+ 
-
+
@@ -39,7 +39,7 @@ $ gdb -q
You can immediately see that GEF is correctly installed by launching GDB:
-
+
A few of `GEF` features include:
diff --git a/docs/commands/canary.md b/docs/commands/canary.md
index c3875a3e..b4f571ed 100644
--- a/docs/commands/canary.md
+++ b/docs/commands/canary.md
@@ -10,4 +10,4 @@ The command `canary` does not take any arguments.
gef➤ canary
```
-
+
diff --git a/docs/commands/config.md b/docs/commands/config.md
index e02e9002..c92eadd1 100644
--- a/docs/commands/config.md
+++ b/docs/commands/config.md
@@ -10,7 +10,7 @@ To view all settings for all commands loaded:
gef➤ gef config
```
-
+
Or to get one setting value:
diff --git a/docs/commands/context.md b/docs/commands/context.md
index 9e06b391..5a5d2d62 100644
--- a/docs/commands/context.md
+++ b/docs/commands/context.md
@@ -1,6 +1,6 @@
## Command `context`
-
+
`gef` (not unlike `PEDA` or `fG! famous gdbinit`) provides comprehensive context menu when hitting a
breakpoint.
@@ -123,7 +123,7 @@ gef➤ gef config context.redirect /dev/pts/0
```
Enjoy:
-
+
To go back to normal, remove the value:
diff --git a/docs/commands/edit-flags.md b/docs/commands/edit-flags.md
index 4ad82b21..b9e7fc50 100644
--- a/docs/commands/edit-flags.md
+++ b/docs/commands/edit-flags.md
@@ -20,4 +20,4 @@ instruction), but we want to have the Carry flag set, simply go with:
gef➤ flags -ZERO +CARRY
```
-
+
diff --git a/docs/commands/entry-break.md b/docs/commands/entry-break.md
index 13a84996..aa0ace90 100644
--- a/docs/commands/entry-break.md
+++ b/docs/commands/entry-break.md
@@ -12,4 +12,4 @@ It will perform the following actions:
header, set a breakpoint and run. This case should never fail if the ELF binary has a valid
structure.
-
+
diff --git a/docs/commands/format-string-helper.md b/docs/commands/format-string-helper.md
index f6c2a5d4..b1c3341a 100644
--- a/docs/commands/format-string-helper.md
+++ b/docs/commands/format-string-helper.md
@@ -28,4 +28,4 @@ gef➤ r
If a potentially insecure entry is found, the breakpoint will trigger, stop the process execution,
display the reason for trigger and the associated context.
-
+
diff --git a/docs/commands/gef-remote.md b/docs/commands/gef-remote.md
index c55da74c..d2aeb889 100644
--- a/docs/commands/gef-remote.md
+++ b/docs/commands/gef-remote.md
@@ -38,7 +38,7 @@ Process /tmp/default.out created; pid = 258932
Listening on port 1234
```
-
+
On the client, when the original `gdb` would use `target remote`, GEF's syntax is roughly similar
(shown running in debug mode for more verbose output, but you don't have to):
@@ -75,12 +75,12 @@ Reading /lib64/ld-linux-x86-64.so.2 from remote target...
And finally breaking into the program, showing the current context:
-
+
You will also notice the prompt has changed to indicate the debugging mode is now "remote". Besides
that, all of GEF features are available:
-
+
#### `remote-extended`
diff --git a/docs/commands/got.md b/docs/commands/got.md
index 3bdfdbc7..4544cec9 100644
--- a/docs/commands/got.md
+++ b/docs/commands/got.md
@@ -11,7 +11,7 @@ gef➤ got [--all] [filters]
`--all` Print the GOT for all shared objects in addition to the executable file
-
+
The applied filter partially matches the name of the functions, so you can do something like this.
@@ -21,7 +21,7 @@ gef➤ got print
gef➤ got read
```
-
+
Example of multiple partial filters:
@@ -29,7 +29,7 @@ Example of multiple partial filters:
gef➤ got str get
```
-
+
```text
gef➤ got --all str get
diff --git a/docs/commands/heap-analysis-helper.md b/docs/commands/heap-analysis-helper.md
index b9c9814a..c46404c9 100644
--- a/docs/commands/heap-analysis-helper.md
+++ b/docs/commands/heap-analysis-helper.md
@@ -33,12 +33,12 @@ The following settings are accepted:
- `check_null_free`: to break execution when a free(NULL) is encountered (disabled by default);
- `check_double_free`: to break execution when a double free is encountered;
-
+
- `check_weird_free`: to execution when `free()` is called against a non-tracked pointer;
- `check_uaf`: to break execution when a possible Use-after-Free condition is found.
-
+
Just like the format string vulnerability helper, the `heap-analysis-helper` can fail to detect
complex heap scenarios and/or provide some false positive alerts. Each finding must of course be
@@ -57,7 +57,7 @@ gef➤ gef config heap-analysis-helper.check_uaf False
Then `gef` will not notify you of any inconsistency detected, but simply display a clear message
when a chunk is allocated/freed.
-
+
To get information regarding the currently tracked chunks, use the `show` subcommand:
@@ -65,4 +65,4 @@ To get information regarding the currently tracked chunks, use the `show` subcom
gef➤ heap-analysis-helper show
```
-
+
diff --git a/docs/commands/heap.md b/docs/commands/heap.md
index 89a0120b..a2ed4b0b 100644
--- a/docs/commands/heap.md
+++ b/docs/commands/heap.md
@@ -46,7 +46,7 @@ Displays all the chunks from the `heap` section of the current arena.
gef➤ heap chunks
```
-
+
To select from which arena to display chunks either use the `heap set-arena` command or provide the
base address of the other arena like this:
@@ -55,7 +55,7 @@ base address of the other arena like this:
gef➤ heap chunks [arena_address]
```
-
+
In order to display the chunks of all the available arenas at once use
@@ -63,7 +63,7 @@ In order to display the chunks of all the available arenas at once use
gef➤ heap chunks -a
```
-
+
Because usually the heap chunks are aligned to a certain number of bytes in memory GEF automatically
re-aligns the chunks data start addresses to match Glibc's behavior. To be able to view unaligned
@@ -76,7 +76,7 @@ To get a higher level overview of the chunks you can use the `--summary` flag to
gef➤ heap chunks --summary
```
-
+
Sometimes, multiple types of objects could have the same size, hence it might not be enough only
knowing the chunk size when debugging issues like memory leaks. GEF supports using the vtable to
@@ -87,7 +87,7 @@ with the `--summary` flag.
gef➤ heap chunks --summary --resolve
```
-
+
Heap chunk command also supports filtering chunks by their size. To do so, simply provide the
`--min-size` or `--max-size` argument:
@@ -96,7 +96,7 @@ Heap chunk command also supports filtering chunks by their size. To do so, simpl
gef➤ heap chunks --min-size 16 --max-size 32
```
-
+
The range is inclusive, so the above command will display all chunks with size >=16 and <=32.
@@ -107,7 +107,7 @@ of the chunks in the output:
gef➤ heap chunks --count 1
```
-
+
### `heap chunk` command
@@ -118,7 +118,7 @@ the user memory pointer of the chunk to show the information related to a specif
gef➤ heap chunk [address]
```
-
+
Because usually the heap chunks are aligned to a certain number of bytes in memory GEF automatically
re-aligns the chunks data start addresses to match Glibc's behavior. To be able to view unaligned
@@ -145,7 +145,7 @@ Multi-threaded programs have different arenas, and the knowledge of the `main_ar
`gef` therefore provides the `arena` sub-commands to help you list all the arenas allocated in your
program **at the moment you call the command**.
-
+
### `heap set-arena` command
diff --git a/docs/commands/memory.md b/docs/commands/memory.md
index 6f824b15..784e1e7e 100644
--- a/docs/commands/memory.md
+++ b/docs/commands/memory.md
@@ -3,7 +3,7 @@
As long as the 'memory' section is enabled in your context layout (which it is by default), you can
register addresses, lengths, and grouping size.
-
+
_Note_: this command **should NOT** be mistaken with the [GDB `watch`
command](https://sourceware.org/gdb/current/onlinedocs/gdb/Set-Watchpoints.html) meant to set
@@ -38,7 +38,7 @@ gef ➤ memory watch $_got()+0x18 5
Which, when the `context` is displayed, will show something like:
-
+
### Removing a watch
diff --git a/docs/commands/pcustom.md b/docs/commands/pcustom.md
index f732d414..e26c0264 100644
--- a/docs/commands/pcustom.md
+++ b/docs/commands/pcustom.md
@@ -110,7 +110,7 @@ gef➤ dt person_t
By providing an address or a GDB symbol, `gef` will apply this user-defined structure to the
specified address:
-
+
This means that we can now create very easily new user-defined structures
@@ -120,7 +120,7 @@ For a full demo, watch the following tutorial:
Additionally, if you have successfully configured your IDA settings, you can also directly import
the structure(s) that was(were) reverse-engineered in IDA directly in your GDB session:
- - (see `gef-extras/ida-rpyc`,
+ - (see `gef-extras/ida-rpyc`,
which is the new improved version of `ida-interact`)
#### Dynamic `ctypes.Structure`-like classes
diff --git a/docs/commands/scan.md b/docs/commands/scan.md
index 4be77f94..a120ed28 100644
--- a/docs/commands/scan.md
+++ b/docs/commands/scan.md
@@ -29,4 +29,4 @@ gef➤ scan stack libc
To check mappings without a path associated, an address range (start-end) can be used. Note that
ranges don't include whitespaces.
-
+
diff --git a/docs/commands/search-pattern.md b/docs/commands/search-pattern.md
index 8546655f..8a13459d 100644
--- a/docs/commands/search-pattern.md
+++ b/docs/commands/search-pattern.md
@@ -7,7 +7,7 @@ memory layout. The command `search-pattern`, alias `grep`, aims to be straight-f
gef➤ search-pattern MyPattern
```
-
+
It will provide an easily understandable to spot occurrences of the specified pattern, including the
section it/they was/were found, and the permission associated to that section.
@@ -19,7 +19,7 @@ starts with `0x` and is a valid hex address. For example:
gef➤ search-pattern 0x4005f6
```
-
+
The `search-pattern` command can also be used as a way to search for cross-references to an address.
For this reason, the alias `xref` also points to the command `search-pattern`. Therefore the
diff --git a/docs/commands/stub.md b/docs/commands/stub.md
index e6a21de3..b244fd83 100644
--- a/docs/commands/stub.md
+++ b/docs/commands/stub.md
@@ -23,8 +23,8 @@ Patching `fork()` calls:
* Without stub:
-
+
* With stub:
-
+
diff --git a/docs/commands/tmux-setup.md b/docs/commands/tmux-setup.md
index 0d8c0f5d..b567bcf0 100644
--- a/docs/commands/tmux-setup.md
+++ b/docs/commands/tmux-setup.md
@@ -10,7 +10,7 @@ Those commands will check whether GDB is being spawn from inside a `tmux` (resp.
and if so, will split the pane vertically, and configure the context to be redirected to the new
pane, looking something like:
-
+
To set it up, simply enter
diff --git a/docs/commands/trace-run.md b/docs/commands/trace-run.md
index 64ec89eb..89dd3f51 100644
--- a/docs/commands/trace-run.md
+++ b/docs/commands/trace-run.md
@@ -11,9 +11,9 @@ until the value provided as argument.
gef> trace-run