
In order to display the chunks of all the available arenas at once use
|
||||
|
||||
@@ -63,7 +63,7 @@ In order to display the chunks of all the available arenas at once use
|
||||
gef➤ heap chunks -a
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
Because usually the heap chunks are aligned to a certain number of bytes in memory GEF automatically
|
||||
re-aligns the chunks data start addresses to match Glibc's behavior. To be able to view unaligned
|
||||
@@ -76,7 +76,7 @@ To get a higher level overview of the chunks you can use the `--summary` flag to
|
||||
gef➤ heap chunks --summary
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
Sometimes, multiple types of objects could have the same size, hence it might not be enough only
|
||||
knowing the chunk size when debugging issues like memory leaks. GEF supports using the vtable to
|
||||
@@ -87,7 +87,7 @@ with the `--summary` flag.
|
||||
gef➤ heap chunks --summary --resolve
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
Heap chunk command also supports filtering chunks by their size. To do so, simply provide the
|
||||
`--min-size` or `--max-size` argument:
|
||||
@@ -96,7 +96,7 @@ Heap chunk command also supports filtering chunks by their size. To do so, simpl
|
||||
gef➤ heap chunks --min-size 16 --max-size 32
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
The range is inclusive, so the above command will display all chunks with size >=16 and <=32.
|
||||
|
||||
@@ -107,7 +107,7 @@ of the chunks in the output:
|
||||
gef➤ heap chunks --count 1
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
### `heap chunk` command
|
||||
|
||||
@@ -118,7 +118,7 @@ the user memory pointer of the chunk to show the information related to a specif
|
||||
gef➤ heap chunk [address]
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
Because usually the heap chunks are aligned to a certain number of bytes in memory GEF automatically
|
||||
re-aligns the chunks data start addresses to match Glibc's behavior. To be able to view unaligned
|
||||
@@ -145,7 +145,7 @@ Multi-threaded programs have different arenas, and the knowledge of the `main_ar
|
||||
`gef` therefore provides the `arena` sub-commands to help you list all the arenas allocated in your
|
||||
program **at the moment you call the command**.
|
||||
|
||||
|
||||
|
||||
|
||||
### `heap set-arena` command
|
||||
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
As long as the 'memory' section is enabled in your context layout (which it is by default), you can
|
||||
register addresses, lengths, and grouping size.
|
||||
|
||||
|
||||
|
||||
|
||||
_Note_: this command **should NOT** be mistaken with the [GDB `watch`
|
||||
command](https://sourceware.org/gdb/current/onlinedocs/gdb/Set-Watchpoints.html) meant to set
|
||||
@@ -38,7 +38,7 @@ gef ➤ memory watch $_got()+0x18 5
|
||||
|
||||
Which, when the `context` is displayed, will show something like:
|
||||
|
||||
|
||||
|
||||
|
||||
### Removing a watch
|
||||
|
||||
|
||||
@@ -110,7 +110,7 @@ gef➤ dt person_t
|
||||
By providing an address or a GDB symbol, `gef` will apply this user-defined structure to the
|
||||
specified address:
|
||||
|
||||
|
||||
|
||||
|
||||
This means that we can now create very easily new user-defined structures
|
||||
|
||||
@@ -120,8 +120,8 @@ For a full demo, watch the following tutorial:
|
||||
|
||||
Additionally, if you have successfully configured your IDA settings, you can also directly import
|
||||
the structure(s) that was(were) reverse-engineered in IDA directly in your GDB session:
|
||||
 - (see `gef-extras/ida-rpyc`, which is
|
||||
the new improved version of `ida-interact`)
|
||||
 - (see `gef-extras/ida-rpyc`,
|
||||
which is the new improved version of `ida-interact`)
|
||||
|
||||
#### Dynamic `ctypes.Structure`-like classes
|
||||
|
||||
|
||||
@@ -29,4 +29,4 @@ gef➤ scan stack libc
|
||||
To check mappings without a path associated, an address range (start-end) can be used. Note that
|
||||
ranges don't include whitespaces.
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -7,7 +7,7 @@ memory layout. The command `search-pattern`, alias `grep`, aims to be straight-f
|
||||
gef➤ search-pattern MyPattern
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
It will provide an easily understandable to spot occurrences of the specified pattern, including the
|
||||
section it/they was/were found, and the permission associated to that section.
|
||||
@@ -19,7 +19,7 @@ starts with `0x` and is a valid hex address. For example:
|
||||
gef➤ search-pattern 0x4005f6
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
The `search-pattern` command can also be used as a way to search for cross-references to an address.
|
||||
For this reason, the alias `xref` also points to the command `search-pattern`. Therefore the
|
||||
|
||||
@@ -23,8 +23,8 @@ Patching `fork()` calls:
|
||||
|
||||
* Without stub:
|
||||
|
||||
|
||||
|
||||
|
||||
* With stub:
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -10,7 +10,7 @@ Those commands will check whether GDB is being spawn from inside a `tmux` (resp.
|
||||
and if so, will split the pane vertically, and configure the context to be redirected to the new
|
||||
pane, looking something like:
|
||||
|
||||
|
||||
|
||||
|
||||
To set it up, simply enter
|
||||
|
||||
|
||||
@@ -11,9 +11,9 @@ until the value provided as argument.
|
||||
gef> trace-run <address_of_last_instruction_to_trace>
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
By using the script `ida_color_gdb_trace.py` on the text file generated, it will color the path
|
||||
taken:
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
`vmmap` displays the target process's entire memory space mapping.
|
||||
|
||||
|
||||
|
||||
|
||||
Interestingly, it helps finding secret gems: as an aware reader might have seen, memory mapping
|
||||
differs from one architecture to another (this is one of the main reasons I started `GEF` in a first
|
||||
|
||||
@@ -4,4 +4,4 @@
|
||||
filter by pattern given in argument. For example, if you only want to show the code sections (i.e.
|
||||
`.text`):
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
`xinfo` displays all the information known to `gef` about the specific address given as argument:
|
||||
|
||||
|
||||
|
||||
|
||||
**Important note** : For performance reasons, `gef` caches certain results. `gef` will try to
|
||||
automatically refresh its own cache to avoid relying on obsolete information of the debugged
|
||||
|
||||
+1
-1
@@ -19,7 +19,7 @@ Once in GEF, the configuration settings can be set/unset/modified by the
|
||||
[command `gef config`](/docs/commands/config.md). Without argument the command
|
||||
will simply dump all known settings:
|
||||
|
||||
|
||||
|
||||
|
||||
To update, follow the syntax
|
||||
|
||||
|
||||
+3
-3
@@ -87,7 +87,7 @@ Some interesting plugins highly recommended too:
|
||||
- [!exploitable](https://github.com/jfoote/exploitable/)
|
||||
- [Voltron](https://github.com/snare/voltron)
|
||||
|
||||
|
||||
|
||||
Src: [@rick2600: terminator + gdb + gef + voltron cc: @snare @_hugsy_](https://twitter.com/rick2600/status/775926070566490113)
|
||||
|
||||
## I want to contribute, where should I head first?
|
||||
@@ -107,7 +107,7 @@ unexpected behavior.
|
||||
In most locations, Python exceptions will be properly intercepted. If not, `gef` wraps all commands
|
||||
with a generic exception handler, to disturb as little as possible your debugging session. If it
|
||||
happens, you'll only get to see a message like this:
|
||||
|
||||
|
||||
|
||||
By switching to debug mode, `gef` will give much more information:
|
||||
|
||||
@@ -115,7 +115,7 @@ By switching to debug mode, `gef` will give much more information:
|
||||
gef➤ gef config gef.debug 1
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
If you think fixing it is in your skills, then send a [Pull
|
||||
Request](https://github.com/hugsy/gef/pulls) with your patched version, explaining your bug, and
|
||||
|
||||
+1
-1
@@ -10,7 +10,7 @@ process of dynamic analysis and exploit development.
|
||||
It requires Python 3, but [`gef-legacy`](https://github.com/hugsy/gef-legacy) can be used if Python
|
||||
2 support is needed.
|
||||
|
||||
|
||||
|
||||
|
||||
## GDB Made Easy
|
||||
|
||||
|
||||
@@ -5,4 +5,4 @@
|
||||
|
||||
---
|
||||
|
||||
|
||||
|
||||
|
||||
+11
-11
@@ -25,51 +25,51 @@ Currently `GEF` supports the following architectures:
|
||||
To this day, GDB doesn't come with a hexdump-like view. Well `GEF` fixes that for you via the
|
||||
`hexdump` command:
|
||||
|
||||
|
||||
|
||||
|
||||
### Dereferencing data or registers
|
||||
|
||||
No more endless manual pointer dereferencing `x/x` style. Just use `dereference` for that. Or for a
|
||||
comprehensive view of the registers, `registers` might become your best friend:
|
||||
|
||||
|
||||
|
||||
|
||||
### Heap analysis
|
||||
|
||||
#### Detailed view of Glibc Chunks
|
||||
|
||||
|
||||
|
||||
|
||||
#### Automatic detection of UaF during runtime
|
||||
|
||||
|
||||
|
||||
|
||||
### Display ELF information
|
||||
|
||||
#### ELF structure
|
||||
|
||||
|
||||
|
||||
|
||||
#### Security settings
|
||||
|
||||
|
||||
|
||||
|
||||
### Automatic vulnerable string detection
|
||||
|
||||
|
||||
|
||||
|
||||
### Code emulation with Unicorn-Engine (x86-64)
|
||||
|
||||
|
||||
|
||||
|
||||
### Comprehensive address space layout display
|
||||
|
||||
|
||||
|
||||
|
||||
### Defining arbitrary custom structures
|
||||
|
||||
|
||||
|
||||
|
||||
### Highlight custom strings
|
||||
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user