`module` `GEF`

Global Variables

GEF_DEFAULT_BRANCH
GEF_EXTRAS_DEFAULT_BRANCH
GDB_MIN_VERSION
PYTHON_MIN_VERSION
PYTHON_VERSION
GDB_VERSION
DEFAULT_PAGE_ALIGN_SHIFT
DEFAULT_PAGE_SIZE
GEF_MAX_STRING_LENGTH
LIBC_HEAP_MAIN_ARENA_DEFAULT_NAME
ANSI_SPLIT_RE
LEFT_ARROW
RIGHT_ARROW
DOWN_ARROW
HORIZONTAL_LINE
VERTICAL_LINE
CROSS
TICK
BP_GLYPH
GEF_PROMPT
GEF_PROMPT_ON
GEF_PROMPT_OFF
gdb_initial_settings
cmd
gef
progspace
disable_tr_overwrite_setting
warnmsg
hook

`function` `http_get`

http_get(url: str) → bytes | None

Basic HTTP wrapper for GET request. Return the body of the page if HTTP code is OK, otherwise return None.

`function` `update_gef`

update_gef(argv: list[str]) → int

Obsolete. Use gef.sh.

`function` `reset_all_caches`

reset_all_caches() → None

Free all caches. If an object is cached, it will have a callable attribute cache_clear which will be invoked to purge the function cache.

`function` `reset`

reset() → None

`function` `highlight_text`

highlight_text(text: str) → str

Highlight text using gef.ui.highlight_table { match -> color } settings.

If RegEx is enabled it will create a match group around all items in the gef.ui.highlight_table and wrap the specified color in the gef.ui.highlight_table around those matches.

If RegEx is disabled, split by ANSI codes and 'colorify' each match found within the specified string.

`function` `gef_print`

gef_print(*args: str, end='\n', sep=' ', **kwargs: Any) → None

Wrapper around print(), using string buffering feature.

`function` `bufferize`

bufferize(f: Callable) → Callable

Store the content to be printed for a function in memory, and flush it on function exit.

`function` `p8`

p8(x: int, s: bool = False, e: 'Endianness | None' = None) → bytes

Pack one byte respecting the current architecture endianness.

`function` `p16`

p16(x: int, s: bool = False, e: 'Endianness | None' = None) → bytes

Pack one word respecting the current architecture endianness.

`function` `p32`

p32(x: int, s: bool = False, e: 'Endianness | None' = None) → bytes

Pack one dword respecting the current architecture endianness.

`function` `p64`

p64(x: int, s: bool = False, e: 'Endianness | None' = None) → bytes

Pack one qword respecting the current architecture endianness.

`function` `u8`

u8(x: bytes, s: bool = False, e: 'Endianness | None' = None) → int

Unpack one byte respecting the current architecture endianness.

`function` `u16`

u16(x: bytes, s: bool = False, e: 'Endianness | None' = None) → int

Unpack one word respecting the current architecture endianness.

`function` `u32`

u32(x: bytes, s: bool = False, e: 'Endianness | None' = None) → int

Unpack one dword respecting the current architecture endianness.

`function` `u64`

u64(x: bytes, s: bool = False, e: 'Endianness | None' = None) → int

Unpack one qword respecting the current architecture endianness.

`function` `is_ascii_string`

is_ascii_string(address: int) → bool

Helper function to determine if the buffer pointed by address is an ASCII string (in GDB)

`function` `is_alive`

is_alive() → bool

Check if GDB is running.

`function` `calling_function`

calling_function() → str | None

Return the name of the calling function

`function` `only_if_gdb_running`

only_if_gdb_running(f: Callable) → Callable

Decorator wrapper to check if GDB is running.

`function` `only_if_gdb_target_local`

only_if_gdb_target_local(f: Callable) → Callable

Decorator wrapper to check if GDB is running locally (target not remote).

`function` `deprecated`

deprecated(solution: str = '') → Callable

Decorator to add a warning when a command is obsolete and will be removed.

`function` `experimental_feature`

experimental_feature(f: Callable) → Callable

Decorator to add a warning when a feature is experimental.

`function` `only_if_events_supported`

only_if_events_supported(event_type: str) → Callable

Checks if GDB supports events without crashing.

`function` `wrapped_f`

wrapped_f(*args: Any, **kwargs: Any) → Any

`function` `wrapped_f`

wrapped_f(*args: Any, **kwargs: Any) → Any

`function` `wrapped_f`

wrapped_f(*args: Any, **kwargs: Any) → Any

`function` `wrapped_f`

wrapped_f(*args: Any, **kwargs: Any) → Any

`function` `wrapped_f`

wrapped_f(*args: Any, **kwargs: Any) → Any

`function` `wrapped_f`

wrapped_f(*args: Any, **kwargs: Any) → Any

`function` `wrapped_f`

wrapped_f(*args: Any, **kwargs: Any) → Any

`function` `wrapped_f`

wrapped_f(*args: Any, **kwargs: Any) → Any

`function` `wrapped_f`

wrapped_f(*args: Any, **kwargs: Any) → Any

`function` `wrapped_f`

wrapped_f(*args: Any, **kwargs: Any) → Any

`function` `wrapped_f`

wrapped_f(*args: Any, **kwargs: Any) → Any

`function` `wrapped_f`

wrapped_f(*args: Any, **kwargs: Any) → Any

`function` `wrapped_f`

wrapped_f(*args: Any, **kwargs: Any) → Any

`function` `wrapped_f`

wrapped_f(*args: Any, **kwargs: Any) → Any

`function` `FakeExit`

FakeExit(*args: Any, **kwargs: Any) → NoReturn

`function` `parse_arguments`

parse_arguments(
    required_arguments: dict[str | tuple[str, str], typing.Any],
    optional_arguments: dict[str | tuple[str, str], typing.Any]
) → Callable

Argument parsing decorator.

`function` `search_for_main_arena`

search_for_main_arena() → int

search_for_main_arena is DEPRECATED and will be removed in the future. Use GefHeapManager.find_main_arena_addr()

`function` `get_libc_version`

get_libc_version() → tuple[int, ...]

get_libc_version is DEPRECATED and will be removed in the future. Use GefLibcManager.find_libc_version()

`function` `titlify`

titlify(text: str, color: str | None = None, msg_color: str | None = None) → str

Print a centered title.

`function` `dbg`

dbg(msg: str) → None

`function` `err`

err(msg: str) → None

`function` `warn`

warn(msg: str) → None

`function` `ok`

ok(msg: str) → None

`function` `info`

info(msg: str) → None

`function` `push_context_message`

push_context_message(level: str, message: str) → None

Push the message to be displayed the next time the context is invoked.

`function` `show_last_exception`

show_last_exception() → None

Display the last Python exception.

`function` `gef_pystring`

gef_pystring(x: bytes) → str

Returns a sanitized version as string of the bytes list given in input.

`function` `gef_pybytes`

gef_pybytes(x: str) → bytes

Returns an immutable bytes list from the string given as input.

`function` `style_byte`

style_byte(b: int, color: bool = True) → str

`function` `hexdump`

hexdump(
    source: ByteString,
    length: int = 16,
    separator: str = '.',
    show_raw: bool = False,
    show_symbol: bool = True,
    base: int = 0
) → str

Return the hexdump of src argument. @param source MUST be of type bytes or bytearray @param length is the length of items per line @param separator is the default character to use if one byte is not printable @param show_raw if True, do not add the line nor the text translation @param base is the start address of the block being hexdump @return a string with the hexdump

`function` `is_debug`

is_debug() → bool

Check if debug mode is enabled.

`function` `buffer_output`

buffer_output() → bool

Check if output should be buffered until command completion.

`function` `hide_context`

hide_context() → bool

Helper function to hide the context pane.

`function` `unhide_context`

unhide_context() → bool

Helper function to unhide the context pane.

`function` `enable_redirect_output`

enable_redirect_output(to_file: str = '/dev/null') → None

Redirect all GDB output to to_file parameter. By default, to_file redirects to /dev/null.

`function` `disable_redirect_output`

disable_redirect_output() → None

Disable the output redirection, if any.

`function` `gef_makedirs`

gef_makedirs(path: str, mode: int = 493) → Path

Recursive mkdir() creation. If successful, return the absolute path of the directory created. gef_makedirs is DEPRECATED and will be removed in the future. use pathlib.Path(...).mkdir()

`function` `gdb_disassemble`

gdb_disassemble(
    start_pc: int,
    **kwargs: int
) → Generator[__main__.Instruction, NoneType, NoneType]

Disassemble instructions from start_pc (Integer). Accepts the following named

parameters:

end_pc (Integer) only instructions whose start address fall in the interval from start_pc to end_pc are returned.
count (Integer) list at most this many disassembled instructions If end_pc and count are not provided, the function will behave as if count=1. Return an iterator of Instruction objects

`function` `gdb_get_nth_previous_instruction_address`

gdb_get_nth_previous_instruction_address(addr: int, n: int) → int | None

Return the address (Integer) of the n-th instruction before addr.

`function` `gdb_get_nth_next_instruction_address`

gdb_get_nth_next_instruction_address(addr: int, n: int) → int

Return the address of the n-th instruction after addr. gdb_get_nth_next_instruction_address is DEPRECATED and will be removed in the future. Use gef_instruction_n().address

`function` `gef_instruction_n`

gef_instruction_n(addr: int, n: int) → Instruction

Return the n-th instruction after addr as an Instruction object. Note that n is treated as an positive index, starting from 0 (current instruction address)

`function` `gef_get_instruction_at`

gef_get_instruction_at(addr: int) → Instruction

Return the full Instruction found at the specified address.

`function` `gef_current_instruction`

gef_current_instruction(addr: int) → Instruction

Return the current instruction as an Instruction object.

`function` `gef_next_instruction`

gef_next_instruction(addr: int) → Instruction

Return the next instruction as an Instruction object.

`function` `gef_disassemble`

gef_disassemble(
    addr: int,
    nb_insn: int,
    nb_prev: int = 0
) → Generator[__main__.Instruction, NoneType, NoneType]

Disassemble nb_insn instructions after addr and nb_prev before addr. Return an iterator of Instruction objects.

`function` `gef_execute_external`

gef_execute_external(
    command: Sequence[str],
    as_list: bool = False,
    **kwargs: Any
) → str | list[str]

Execute an external command and return the result.

`function` `gef_execute_gdb_script`

gef_execute_gdb_script(commands: str) → None

Execute the parameter source as GDB command. This is done by writing commands to a temporary file, which is then executed via GDB source command. The tempfile is then deleted.

`function` `checksec`

checksec(filename: str) → dict[str, bool]

checksec is DEPRECATED and will be removed in the future. Use Elf(fname).checksec()

`function` `get_arch`

get_arch() → str

Return the binary's architecture. get_arch is DEPRECATED and will be removed in the future. Use gef.arch instead

`function` `get_entry_point`

get_entry_point() → int | None

Return the binary entry point. get_entry_point is DEPRECATED and will be removed in the future. Use gef.binary.entry_point instead

`function` `is_pie`

is_pie(fpath: str) → bool

`function` `is_big_endian`

is_big_endian() → bool

is_big_endian is DEPRECATED and will be removed in the future. Prefer gef.arch.endianness == Endianness.BIG_ENDIAN

`function` `is_little_endian`

is_little_endian() → bool

is_little_endian is DEPRECATED and will be removed in the future. gef.arch.endianness == Endianness.LITTLE_ENDIAN

`function` `flags_to_human`

flags_to_human(reg_value: int, value_table: dict[int, str]) → str

Return a human readable string showing the flag states.

`function` `register_architecture`

register_architecture(
    cls: Type[ForwardRef('Architecture')]
) → Type[ForwardRef('Architecture')]

register_architecture is DEPRECATED and will be removed in the future. Using the decorator register_architecture is unecessary

`function` `copy_to_clipboard`

copy_to_clipboard(data: bytes) → None

Helper function to submit data to the clipboard

`function` `use_stdtype`

use_stdtype() → str

`function` `use_default_type`

use_default_type() → str

`function` `use_golang_type`

use_golang_type() → str

`function` `use_rust_type`

use_rust_type() → str

`function` `to_unsigned_long`

to_unsigned_long(v: gdb.Value) → int

Cast a gdb.Value to unsigned long.

`function` `get_path_from_info_proc`

get_path_from_info_proc() → str | None

`function` `get_os`

get_os() → str

get_os is DEPRECATED and will be removed in the future. Use gef.session.os

`function` `is_target_coredump`

is_target_coredump() → bool

`function` `get_filepath`

get_filepath() → str | None

Return the local absolute path of the file currently debugged.

`function` `get_function_length`

get_function_length(sym: str) → int

Attempt to get the length of the raw bytes of a function.

`function` `process_lookup_address`

process_lookup_address(address: int) → __main__.Section | None

Look up for an address in memory. Return an Address object if found, None otherwise.

`function` `xor`

xor(data: ByteString, key: str) → bytearray

Return data xor-ed with key.

`function` `is_hex`

is_hex(pattern: str) → bool

Return whether provided string is a hexadecimal value.

`function` `continue_handler`

continue_handler(_: 'gdb.ContinueEvent') → None

GDB event handler for new object continue cases.

`function` `hook_stop_handler`

hook_stop_handler(_: 'gdb.StopEvent') → None

GDB event handler for stop cases.

`function` `new_objfile_handler`

new_objfile_handler(evt: 'gdb.NewObjFileEvent | None') → None

GDB event handler for new object file cases.

`function` `exit_handler`

exit_handler(_: 'gdb.ExitedEvent') → None

GDB event handler for exit cases.

`function` `memchanged_handler`

memchanged_handler(_: 'gdb.MemoryChangedEvent') → None

GDB event handler for mem changes cases.

`function` `regchanged_handler`

regchanged_handler(_: 'gdb.RegisterChangedEvent') → None

GDB event handler for reg changes cases.

`function` `get_terminal_size`

get_terminal_size() → tuple[int, int]

Return the current terminal size.

`function` `reset_architecture`

reset_architecture(arch: str | None = None) → None

Sets the current architecture. If an architecture is explicitly specified by parameter, try to use that one. If this fails, an OSError exception will occur. If no architecture is specified, then GEF will attempt to determine automatically based on the current ELF target. If this fails, an OSError exception will occur.

`function` `get_memory_alignment`

get_memory_alignment(in_bits: bool = False) → int

Try to determine the size of a pointer on this system. First, try to parse it out of the ELF header. Next, use the size of size_t. Finally, try the size of $pc. If in_bits is set to True, the result is returned in bits, otherwise in bytes. get_memory_alignment is DEPRECATED and will be removed in the future. Use gef.arch.ptrsize instead

`function` `clear_screen`

clear_screen(tty: str = '') → None

Clear the screen.

`function` `format_address`

format_address(addr: int) → str

Format the address according to its size.

`function` `format_address_spaces`

format_address_spaces(addr: int, left: bool = True) → str

Format the address according to its size, but with spaces instead of zeroes.

`function` `align_address`

align_address(address: int) → int

Align the provided address to the process's native length.

`function` `align_address_to_size`

align_address_to_size(address: int, align: int) → int

Align the address to the given size.

`function` `align_address_to_page`

align_address_to_page(address: int) → int

Align the address to a page.

`function` `parse_address`

parse_address(address: str) → int

Parse an address and return it as an Integer.

`function` `is_in_x86_kernel`

is_in_x86_kernel(address: int) → bool

`function` `is_remote_debug`

is_remote_debug() → bool

"Return True is the current debugging session is running through GDB remote session.

`function` `de_bruijn`

de_bruijn(alphabet: bytes, n: int) → Generator[int, NoneType, NoneType]

De Bruijn sequence for alphabet and subsequences of length n (for compat. w/ pwnlib).

`function` `generate_cyclic_pattern`

generate_cyclic_pattern(length: int, cycle: int = 4) → bytearray

Create a length byte bytearray of a de Bruijn cyclic pattern.

`function` `safe_parse_and_eval`

safe_parse_and_eval(value: str) → gdb.Value | None

GEF wrapper for gdb.parse_and_eval(): this function returns None instead of raising gdb.error if the eval failed.

`function` `gef_convenience`

gef_convenience(value: str | bytes) → str

Defines a new convenience value.

`function` `parse_string_range`

parse_string_range(s: str) → Iterator[int]

Parses an address range (e.g. 0x400000-0x401000)

`function` `gef_get_pie_breakpoint`

gef_get_pie_breakpoint(num: int) → PieVirtualBreakpoint

gef_get_pie_breakpoint is DEPRECATED and will be removed in the future. Use gef.session.pie_breakpoints[num]

`function` `endian_str`

endian_str() → str

endian_str is DEPRECATED and will be removed in the future. Use str(gef.arch.endianness) instead

`function` `get_gef_setting`

get_gef_setting(name: str) → Any

get_gef_setting is DEPRECATED and will be removed in the future. Use gef.config[key]

`function` `set_gef_setting`

set_gef_setting(name: str, value: Any) → None

set_gef_setting is DEPRECATED and will be removed in the future. Use gef.config[key] = value

`function` `gef_getpagesize`

gef_getpagesize() → int

gef_getpagesize is DEPRECATED and will be removed in the future. Use gef.session.pagesize

`function` `gef_read_canary`

gef_read_canary() → tuple[int, int] | None

gef_read_canary is DEPRECATED and will be removed in the future. Use gef.session.canary

`function` `get_pid`

get_pid() → int

get_pid is DEPRECATED and will be removed in the future. Use gef.session.pid

`function` `get_filename`

get_filename() → str

get_filename is DEPRECATED and will be removed in the future. Use gef.session.file.name

`function` `get_glibc_arena`

get_glibc_arena() → __main__.GlibcArena | None

get_glibc_arena is DEPRECATED and will be removed in the future. Use gef.heap.main_arena

`function` `get_register`

get_register(regname) → int | None

get_register is DEPRECATED and will be removed in the future. Use gef.arch.register(regname)

`function` `get_process_maps`

get_process_maps() → list[__main__.Section]

get_process_maps is DEPRECATED and will be removed in the future. Use gef.memory.maps

`function` `set_arch`

set_arch(arch: str | None = None, _: str | None = None) → None

set_arch is DEPRECATED and will be removed in the future. Use reset_architecture

`function` `register_external_context_pane`

register_external_context_pane(
    pane_name: str,
    display_pane_function: Callable[[], NoneType],
    pane_title_function: Callable[[], str | None],
    condition: Optional[Callable[[], bool]] = None
) → None

Registering function for new GEF Context View. pane_name: a string that has no spaces (used in settings) display_pane_function: a function that uses gef_print() to print strings pane_title_function: a function that returns a string or None, which will be displayed as the title. If None, no title line is displayed. condition: an optional callback: if not None, the callback will be executed first. If it returns true, then only the pane title and content will displayed. Otherwise, it's simply skipped.

Example usage for a simple text to show when we hit a syscall: def only_syscall(): return gef_current_instruction(gef.arch.pc).is_syscall() def display_pane(): gef_print("Wow, I am a context pane!") def pane_title(): return "example:pane" register_external_context_pane("example_pane", display_pane, pane_title, only_syscall)

`function` `register_external_context_layout_mapping`

register_external_context_layout_mapping(
    current_pane_name: str,
    display_pane_function: Callable[[], NoneType],
    pane_title_function: Callable[[], str | None],
    condition: Optional[Callable[[], bool]] = None
) → None

`function` `register_external_command`

register_external_command(
    cls: Type[ForwardRef('GenericCommand')]
) → Type[ForwardRef('GenericCommand')]

Registering function for new GEF (sub-)command to GDB. register_external_command is DEPRECATED and will be removed in the future. Use register(), and inherit from GenericCommand instead

`function` `register_command`

register_command(
    cls: Type[ForwardRef('GenericCommand')]
) → Type[ForwardRef('GenericCommand')]

Decorator for registering new GEF (sub-)command to GDB. register_command is DEPRECATED and will be removed in the future. Use register(), and inherit from GenericCommand instead

`function` `register_priority_command`

register_priority_command(
    cls: Type[ForwardRef('GenericCommand')]
) → Type[ForwardRef('GenericCommand')]

Decorator for registering new command with priority, meaning that it must loaded before the other generic commands. register_priority_command is DEPRECATED and will be removed in the future.

`function` `register`

register(
    cls: Union[Type[ForwardRef('ValidCommandType')], Type[ForwardRef('ValidFunctionType')]]
) → Union[Type[ForwardRef('ValidCommandType')], Type[ForwardRef('ValidFunctionType')]]

`function` `register_function`

register_function(
    cls: Type[ForwardRef('GenericFunction')]
) → Type[ForwardRef('GenericFunction')]

Decorator for registering a new convenience function to GDB. register_function is DEPRECATED and will be removed in the future.

`function` `target_remote_posthook`

target_remote_posthook()

`class` `AARCH64`

`property` AARCH64.cpsr

`property` AARCH64.endianness

`property` AARCH64.fp

`property` AARCH64.instruction_length

`property` AARCH64.pc

`property` AARCH64.ptrsize

Determine the size of pointer from the current CPU mode

`property` AARCH64.registers

`property` AARCH64.sp

`function` `AARCH64.canary_address`

canary_address() → int

`function` `AARCH64.flag_register_to_human`

flag_register_to_human(val: int | None = None) → str

`function` `AARCH64.get_ith_parameter`

get_ith_parameter(i: int, in_func: bool = True) → tuple[str, int | None]

Retrieves the correct parameter used for the current function call.

`function` `AARCH64.get_ra`

get_ra(insn: __main__.Instruction, frame: 'gdb.Frame') → int | None

`function` `AARCH64.is_aarch32`

is_aarch32() → bool

Determine if the CPU is currently in AARCH32 mode from runtime.

`function` `AARCH64.is_branch_taken`

is_branch_taken(insn: __main__.Instruction) → tuple[bool, str]

`function` `AARCH64.is_call`

is_call(insn: __main__.Instruction) → bool

`function` `AARCH64.is_conditional_branch`

is_conditional_branch(insn: __main__.Instruction) → bool

`function` `AARCH64.is_ret`

is_ret(insn: __main__.Instruction) → bool

`function` `AARCH64.is_thumb`

is_thumb() → bool

Determine if the machine is currently in THUMB mode.

`function` `AARCH64.is_thumb32`

is_thumb32() → bool

Determine if the CPU is currently in THUMB32 mode from runtime.

`function` `AARCH64.mprotect_asm`

mprotect_asm(addr: int, size: int, perm: __main__.Permission) → str

`function` `AARCH64.register`

register(name: str) → int

`function` `AARCH64.reset_caches`

reset_caches() → None

`function` `AARCH64.supports_gdb_arch`

supports_gdb_arch(gdb_arch: str) → bool | None

If implemented by a child Architecture, this function dictates if the current class supports the loaded ELF file (which can be accessed via gef.binary). This callback function will override any assumption made by GEF to determine the architecture.

`class` `ARM`

`property` ARM.cpsr

`property` ARM.endianness

`property` ARM.fp

`property` ARM.instruction_length

`property` ARM.mode

`property` ARM.pc

`property` ARM.ptrsize

`property` ARM.registers

`property` ARM.sp

`function` `ARM.canary_address`

canary_address() → int

`function` `ARM.flag_register_to_human`

flag_register_to_human(val: int | None = None) → str

`function` `ARM.get_ith_parameter`

get_ith_parameter(i: int, in_func: bool = True) → tuple[str, int | None]

Retrieves the correct parameter used for the current function call.

`function` `ARM.get_ra`

get_ra(insn: __main__.Instruction, frame: 'gdb.Frame') → int | None

`function` `ARM.is_branch_taken`

is_branch_taken(insn: __main__.Instruction) → tuple[bool, str]

`function` `ARM.is_call`

is_call(insn: __main__.Instruction) → bool

`function` `ARM.is_conditional_branch`

is_conditional_branch(insn: __main__.Instruction) → bool

`function` `ARM.is_ret`

is_ret(insn: __main__.Instruction) → bool

`function` `ARM.is_thumb`

is_thumb() → bool

Determine if the machine is currently in THUMB mode.

`function` `ARM.mprotect_asm`

mprotect_asm(addr: int, size: int, perm: __main__.Permission) → str

`function` `ARM.register`

register(name: str) → int

`function` `ARM.reset_caches`

reset_caches() → None

`function` `ARM.supports_gdb_arch`

supports_gdb_arch(gdb_arch: str) → bool | None

If implemented by a child Architecture, this function dictates if the current class supports the loaded ELF file (which can be accessed via gef.binary). This callback function will override any assumption made by GEF to determine the architecture.

`class` `ASLRCommand`

View/modify the ASLR setting of GDB. By default, GDB will disable ASLR when it starts the process. (i.e. not attached). This command allows to change that setting.

`function` `ASLRCommand.init`

__init__(*args: Any, **kwargs: Any) → None

`property` ASLRCommand.settings

Return the list of settings for this command.

`function` `ASLRCommand.add_setting`

add_setting(
    name: str,
    value: tuple[typing.Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead

`function` `ASLRCommand.del_setting`

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead

`function` `ASLRCommand.do_invoke`

do_invoke(argv: list[str]) → None

`function` `ASLRCommand.get_setting`

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead

`function` `ASLRCommand.has_setting`

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead

`function` `ASLRCommand.invoke`

invoke(args: str, from_tty: bool) → None

`function` `ASLRCommand.post_load`

post_load() → None

`function` `ASLRCommand.pre_load`

pre_load() → None

`function` `ASLRCommand.usage`

usage() → None

`class` `Address`

GEF representation of memory addresses.

`function` `Address.init`

__init__(**kwargs: Any) → None

`property` Address.valid

`function` `Address.dereference`

dereference() → int | None

`function` `Address.is_in_heap_segment`

is_in_heap_segment() → bool

`function` `Address.is_in_stack_segment`

is_in_stack_segment() → bool

`function` `Address.is_in_text_segment`

is_in_text_segment() → bool

`class` `AliasesAddCommand`

Command to add aliases.

`function` `AliasesAddCommand.init`

__init__() → None

`property` AliasesAddCommand.settings

Return the list of settings for this command.

`function` `AliasesAddCommand.add_setting`

add_setting(
    name: str,
    value: tuple[typing.Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead

`function` `AliasesAddCommand.del_setting`

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead

`function` `AliasesAddCommand.do_invoke`

do_invoke(argv: list[str]) → None

`function` `AliasesAddCommand.get_setting`

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead

`function` `AliasesAddCommand.has_setting`

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead

`function` `AliasesAddCommand.invoke`

invoke(args: str, from_tty: bool) → None

`function` `AliasesAddCommand.post_load`

post_load() → None

`function` `AliasesAddCommand.pre_load`

pre_load() → None

`function` `AliasesAddCommand.usage`

usage() → None

`class` `AliasesCommand`

Base command to add, remove, or list aliases.

`function` `AliasesCommand.init`

__init__() → None

`property` AliasesCommand.settings

Return the list of settings for this command.

`function` `AliasesCommand.add_setting`

add_setting(
    name: str,
    value: tuple[typing.Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead

`function` `AliasesCommand.del_setting`

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead

`function` `AliasesCommand.do_invoke`

do_invoke(_: list[str]) → None

`function` `AliasesCommand.get_setting`

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead

`function` `AliasesCommand.has_setting`

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead

`function` `AliasesCommand.invoke`

invoke(args: str, from_tty: bool) → None

`function` `AliasesCommand.post_load`

post_load() → None

`function` `AliasesCommand.pre_load`

pre_load() → None

`function` `AliasesCommand.usage`

usage() → None

`class` `AliasesListCommand`

Command to list aliases.

`function` `AliasesListCommand.init`

__init__() → None

`property` AliasesListCommand.settings

Return the list of settings for this command.

`function` `AliasesListCommand.add_setting`

add_setting(
    name: str,
    value: tuple[typing.Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead

`function` `AliasesListCommand.del_setting`

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead

`function` `AliasesListCommand.do_invoke`

do_invoke(_: list[str]) → None

`function` `AliasesListCommand.get_setting`

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead

`function` `AliasesListCommand.has_setting`

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead

`function` `AliasesListCommand.invoke`

invoke(args: str, from_tty: bool) → None

`function` `AliasesListCommand.post_load`

post_load() → None

`function` `AliasesListCommand.pre_load`

pre_load() → None

`function` `AliasesListCommand.usage`

usage() → None

`class` `AliasesRmCommand`

Command to remove aliases.

`function` `AliasesRmCommand.init`

__init__() → None

`property` AliasesRmCommand.settings

Return the list of settings for this command.

`function` `AliasesRmCommand.add_setting`

add_setting(
    name: str,
    value: tuple[typing.Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead

`function` `AliasesRmCommand.del_setting`

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead

`function` `AliasesRmCommand.do_invoke`

do_invoke(argv: list[str]) → None

`function` `AliasesRmCommand.get_setting`

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead

`function` `AliasesRmCommand.has_setting`

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead

`function` `AliasesRmCommand.invoke`

invoke(args: str, from_tty: bool) → None

`function` `AliasesRmCommand.post_load`

post_load() → None

`function` `AliasesRmCommand.pre_load`

pre_load() → None

`function` `AliasesRmCommand.usage`

usage() → None

`class` `AlreadyRegisteredException`

`class` `ArchCommand`

Manage the current loaded architecture.

`function` `ArchCommand.init`

__init__() → None

`property` ArchCommand.settings

Return the list of settings for this command.

`function` `ArchCommand.add_setting`

add_setting(
    name: str,
    value: tuple[typing.Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead

`function` `ArchCommand.del_setting`

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead

`function` `ArchCommand.do_invoke`

do_invoke(argv: list[str]) → None

`function` `ArchCommand.get_setting`

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead

`function` `ArchCommand.has_setting`

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead

`function` `ArchCommand.invoke`

invoke(args: str, from_tty: bool) → None

`function` `ArchCommand.post_load`

post_load() → None

`function` `ArchCommand.pre_load`

pre_load() → None

`function` `ArchCommand.usage`

usage() → None

`class` `ArchGetCommand`

Get the current loaded architecture.

`function` `ArchGetCommand.init`

__init__(*args: Any, **kwargs: Any) → None

`property` ArchGetCommand.settings

Return the list of settings for this command.

`function` `ArchGetCommand.add_setting`

add_setting(
    name: str,
    value: tuple[typing.Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead

`function` `ArchGetCommand.del_setting`

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead

`function` `ArchGetCommand.do_invoke`

do_invoke(args: list[str]) → None

`function` `ArchGetCommand.get_setting`

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead

`function` `ArchGetCommand.has_setting`

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead

`function` `ArchGetCommand.invoke`

invoke(args: str, from_tty: bool) → None

`function` `ArchGetCommand.post_load`

post_load() → None

`function` `ArchGetCommand.pre_load`

pre_load() → None

`function` `ArchGetCommand.usage`

usage() → None

`class` `ArchListCommand`

List the available architectures.

`function` `ArchListCommand.init`

__init__(*args: Any, **kwargs: Any) → None

`property` ArchListCommand.settings

Return the list of settings for this command.

`function` `ArchListCommand.add_setting`

add_setting(
    name: str,
    value: tuple[typing.Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead

`function` `ArchListCommand.del_setting`

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead

`function` `ArchListCommand.do_invoke`

do_invoke(args: list[str]) → None

`function` `ArchListCommand.get_setting`

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead

`function` `ArchListCommand.has_setting`

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead

`function` `ArchListCommand.invoke`

invoke(args: str, from_tty: bool) → None

`function` `ArchListCommand.post_load`

post_load() → None

`function` `ArchListCommand.pre_load`

pre_load() → None

`function` `ArchListCommand.usage`

usage() → None

`class` `ArchSetCommand`

Set the current loaded architecture.

`function` `ArchSetCommand.init`

__init__(*args: Any, **kwargs: Any) → None

`property` ArchSetCommand.settings

Return the list of settings for this command.

`function` `ArchSetCommand.add_setting`

add_setting(
    name: str,
    value: tuple[typing.Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead

`function` `ArchSetCommand.complete`

complete(text: str, word: str) → list[str]

`function` `ArchSetCommand.del_setting`

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead

`function` `ArchSetCommand.do_invoke`

do_invoke(args: list[str]) → None

`function` `ArchSetCommand.get_setting`

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead

`function` `ArchSetCommand.has_setting`

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead

`function` `ArchSetCommand.invoke`

invoke(args: str, from_tty: bool) → None

`function` `ArchSetCommand.post_load`

post_load() → None

`function` `ArchSetCommand.pre_load`

pre_load() → None

`function` `ArchSetCommand.usage`

usage() → None

`class` `Architecture`

Generic metaclass for the architecture supported by GEF.

`property` Architecture.endianness

`property` Architecture.fp

`property` Architecture.pc

`property` Architecture.ptrsize

`property` Architecture.registers

`property` Architecture.sp

`function` `Architecture.canary_address`

canary_address() → int

`function` `Architecture.flag_register_to_human`

flag_register_to_human(val: int | None = None) → str

`function` `Architecture.get_ith_parameter`

get_ith_parameter(i: int, in_func: bool = True) → tuple[str, int | None]

Retrieves the correct parameter used for the current function call.

`function` `Architecture.get_ra`

get_ra(insn: __main__.Instruction, frame: 'gdb.Frame') → int | None

`function` `Architecture.is_branch_taken`

is_branch_taken(insn: __main__.Instruction) → tuple[bool, str]

`function` `Architecture.is_call`

is_call(insn: __main__.Instruction) → bool

`function` `Architecture.is_conditional_branch`

is_conditional_branch(insn: __main__.Instruction) → bool

`function` `Architecture.is_ret`

is_ret(insn: __main__.Instruction) → bool

`function` `Architecture.mprotect_asm`

mprotect_asm(addr: int, size: int, perm: __main__.Permission) → str

`function` `Architecture.register`

register(name: str) → int

`function` `Architecture.reset_caches`

reset_caches() → None

`function` `Architecture.supports_gdb_arch`

supports_gdb_arch(gdb_arch: str) → bool | None

If implemented by a child Architecture, this function dictates if the current class supports the loaded ELF file (which can be accessed via gef.binary). This callback function will override any assumption made by GEF to determine the architecture.

`class` `ArchitectureBase`

Class decorator for declaring an architecture to GEF.

`class` `BssBaseFunction`

Return the current bss base address plus the given offset.

`function` `BssBaseFunction.init`

__init__() → None

`function` `BssBaseFunction.arg_to_long`

arg_to_long(args: Any, index: int, default: int = 0) → int

`function` `BssBaseFunction.do_invoke`

do_invoke(args: list) → int

`function` `BssBaseFunction.invoke`

invoke(*args: Any) → int

`class` `CanaryCommand`

Shows the canary value of the current process.

`function` `CanaryCommand.init`

__init__(*args: Any, **kwargs: Any) → None

`property` CanaryCommand.settings

Return the list of settings for this command.

`function` `CanaryCommand.add_setting`

add_setting(
    name: str,
    value: tuple[typing.Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead

`function` `CanaryCommand.del_setting`

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead

`function` `CanaryCommand.do_invoke`

do_invoke(argv: list[str]) → None

`function` `CanaryCommand.get_setting`

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead

`function` `CanaryCommand.has_setting`

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead

`function` `CanaryCommand.invoke`

invoke(args: str, from_tty: bool) → None

`function` `CanaryCommand.post_load`

post_load() → None

`function` `CanaryCommand.pre_load`

pre_load() → None

`function` `CanaryCommand.usage`

usage() → None

`class` `ChangeFdCommand`

ChangeFdCommand: redirect file descriptor during runtime.

`function` `ChangeFdCommand.init`

__init__(*args: Any, **kwargs: Any) → None

`property` ChangeFdCommand.settings

Return the list of settings for this command.

`function` `ChangeFdCommand.add_setting`

add_setting(
    name: str,
    value: tuple[typing.Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead

`function` `ChangeFdCommand.del_setting`

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead

`function` `ChangeFdCommand.do_invoke`

do_invoke(argv: list[str]) → None

`function` `ChangeFdCommand.get_fd_from_result`

get_fd_from_result(res: str) → int

`function` `ChangeFdCommand.get_setting`

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead

`function` `ChangeFdCommand.has_setting`

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead

`function` `ChangeFdCommand.invoke`

invoke(args: str, from_tty: bool) → None

`function` `ChangeFdCommand.post_load`

post_load() → None

`function` `ChangeFdCommand.pre_load`

pre_load() → None

`function` `ChangeFdCommand.usage`

usage() → None

`class` `ChangePermissionBreakpoint`

When hit, this temporary breakpoint will restore the original code, and position $pc correctly.

`function` `ChangePermissionBreakpoint.init`

__init__(loc: str, code: ByteString, pc: int) → None

`function` `ChangePermissionBreakpoint.stop`

stop() → bool

`class` `ChecksecCommand`

Checksec the security properties of the current executable or passed as argument. The command checks for the following protections: - PIE - NX - RelRO - Glibc Stack Canaries - Fortify Source

`function` `ChecksecCommand.init`

__init__() → None

`property` ChecksecCommand.settings

Return the list of settings for this command.

`function` `ChecksecCommand.add_setting`

add_setting(
    name: str,
    value: tuple[typing.Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead

`function` `ChecksecCommand.del_setting`

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead

`function` `ChecksecCommand.do_invoke`

do_invoke(argv: list[str]) → None

`function` `ChecksecCommand.get_setting`

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead

`function` `ChecksecCommand.has_setting`

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead

`function` `ChecksecCommand.invoke`

invoke(args: str, from_tty: bool) → None

`function` `ChecksecCommand.post_load`

post_load() → None

`function` `ChecksecCommand.pre_load`

pre_load() → None

`function` `ChecksecCommand.print_security_properties`

print_security_properties(filename: str) → None

`function` `ChecksecCommand.usage`

usage() → None

`class` `Color`

Used to colorify terminal output.

`function` `Color.blinkify`

blinkify(msg: str) → str

`function` `Color.blueify`

blueify(msg: str) → str

`function` `Color.boldify`

boldify(msg: str) → str

`function` `Color.colorify`

colorify(text: str, attrs: str) → str

Color text according to the given attributes.

`function` `Color.cyanify`

cyanify(msg: str) → str

`function` `Color.grayify`

grayify(msg: str) → str

`function` `Color.greenify`

greenify(msg: str) → str

`function` `Color.highlightify`

highlightify(msg: str) → str

`function` `Color.light_grayify`

light_grayify(msg: str) → str

`function` `Color.pinkify`

pinkify(msg: str) → str

`function` `Color.redify`

redify(msg: str) → str

module GEF

Global Variables

function http_get

function update_gef

function reset_all_caches

function reset

function highlight_text

function gef_print

function bufferize

function p8

function p16

function p32

function p64

function u8

function u16

function u32

function u64

function is_ascii_string

function is_alive

function calling_function

function only_if_gdb_running

function only_if_gdb_target_local

function deprecated

function experimental_feature

function only_if_events_supported

function wrapped_f

function wrapped_f

function wrapped_f

function wrapped_f

function wrapped_f

function wrapped_f

function wrapped_f

function wrapped_f

function wrapped_f

function wrapped_f

function wrapped_f

function wrapped_f

function wrapped_f

function wrapped_f

function FakeExit

function parse_arguments

function search_for_main_arena

function get_libc_version

function titlify

function dbg

function err

function warn

function ok

function info

function push_context_message

function show_last_exception

function gef_pystring

function gef_pybytes

function style_byte

function hexdump

function is_debug

function buffer_output

function hide_context

function unhide_context

function enable_redirect_output

function disable_redirect_output

function gef_makedirs

function gdb_disassemble

function gdb_get_nth_previous_instruction_address

function gdb_get_nth_next_instruction_address

function gef_instruction_n

function gef_get_instruction_at

function gef_current_instruction

function gef_next_instruction

function gef_disassemble

function gef_execute_external

function gef_execute_gdb_script

function checksec

function get_arch

function get_entry_point

function is_pie

function is_big_endian

function is_little_endian

function flags_to_human

function register_architecture

`module` `GEF`

`function` `http_get`

`function` `update_gef`

`function` `reset_all_caches`

`function` `reset`

`function` `highlight_text`

`function` `gef_print`

`function` `bufferize`

`function` `p8`

`function` `p16`

`function` `p32`

`function` `p64`

`function` `u8`

`function` `u16`

`function` `u32`

`function` `u64`

`function` `is_ascii_string`

`function` `is_alive`

`function` `calling_function`

`function` `only_if_gdb_running`

`function` `only_if_gdb_target_local`

`function` `deprecated`

`function` `experimental_feature`

`function` `only_if_events_supported`

`function` `wrapped_f`

`function` `wrapped_f`

`function` `wrapped_f`

`function` `wrapped_f`

`function` `wrapped_f`

`function` `wrapped_f`

`function` `wrapped_f`

`function` `wrapped_f`

`function` `wrapped_f`

`function` `wrapped_f`

`function` `wrapped_f`

`function` `wrapped_f`

`function` `wrapped_f`

`function` `wrapped_f`

`function` `FakeExit`

`function` `parse_arguments`

`function` `search_for_main_arena`

`function` `get_libc_version`

`function` `titlify`

`function` `dbg`

`function` `err`

`function` `warn`

`function` `ok`

`function` `info`

`function` `push_context_message`

`function` `show_last_exception`

`function` `gef_pystring`

`function` `gef_pybytes`

`function` `style_byte`

`function` `hexdump`

`function` `is_debug`

`function` `buffer_output`

`function` `hide_context`

`function` `unhide_context`

`function` `enable_redirect_output`

`function` `disable_redirect_output`

`function` `gef_makedirs`

`function` `gdb_disassemble`

`function` `gdb_get_nth_previous_instruction_address`

`function` `gdb_get_nth_next_instruction_address`

`function` `gef_instruction_n`

`function` `gef_get_instruction_at`

`function` `gef_current_instruction`

`function` `gef_next_instruction`

`function` `gef_disassemble`

`function` `gef_execute_external`

`function` `gef_execute_gdb_script`

`function` `checksec`

`function` `get_arch`

`function` `get_entry_point`

`function` `is_pie`

`function` `is_big_endian`

`function` `is_little_endian`

`function` `flags_to_human`

`function` `register_architecture`

`function` `copy_to_clipboard`