Aprelius logo
uptime: 00:00:00
Assembly

GDB Assembly Debugging

Starting a debug session

bash
starti          # start and break on the first instruction
# or
break _start    # breakpoint at the _start label
run             # start execution

Examining memory

The x command prints memory contents:

text
x/[count][format][size] <address>
bash
x/8xw $esp      # 8 words in hex
x/8dw $esp      # 8 words in signed decimal
x/8uw $esp      # unsigned decimal
x/32xb $esp     # 32 bytes in hex (detailed view)
x/8xg $rsp      # 8 64-bit values in hex (x86-64)

Example output:

text
0xffffd5c0:     0x00000040      0x00000030      0x00000018      0x00000012
0xffffd5d0:     0x00000001      0xffffd7b7      0x00000000      0xffffd7e4
  • count — how many units to display
  • format — x hex, d signed decimal, u unsigned decimal, t binary, s string, i instruction (disassembly)
  • size — b byte, h halfword (2), w word (4), g giant word (8)

Stepping through code

bash
stepi   # si   — execute one machine instruction
nexti   # ni   — one instruction, stepping over calls
continue  # c  — run until the next breakpoint

stepi/nexti work per instruction, unlike step/next which work per source line. nexti is useful when diving into a called function isn't wanted.

Breakpoints

bash
break _start                # at a label
break *0x8049000            # at an address
break _start if $eax == 0   # conditional

info breakpoints            # list
delete 1                    # remove #1
disable 1 / enable 1        # toggle #1

Registers

bash
info registers   # info reg — all registers
info reg eax     # one register
print $eax
p/x $eax         # hex
p/d $eax         # decimal

Stack inspection

bash
x/16xw $esp      # 16 words on the stack
info frame       # frame info (useful inside functions)
backtrace        # bt — call stack

Pointer dereferencing with print:

bash
p *(long*)($rsp+8)                  # 8-byte value at $rsp+8
p *(long*)($rsp+0x20)               # dereference (note the *)
p (char*)*(long*)($rsp + 0x18)      # dereference twice: 0x7fffffffe7d9 "hello"
x/s *(char**)($rsp + 0x20)          # same, as a string
p (char*)*((long*)($rsp+0x20)+1)    # next stack slot: "world"

p *(long)($rsp+8)                   # wrong — needs (long*)

TUI mode

bash
layout asm       # assembly view
layout regs      # registers + assembly
layout src       # source view
layout split     # source + assembly
Ctrl+X, A        # toggle TUI on/off

Navigation: Ctrl+X, O switches the active window, Ctrl+L refreshes if the display breaks, Ctrl+X, 1 / Ctrl+X, 2 switch between single and split windows.

TUI shows code and registers at once, highlights the current instruction, and updates registers on every step.

Tips

  • Press Enter to repeat the last command.
  • Up/Down navigate command history, Ctrl+R searches it.
  • help <command> (e.g. help x, help stepi) prints details for any command.

Common workflow

bash
gdb ./program
starti
layout regs        # better view
info reg
x/8dw $esp
si                 # step; press Enter to repeat
si
x/8dw $esp
info reg eax
break *0x8049020
continue

References