Skip to content

module GEF

Global Variables

  • GEF_DEFAULT_BRANCH
  • GEF_EXTRAS_DEFAULT_BRANCH
  • GDB_MIN_VERSION
  • GDB_VERSION
  • PYTHON_MIN_VERSION
  • PYTHON_VERSION
  • DEFAULT_PAGE_ALIGN_SHIFT
  • DEFAULT_PAGE_SIZE
  • GEF_TEMP_DIR
  • GEF_MAX_STRING_LENGTH
  • LIBC_HEAP_MAIN_ARENA_DEFAULT_NAME
  • ANSI_SPLIT_RE
  • LEFT_ARROW
  • RIGHT_ARROW
  • DOWN_ARROW
  • HORIZONTAL_LINE
  • VERTICAL_LINE
  • CROSS
  • TICK
  • BP_GLYPH
  • GEF_PROMPT
  • GEF_PROMPT_ON
  • GEF_PROMPT_OFF
  • PREFIX
  • gdb_initial_settings
  • cmd
  • gef
  • errmsg

function http_get

http_get(url: str) → Optional[bytes]

Basic HTTP wrapper for GET request. Return the body of the page if HTTP code is OK, otherwise return None.


function update_gef

update_gef(argv: List[str]) → int

Try to update gef to the latest version pushed on GitHub main branch. Return 0 on success, 1 on failure.


function reset_all_caches

reset_all_caches() → None

Free all caches. If an object is cached, it will have a callable attribute cache_clear which will be invoked to purge the function cache.


function reset

reset() → None

function highlight_text

highlight_text(text: str) → str

Highlight text using gef.ui.highlight_table { match -> color } settings.

If RegEx is enabled it will create a match group around all items in the gef.ui.highlight_table and wrap the specified color in the gef.ui.highlight_table around those matches.

If RegEx is disabled, split by ANSI codes and 'colorify' each match found within the specified string.


function gef_print

gef_print(*args: str, end='\n', sep=' ', **kwargs: Any) → None

Wrapper around print(), using string buffering feature.


function bufferize

bufferize(f: Callable) → Callable

Store the content to be printed for a function in memory, and flush it on function exit.


function p8

p8(
    x: int,
    s: bool = False,
    e: Optional[ForwardRef('Endianness')] = None
) → bytes

Pack one byte respecting the current architecture endianness.


function p16

p16(
    x: int,
    s: bool = False,
    e: Optional[ForwardRef('Endianness')] = None
) → bytes

Pack one word respecting the current architecture endianness.


function p32

p32(
    x: int,
    s: bool = False,
    e: Optional[ForwardRef('Endianness')] = None
) → bytes

Pack one dword respecting the current architecture endianness.


function p64

p64(
    x: int,
    s: bool = False,
    e: Optional[ForwardRef('Endianness')] = None
) → bytes

Pack one qword respecting the current architecture endianness.


function u8

u8(
    x: bytes,
    s: bool = False,
    e: Optional[ForwardRef('Endianness')] = None
) → int

Unpack one byte respecting the current architecture endianness.


function u16

u16(
    x: bytes,
    s: bool = False,
    e: Optional[ForwardRef('Endianness')] = None
) → int

Unpack one word respecting the current architecture endianness.


function u32

u32(
    x: bytes,
    s: bool = False,
    e: Optional[ForwardRef('Endianness')] = None
) → int

Unpack one dword respecting the current architecture endianness.


function u64

u64(
    x: bytes,
    s: bool = False,
    e: Optional[ForwardRef('Endianness')] = None
) → int

Unpack one qword respecting the current architecture endianness.


function is_ascii_string

is_ascii_string(address: int) → bool

Helper function to determine if the buffer pointed by address is an ASCII string (in GDB)


function is_alive

is_alive() → bool

Check if GDB is running.


function calling_function

calling_function() → Optional[str]

Return the name of the calling function


function only_if_gdb_running

only_if_gdb_running(f: Callable) → Callable

Decorator wrapper to check if GDB is running.


function only_if_gdb_target_local

only_if_gdb_target_local(f: Callable) → Callable

Decorator wrapper to check if GDB is running locally (target not remote).


function deprecated

deprecated(solution: str = '') → Callable

Decorator to add a warning when a command is obsolete and will be removed.


function experimental_feature

experimental_feature(f: Callable) → Callable

Decorator to add a warning when a feature is experimental.


function only_if_events_supported

only_if_events_supported(event_type: str) → Callable

Checks if GDB supports events without crashing.


function wrapped_f

wrapped_f(*args: Any, **kwargs: Any) → Any

function wrapped_f

wrapped_f(*args: Any, **kwargs: Any) → Any

function wrapped_f

wrapped_f(*args: Any, **kwargs: Any) → Any

function wrapped_f

wrapped_f(*args: Any, **kwargs: Any) → Any

function wrapped_f

wrapped_f(*args: Any, **kwargs: Any) → Any

function wrapped_f

wrapped_f(*args: Any, **kwargs: Any) → Any

function wrapped_f

wrapped_f(*args: Any, **kwargs: Any) → Any

function wrapped_f

wrapped_f(*args: Any, **kwargs: Any) → Any

function wrapped_f

wrapped_f(*args: Any, **kwargs: Any) → Any

function wrapped_f

wrapped_f(*args: Any, **kwargs: Any) → Any

function wrapped_f

wrapped_f(*args: Any, **kwargs: Any) → Any

function wrapped_f

wrapped_f(*args: Any, **kwargs: Any) → Any

function wrapped_f

wrapped_f(*args: Any, **kwargs: Any) → Any

function wrapped_f

wrapped_f(*args: Any, **kwargs: Any) → Any

function FakeExit

FakeExit(*args: Any, **kwargs: Any) → NoReturn

function parse_arguments

parse_arguments(
    required_arguments: Dict[Union[str, Tuple[str, str]], Any],
    optional_arguments: Dict[Union[str, Tuple[str, str]], Any]
) → Callable

Argument parsing decorator.


function search_for_main_arena

search_for_main_arena() → int

search_for_main_arena is DEPRECATED and will be removed in the future. Use GefHeapManager.find_main_arena_addr()


function get_libc_version

get_libc_version() → Tuple[int, ...]

get_libc_version is DEPRECATED and will be removed in the future. Use GefLibcManager.find_libc_version()


function titlify

titlify(
    text: str,
    color: Optional[str] = None,
    msg_color: Optional[str] = None
) → str

Print a centered title.


function dbg

dbg(msg: str) → None

function err

err(msg: str) → None

function warn

warn(msg: str) → None

function ok

ok(msg: str) → None

function info

info(msg: str) → None

function push_context_message

push_context_message(level: str, message: str) → None

Push the message to be displayed the next time the context is invoked.


function show_last_exception

show_last_exception() → None

Display the last Python exception.


function gef_pystring

gef_pystring(x: bytes) → str

Returns a sanitized version as string of the bytes list given in input.


function gef_pybytes

gef_pybytes(x: str) → bytes

Returns an immutable bytes list from the string given as input.


function style_byte

style_byte(b: int, color: bool = True) → str

function hexdump

hexdump(
    source: ByteString,
    length: int = 16,
    separator: str = '.',
    show_raw: bool = False,
    show_symbol: bool = True,
    base: int = 0
) → str

Return the hexdump of src argument. @param source MUST be of type bytes or bytearray @param length is the length of items per line @param separator is the default character to use if one byte is not printable @param show_raw if True, do not add the line nor the text translation @param base is the start address of the block being hexdump @return a string with the hexdump


function is_debug

is_debug() → bool

Check if debug mode is enabled.


function buffer_output

buffer_output() → bool

Check if output should be buffered until command completion.


function hide_context

hide_context() → bool

Helper function to hide the context pane.


function unhide_context

unhide_context() → bool

Helper function to unhide the context pane.


function enable_redirect_output

enable_redirect_output(to_file: str = '/dev/null') → None

Redirect all GDB output to to_file parameter. By default, to_file redirects to /dev/null.


function disable_redirect_output

disable_redirect_output() → None

Disable the output redirection, if any.


function gef_makedirs

gef_makedirs(path: str, mode: int = 493) → Path

Recursive mkdir() creation. If successful, return the absolute path of the directory created.


function gdb_disassemble

gdb_disassemble(
    start_pc: int,
    **kwargs: int
) → Generator[__main__.Instruction, NoneType, NoneType]

Disassemble instructions from start_pc (Integer). Accepts the following named

parameters:

  • end_pc (Integer) only instructions whose start address fall in the interval from start_pc to end_pc are returned.
  • count (Integer) list at most this many disassembled instructions If end_pc and count are not provided, the function will behave as if count=1. Return an iterator of Instruction objects

function gdb_get_nth_previous_instruction_address

gdb_get_nth_previous_instruction_address(addr: int, n: int) → Optional[int]

Return the address (Integer) of the n-th instruction before addr.


function gdb_get_nth_next_instruction_address

gdb_get_nth_next_instruction_address(addr: int, n: int) → int

Return the address (Integer) of the n-th instruction after addr.


function gef_instruction_n

gef_instruction_n(addr: int, n: int) → Instruction

Return the n-th instruction after addr as an Instruction object.


function gef_get_instruction_at

gef_get_instruction_at(addr: int) → Instruction

Return the full Instruction found at the specified address.


function gef_current_instruction

gef_current_instruction(addr: int) → Instruction

Return the current instruction as an Instruction object.


function gef_next_instruction

gef_next_instruction(addr: int) → Instruction

Return the next instruction as an Instruction object.


function gef_disassemble

gef_disassemble(
    addr: int,
    nb_insn: int,
    nb_prev: int = 0
) → Generator[__main__.Instruction, NoneType, NoneType]

Disassemble nb_insn instructions after addr and nb_prev before addr. Return an iterator of Instruction objects.


function gef_execute_external

gef_execute_external(
    command: Sequence[str],
    as_list: bool = False,
    **kwargs: Any
) → Union[str, List[str]]

Execute an external command and return the result.


function gef_execute_gdb_script

gef_execute_gdb_script(commands: str) → None

Execute the parameter source as GDB command. This is done by writing commands to a temporary file, which is then executed via GDB source command. The tempfile is then deleted.


function checksec

checksec(filename: str) → Dict[str, bool]

checksec is DEPRECATED and will be removed in the future. Use Elf(fname).checksec()


function get_entry_point

get_entry_point() → Optional[int]

Return the binary entry point. get_entry_point is DEPRECATED and will be removed in the future. Use gef.binary.entry_point instead


function is_pie

is_pie(fpath: str) → bool

function is_big_endian

is_big_endian() → bool

is_big_endian is DEPRECATED and will be removed in the future. Prefer gef.arch.endianness == Endianness.BIG_ENDIAN


function is_little_endian

is_little_endian() → bool

is_little_endian is DEPRECATED and will be removed in the future. gef.arch.endianness == Endianness.LITTLE_ENDIAN


function flags_to_human

flags_to_human(reg_value: int, value_table: Dict[int, str]) → str

Return a human readable string showing the flag states.


function register_architecture

register_architecture(
    cls: Type[ForwardRef('Architecture')]
) → Type[ForwardRef('Architecture')]

register_architecture is DEPRECATED and will be removed in the future. Using the decorator register_architecture is unecessary


function copy_to_clipboard

copy_to_clipboard(data: bytes) → None

Helper function to submit data to the clipboard


function use_stdtype

use_stdtype() → str

function use_default_type

use_default_type() → str

function use_golang_type

use_golang_type() → str

function use_rust_type

use_rust_type() → str

function to_unsigned_long

to_unsigned_long(v: gdb.Value) → int

Cast a gdb.Value to unsigned long.


function get_path_from_info_proc

get_path_from_info_proc() → Optional[str]

function get_os

get_os() → str

get_os is DEPRECATED and will be removed in the future. Use gef.session.os


function get_filepath

get_filepath() → Optional[str]

Return the local absolute path of the file currently debugged.


function get_function_length

get_function_length(sym: str) → int

Attempt to get the length of the raw bytes of a function.


function process_lookup_address

process_lookup_address(address: int) → Optional[__main__.Section]

Look up for an address in memory. Return an Address object if found, None otherwise.


function xor

xor(data: ByteString, key: str) → bytearray

Return data xor-ed with key.


function is_hex

is_hex(pattern: str) → bool

Return whether provided string is a hexadecimal value.


function continue_handler

continue_handler(_: 'gdb.Event') → None

GDB event handler for new object continue cases.


function hook_stop_handler

hook_stop_handler(_: 'gdb.StopEvent') → None

GDB event handler for stop cases.


function new_objfile_handler

new_objfile_handler(evt: Optional[ForwardRef('gdb.NewObjFileEvent')]) → None

GDB event handler for new object file cases.


function exit_handler

exit_handler(_: 'gdb.ExitedEvent') → None

GDB event handler for exit cases.


function memchanged_handler

memchanged_handler(_: 'gdb.MemoryChangedEvent') → None

GDB event handler for mem changes cases.


function regchanged_handler

regchanged_handler(_: 'gdb.RegisterChangedEvent') → None

GDB event handler for reg changes cases.


function get_terminal_size

get_terminal_size() → Tuple[int, int]

Return the current terminal size.


function reset_architecture

reset_architecture(arch: Optional[str] = None) → None

Sets the current architecture. If an architecture is explicitly specified by parameter, try to use that one. If this fails, an OSError exception will occur. If no architecture is specified, then GEF will attempt to determine automatically based on the current ELF target. If this fails, an OSError exception will occur.


function get_memory_alignment

get_memory_alignment(in_bits: bool = False) → int

Try to determine the size of a pointer on this system. First, try to parse it out of the ELF header. Next, use the size of size_t. Finally, try the size of $pc. If in_bits is set to True, the result is returned in bits, otherwise in bytes. get_memory_alignment is DEPRECATED and will be removed in the future. Use gef.arch.ptrsize instead


function clear_screen

clear_screen(tty: str = '') → None

Clear the screen.


function format_address

format_address(addr: int) → str

Format the address according to its size.


function format_address_spaces

format_address_spaces(addr: int, left: bool = True) → str

Format the address according to its size, but with spaces instead of zeroes.


function align_address

align_address(address: int) → int

Align the provided address to the process's native length.


function align_address_to_size

align_address_to_size(address: int, align: int) → int

Align the address to the given size.


function align_address_to_page

align_address_to_page(address: int) → int

Align the address to a page.


function parse_address

parse_address(address: str) → int

Parse an address and return it as an Integer.


function is_in_x86_kernel

is_in_x86_kernel(address: int) → bool

function is_remote_debug

is_remote_debug() → bool

"Return True is the current debugging session is running through GDB remote session.


function de_bruijn

de_bruijn(alphabet: bytes, n: int) → Generator[str, NoneType, NoneType]

De Bruijn sequence for alphabet and subsequences of length n (for compat. w/ pwnlib).


function generate_cyclic_pattern

generate_cyclic_pattern(length: int, cycle: int = 4) → bytearray

Create a length byte bytearray of a de Bruijn cyclic pattern.


function safe_parse_and_eval

safe_parse_and_eval(value: str) → Optional[ForwardRef('gdb.Value')]

GEF wrapper for gdb.parse_and_eval(): this function returns None instead of raising gdb.error if the eval failed.


function gef_convenience

gef_convenience(value: Union[str, bytes]) → str

Defines a new convenience value.


function parse_string_range

parse_string_range(s: str) → Iterator[int]

Parses an address range (e.g. 0x400000-0x401000)


function gef_get_pie_breakpoint

gef_get_pie_breakpoint(num: int) → PieVirtualBreakpoint

gef_get_pie_breakpoint is DEPRECATED and will be removed in the future. Use gef.session.pie_breakpoints[num]


function endian_str

endian_str() → str

endian_str is DEPRECATED and will be removed in the future. Use str(gef.arch.endianness) instead


function get_gef_setting

get_gef_setting(name: str) → Any

get_gef_setting is DEPRECATED and will be removed in the future. Use gef.config[key]


function set_gef_setting

set_gef_setting(name: str, value: Any) → None

set_gef_setting is DEPRECATED and will be removed in the future. Use gef.config[key] = value


function gef_getpagesize

gef_getpagesize() → int

gef_getpagesize is DEPRECATED and will be removed in the future. Use gef.session.pagesize


function gef_read_canary

gef_read_canary() → Optional[Tuple[int, int]]

gef_read_canary is DEPRECATED and will be removed in the future. Use gef.session.canary


function get_pid

get_pid() → int

get_pid is DEPRECATED and will be removed in the future. Use gef.session.pid


function get_filename

get_filename() → str

get_filename is DEPRECATED and will be removed in the future. Use gef.session.file.name


function get_glibc_arena

get_glibc_arena() → Optional[__main__.GlibcArena]

get_glibc_arena is DEPRECATED and will be removed in the future. Use gef.heap.main_arena


function get_register

get_register(regname) → Optional[int]

get_register is DEPRECATED and will be removed in the future. Use gef.arch.register(regname)


function get_process_maps

get_process_maps() → List[__main__.Section]

get_process_maps is DEPRECATED and will be removed in the future. Use gef.memory.maps


function set_arch

set_arch(arch: Optional[str] = None, _: Optional[str] = None) → None

set_arch is DEPRECATED and will be removed in the future. Use reset_architecture


function register_external_context_pane

register_external_context_pane(
    pane_name: str,
    display_pane_function: Callable[[], NoneType],
    pane_title_function: Callable[[], Optional[str]],
    condition: Optional[Callable[[], bool]] = None
) → None

Registering function for new GEF Context View. pane_name: a string that has no spaces (used in settings) display_pane_function: a function that uses gef_print() to print strings pane_title_function: a function that returns a string or None, which will be displayed as the title. If None, no title line is displayed. condition: an optional callback: if not None, the callback will be executed first. If it returns true, then only the pane title and content will displayed. Otherwise, it's simply skipped.

Example usage for a simple text to show when we hit a syscall: def only_syscall(): return gef_current_instruction(gef.arch.pc).is_syscall() def display_pane(): gef_print("Wow, I am a context pane!") def pane_title(): return "example:pane" register_external_context_pane("example_pane", display_pane, pane_title, only_syscall)


function register_external_command

register_external_command(
    cls: Type[ForwardRef('GenericCommand')]
) → Type[ForwardRef('GenericCommand')]

Registering function for new GEF (sub-)command to GDB. register_external_command is DEPRECATED and will be removed in the future. Use register(), and inherit from GenericCommand instead


function register_command

register_command(
    cls: Type[ForwardRef('GenericCommand')]
) → Type[ForwardRef('GenericCommand')]

Decorator for registering new GEF (sub-)command to GDB. register_command is DEPRECATED and will be removed in the future. Use register(), and inherit from GenericCommand instead


function register_priority_command

register_priority_command(
    cls: Type[ForwardRef('GenericCommand')]
) → Type[ForwardRef('GenericCommand')]

Decorator for registering new command with priority, meaning that it must loaded before the other generic commands. register_priority_command is DEPRECATED and will be removed in the future.


function register

register(
    cls: Union[Type[ForwardRef('GenericCommand')], Type[ForwardRef('GenericFunction')]]
) → Union[Type[ForwardRef('GenericCommand')], Type[ForwardRef('GenericFunction')]]

function register_function

register_function(
    cls: Type[ForwardRef('GenericFunction')]
) → Type[ForwardRef('GenericFunction')]

Decorator for registering a new convenience function to GDB. register_function is DEPRECATED and will be removed in the future.


class AARCH64


property AARCH64.cpsr


property AARCH64.endianness


property AARCH64.fp


property AARCH64.instruction_length


property AARCH64.pc


property AARCH64.ptrsize

Determine the size of pointer from the current CPU mode


property AARCH64.registers


property AARCH64.sp


function AARCH64.canary_address

canary_address() → int

function AARCH64.flag_register_to_human

flag_register_to_human(val: Optional[int] = None) → str

function AARCH64.get_ith_parameter

get_ith_parameter(i: int, in_func: bool = True) → Tuple[str, Optional[int]]

Retrieves the correct parameter used for the current function call.


function AARCH64.get_ra

get_ra(insn: __main__.Instruction, frame: 'gdb.Frame') → int

function AARCH64.is_aarch32

is_aarch32() → bool

Determine if the CPU is currently in AARCH32 mode from runtime.


function AARCH64.is_branch_taken

is_branch_taken(insn: __main__.Instruction) → Tuple[bool, str]

function AARCH64.is_call

is_call(insn: __main__.Instruction) → bool

function AARCH64.is_conditional_branch

is_conditional_branch(insn: __main__.Instruction) → bool

function AARCH64.is_ret

is_ret(insn: __main__.Instruction) → bool

function AARCH64.is_thumb

is_thumb() → bool

Determine if the machine is currently in THUMB mode.


function AARCH64.is_thumb32

is_thumb32() → bool

Determine if the CPU is currently in THUMB32 mode from runtime.


function AARCH64.mprotect_asm

mprotect_asm(addr: int, size: int, perm: __main__.Permission) → str

function AARCH64.register

register(name: str) → int

function AARCH64.reset_caches

reset_caches() → None

function AARCH64.supports_gdb_arch

supports_gdb_arch(gdb_arch: str) → Optional[bool]

If implemented by a child Architecture, this function dictates if the current class supports the loaded ELF file (which can be accessed via gef.binary). This callback function will override any assumption made by GEF to determine the architecture.


class ARM


property ARM.cpsr


property ARM.endianness


property ARM.fp


property ARM.instruction_length


property ARM.mode


property ARM.pc


property ARM.ptrsize


property ARM.registers


property ARM.sp


function ARM.canary_address

canary_address() → int

function ARM.flag_register_to_human

flag_register_to_human(val: Optional[int] = None) → str

function ARM.get_ith_parameter

get_ith_parameter(i: int, in_func: bool = True) → Tuple[str, Optional[int]]

Retrieves the correct parameter used for the current function call.


function ARM.get_ra

get_ra(insn: __main__.Instruction, frame: 'gdb.Frame') → int

function ARM.is_branch_taken

is_branch_taken(insn: __main__.Instruction) → Tuple[bool, str]

function ARM.is_call

is_call(insn: __main__.Instruction) → bool

function ARM.is_conditional_branch

is_conditional_branch(insn: __main__.Instruction) → bool

function ARM.is_ret

is_ret(insn: __main__.Instruction) → bool

function ARM.is_thumb

is_thumb() → bool

Determine if the machine is currently in THUMB mode.


function ARM.mprotect_asm

mprotect_asm(addr: int, size: int, perm: __main__.Permission) → str

function ARM.register

register(name: str) → int

function ARM.reset_caches

reset_caches() → None

function ARM.supports_gdb_arch

supports_gdb_arch(gdb_arch: str) → Optional[bool]

If implemented by a child Architecture, this function dictates if the current class supports the loaded ELF file (which can be accessed via gef.binary). This callback function will override any assumption made by GEF to determine the architecture.


class ASLRCommand

View/modify the ASLR setting of GDB. By default, GDB will disable ASLR when it starts the process. (i.e. not attached). This command allows to change that setting.

function ASLRCommand.__init__

__init__(*args: Any, **kwargs: Any) → None

property ASLRCommand.settings

Return the list of settings for this command.


function ASLRCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function ASLRCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function ASLRCommand.do_invoke

do_invoke(argv: List[str]) → None

function ASLRCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function ASLRCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function ASLRCommand.invoke

invoke(args: str, from_tty: bool) → None

function ASLRCommand.post_load

post_load() → None

function ASLRCommand.pre_load

pre_load() → None

function ASLRCommand.usage

usage() → None

class Address

GEF representation of memory addresses.

function Address.__init__

__init__(**kwargs: Any) → None

property Address.valid


function Address.dereference

dereference() → Optional[int]

function Address.is_in_heap_segment

is_in_heap_segment() → bool

function Address.is_in_stack_segment

is_in_stack_segment() → bool

function Address.is_in_text_segment

is_in_text_segment() → bool

class AliasesAddCommand

Command to add aliases.

function AliasesAddCommand.__init__

__init__() → None

property AliasesAddCommand.settings

Return the list of settings for this command.


function AliasesAddCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function AliasesAddCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function AliasesAddCommand.do_invoke

do_invoke(argv: List[str]) → None

function AliasesAddCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function AliasesAddCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function AliasesAddCommand.invoke

invoke(args: str, from_tty: bool) → None

function AliasesAddCommand.post_load

post_load() → None

function AliasesAddCommand.pre_load

pre_load() → None

function AliasesAddCommand.usage

usage() → None

class AliasesCommand

Base command to add, remove, or list aliases.

function AliasesCommand.__init__

__init__() → None

property AliasesCommand.settings

Return the list of settings for this command.


function AliasesCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function AliasesCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function AliasesCommand.do_invoke

do_invoke(_: List[str]) → None

function AliasesCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function AliasesCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function AliasesCommand.invoke

invoke(args: str, from_tty: bool) → None

function AliasesCommand.post_load

post_load() → None

function AliasesCommand.pre_load

pre_load() → None

function AliasesCommand.usage

usage() → None

class AliasesListCommand

Command to list aliases.

function AliasesListCommand.__init__

__init__() → None

property AliasesListCommand.settings

Return the list of settings for this command.


function AliasesListCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function AliasesListCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function AliasesListCommand.do_invoke

do_invoke(_: List[str]) → None

function AliasesListCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function AliasesListCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function AliasesListCommand.invoke

invoke(args: str, from_tty: bool) → None

function AliasesListCommand.post_load

post_load() → None

function AliasesListCommand.pre_load

pre_load() → None

function AliasesListCommand.usage

usage() → None

class AliasesRmCommand

Command to remove aliases.

function AliasesRmCommand.__init__

__init__() → None

property AliasesRmCommand.settings

Return the list of settings for this command.


function AliasesRmCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function AliasesRmCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function AliasesRmCommand.do_invoke

do_invoke(argv: List[str]) → None

function AliasesRmCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function AliasesRmCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function AliasesRmCommand.invoke

invoke(args: str, from_tty: bool) → None

function AliasesRmCommand.post_load

post_load() → None

function AliasesRmCommand.pre_load

pre_load() → None

function AliasesRmCommand.usage

usage() → None

class Architecture

Generic metaclass for the architecture supported by GEF.


property Architecture.endianness


property Architecture.fp


property Architecture.pc


property Architecture.ptrsize


property Architecture.registers


property Architecture.sp


function Architecture.canary_address

canary_address() → int

function Architecture.flag_register_to_human

flag_register_to_human(val: Optional[int] = None) → str

function Architecture.get_ith_parameter

get_ith_parameter(i: int, in_func: bool = True) → Tuple[str, Optional[int]]

Retrieves the correct parameter used for the current function call.


function Architecture.get_ra

get_ra(insn: __main__.Instruction, frame: 'gdb.Frame') → Optional[int]

function Architecture.is_branch_taken

is_branch_taken(insn: __main__.Instruction) → Tuple[bool, str]

function Architecture.is_call

is_call(insn: __main__.Instruction) → bool

function Architecture.is_conditional_branch

is_conditional_branch(insn: __main__.Instruction) → bool

function Architecture.is_ret

is_ret(insn: __main__.Instruction) → bool

function Architecture.mprotect_asm

mprotect_asm(addr: int, size: int, perm: __main__.Permission) → str

function Architecture.register

register(name: str) → int

function Architecture.reset_caches

reset_caches() → None

function Architecture.supports_gdb_arch

supports_gdb_arch(gdb_arch: str) → Optional[bool]

If implemented by a child Architecture, this function dictates if the current class supports the loaded ELF file (which can be accessed via gef.binary). This callback function will override any assumption made by GEF to determine the architecture.


class ArchitectureBase

Class decorator for declaring an architecture to GEF.


class BssBaseFunction

Return the current bss base address plus the given offset.

function BssBaseFunction.__init__

__init__() → None

function BssBaseFunction.arg_to_long

arg_to_long(args: List, index: int, default: int = 0) → int

function BssBaseFunction.do_invoke

do_invoke(args: List) → int

function BssBaseFunction.invoke

invoke(*args: Any) → int

class CanaryCommand

Shows the canary value of the current process.

function CanaryCommand.__init__

__init__(*args: Any, **kwargs: Any) → None

property CanaryCommand.settings

Return the list of settings for this command.


function CanaryCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function CanaryCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function CanaryCommand.do_invoke

do_invoke(argv: List[str]) → None

function CanaryCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function CanaryCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function CanaryCommand.invoke

invoke(args: str, from_tty: bool) → None

function CanaryCommand.post_load

post_load() → None

function CanaryCommand.pre_load

pre_load() → None

function CanaryCommand.usage

usage() → None

class ChangeFdCommand

ChangeFdCommand: redirect file descriptor during runtime.

function ChangeFdCommand.__init__

__init__(*args: Any, **kwargs: Any) → None

property ChangeFdCommand.settings

Return the list of settings for this command.


function ChangeFdCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function ChangeFdCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function ChangeFdCommand.do_invoke

do_invoke(argv: List[str]) → None

function ChangeFdCommand.get_fd_from_result

get_fd_from_result(res: str) → int

function ChangeFdCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function ChangeFdCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function ChangeFdCommand.invoke

invoke(args: str, from_tty: bool) → None

function ChangeFdCommand.post_load

post_load() → None

function ChangeFdCommand.pre_load

pre_load() → None

function ChangeFdCommand.usage

usage() → None

class ChangePermissionBreakpoint

When hit, this temporary breakpoint will restore the original code, and position $pc correctly.

function ChangePermissionBreakpoint.__init__

__init__(loc: str, code: ByteString, pc: int) → None

function ChangePermissionBreakpoint.stop

stop() → bool

class ChecksecCommand

Checksec the security properties of the current executable or passed as argument. The command checks for the following protections: - PIE - NX - RelRO - Glibc Stack Canaries - Fortify Source

function ChecksecCommand.__init__

__init__() → None

property ChecksecCommand.settings

Return the list of settings for this command.


function ChecksecCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function ChecksecCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function ChecksecCommand.do_invoke

do_invoke(argv: List[str]) → None

function ChecksecCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function ChecksecCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function ChecksecCommand.invoke

invoke(args: str, from_tty: bool) → None

function ChecksecCommand.post_load

post_load() → None

function ChecksecCommand.pre_load

pre_load() → None

function ChecksecCommand.print_security_properties

print_security_properties(filename: str) → None

function ChecksecCommand.usage

usage() → None

class Color

Used to colorify terminal output.


function Color.blinkify

blinkify(msg: str) → str

function Color.blueify

blueify(msg: str) → str

function Color.boldify

boldify(msg: str) → str

function Color.colorify

colorify(text: str, attrs: str) → str

Color text according to the given attributes.


function Color.cyanify

cyanify(msg: str) → str

function Color.grayify

grayify(msg: str) → str

function Color.greenify

greenify(msg: str) → str

function Color.highlightify

highlightify(msg: str) → str

function Color.light_grayify

light_grayify(msg: str) → str

function Color.pinkify

pinkify(msg: str) → str

function Color.redify

redify(msg: str) → str

function Color.underlinify

underlinify(msg: str) → str

function Color.yellowify

yellowify(msg: str) → str

class ContextCommand

Displays a comprehensive and modular summary of runtime context. Unless setting enable is set to False, this command will be spawned automatically every time GDB hits a breakpoint, a watchpoint, or any kind of interrupt. By default, it will show panes that contain the register states, the stack, and the disassembly code around $pc.

function ContextCommand.__init__

__init__() → None

property ContextCommand.settings

Return the list of settings for this command.


function ContextCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function ContextCommand.addr_has_breakpoint

addr_has_breakpoint(address: int, bp_locations: List[str]) → bool

function ContextCommand.context_additional_information

context_additional_information() → None

function ContextCommand.context_args

context_args() → None

function ContextCommand.context_code

context_code() → None

function ContextCommand.context_memory

context_memory() → None

function ContextCommand.context_regs

context_regs() → None

function ContextCommand.context_source

context_source() → None

function ContextCommand.context_stack

context_stack() → None

function ContextCommand.context_threads

context_threads() → None

function ContextCommand.context_title

context_title(m: Optional[str]) → None

function ContextCommand.context_trace

context_trace() → None

function ContextCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function ContextCommand.do_invoke

do_invoke(argv: List[str]) → None

function ContextCommand.empty_extra_messages

empty_extra_messages(_) → None

function ContextCommand.get_pc_context_info

get_pc_context_info(pc: int, line: str) → str

function ContextCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function ContextCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function ContextCommand.invoke

invoke(args: str, from_tty: bool) → None

function ContextCommand.line_has_breakpoint

line_has_breakpoint(
    file_name: str,
    line_number: int,
    bp_locations: List[str]
) → bool

function ContextCommand.post_load

post_load() → None

function ContextCommand.pre_load

pre_load() → None

function ContextCommand.print_arguments_from_symbol

print_arguments_from_symbol(function_name: str, symbol: 'gdb.Symbol') → None

If symbols were found, parse them and print the argument adequately.


function ContextCommand.print_guessed_arguments

print_guessed_arguments(function_name: str) → None

When no symbol, read the current basic block and look for "interesting" instructions.


function ContextCommand.show_legend

show_legend() → None

function ContextCommand.update_registers

update_registers(_) → None

function ContextCommand.usage

usage() → None

class DereferenceCommand

Dereference recursively from an address and display information. This acts like WinDBG dps command.

function DereferenceCommand.__init__

__init__() → None

property DereferenceCommand.settings

Return the list of settings for this command.


function DereferenceCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function DereferenceCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function DereferenceCommand.wrapper

wrapper(*args: Any, **kwargs: Any) → Callable

function DereferenceCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function DereferenceCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function DereferenceCommand.invoke

invoke(args: str, from_tty: bool) → None

function DereferenceCommand.post_load

post_load() → None

function DereferenceCommand.pprint_dereferenced

pprint_dereferenced(addr: int, idx: int, base_offset: int = 0) → str

function DereferenceCommand.pre_load

pre_load() → None

function DereferenceCommand.usage

usage() → None

class DetailRegistersCommand

Display full details on one, many or all registers value from current architecture.

function DetailRegistersCommand.__init__

__init__(*args: Any, **kwargs: Any) → None

property DetailRegistersCommand.settings

Return the list of settings for this command.


function DetailRegistersCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function DetailRegistersCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function DetailRegistersCommand.wrapper

wrapper(*args: Any, **kwargs: Any) → Callable

function DetailRegistersCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function DetailRegistersCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function DetailRegistersCommand.invoke

invoke(args: str, from_tty: bool) → None

function DetailRegistersCommand.post_load

post_load() → None

function DetailRegistersCommand.pre_load

pre_load() → None

function DetailRegistersCommand.usage

usage() → None

class DisableContextOutputContext


class Elf

Basic ELF parsing. Ref: - http://www.skyfree.org/linux/references/ELF_Format.pdf - https://refspecs.linuxfoundation.org/elf/elfspec_ppc.pdf - https://refspecs.linuxfoundation.org/ELF/ppc64/PPC-elf64abi.html

function Elf.__init__

__init__(path: Union[str, pathlib.Path]) → None

Instantiate an ELF object. A valid ELF must be provided, or an exception will be thrown.


property Elf.checksec

Check the security property of the ELF binary. The following properties are: - Canary - NX - PIE - Fortify - Partial/Full RelRO. Return a dict() with the different keys mentioned above, and the boolean associated whether the protection was found.


property Elf.entry_point


function Elf.is_valid

is_valid(path: pathlib.Path) → bool

function Elf.read

read(size: int) → bytes

function Elf.read_and_unpack

read_and_unpack(fmt: str) → Tuple[Any, ...]

function Elf.seek

seek(off: int) → None

class ElfInfoCommand

Display a limited subset of ELF header information. If no argument is provided, the command will show information about the current ELF being debugged.

function ElfInfoCommand.__init__

__init__() → None

property ElfInfoCommand.settings

Return the list of settings for this command.


function ElfInfoCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function ElfInfoCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function ElfInfoCommand.wrapper

wrapper(*args: Any, **kwargs: Any) → Callable

function ElfInfoCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function ElfInfoCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function ElfInfoCommand.invoke

invoke(args: str, from_tty: bool) → None

function ElfInfoCommand.post_load

post_load() → None

function ElfInfoCommand.pre_load

pre_load() → None

function ElfInfoCommand.usage

usage() → None

class Endianness

An enumeration.


class EntryBreakBreakpoint

Breakpoint used internally to stop execution at the most convenient entry point.

function EntryBreakBreakpoint.__init__

__init__(location: str) → None

function EntryBreakBreakpoint.stop

stop() → bool

class EntryPointBreakCommand

Tries to find best entry point and sets a temporary breakpoint on it. The command will test for well-known symbols for entry points, such as main, _main, __libc_start_main, etc. defined by the setting entrypoint_symbols.

function EntryPointBreakCommand.__init__

__init__() → None

property EntryPointBreakCommand.settings

Return the list of settings for this command.


function EntryPointBreakCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function EntryPointBreakCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function EntryPointBreakCommand.do_invoke

do_invoke(argv: List[str]) → None

function EntryPointBreakCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function EntryPointBreakCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function EntryPointBreakCommand.invoke

invoke(args: str, from_tty: bool) → None

function EntryPointBreakCommand.post_load

post_load() → None

function EntryPointBreakCommand.pre_load

pre_load() → None

function EntryPointBreakCommand.set_init_tbreak

set_init_tbreak(addr: int) → EntryBreakBreakpoint

function EntryPointBreakCommand.set_init_tbreak_pie

set_init_tbreak_pie(addr: int, argv: List[str]) → EntryBreakBreakpoint

function EntryPointBreakCommand.usage

usage() → None

class ExternalStructureManager

function ExternalStructureManager.__init__

__init__() → None

property ExternalStructureManager.modules


property ExternalStructureManager.path


property ExternalStructureManager.structures


handler ExternalStructureManager.find


function ExternalStructureManager.clear_caches

clear_caches() → None

class FileFormat

function FileFormat.__init__

__init__(path: Union[str, pathlib.Path]) → None

function FileFormat.is_valid

is_valid(path: pathlib.Path) → bool

class FileFormatSection


class FlagsCommand

Edit flags in a human friendly way.

function FlagsCommand.__init__

__init__(*args: Any, **kwargs: Any) → None

property FlagsCommand.settings

Return the list of settings for this command.


function FlagsCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function FlagsCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function FlagsCommand.do_invoke

do_invoke(argv: List[str]) → None

function FlagsCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function FlagsCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function FlagsCommand.invoke

invoke(args: str, from_tty: bool) → None

function FlagsCommand.post_load

post_load() → None

function FlagsCommand.pre_load

pre_load() → None

function FlagsCommand.usage

usage() → None

class FormatStringBreakpoint

Inspect stack for format string.

function FormatStringBreakpoint.__init__

__init__(spec: str, num_args: int) → None

function FormatStringBreakpoint.stop

stop() → bool

class FormatStringSearchCommand

Exploitable format-string helper: this command will set up specific breakpoints at well-known dangerous functions (printf, snprintf, etc.), and check if the pointer holding the format string is writable, and therefore susceptible to format string attacks if an attacker can control its content.

function FormatStringSearchCommand.__init__

__init__(*args: Any, **kwargs: Any) → None

property FormatStringSearchCommand.settings

Return the list of settings for this command.


function FormatStringSearchCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function FormatStringSearchCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function FormatStringSearchCommand.do_invoke

do_invoke(_: List[str]) → None

function FormatStringSearchCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function FormatStringSearchCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function FormatStringSearchCommand.invoke

invoke(args: str, from_tty: bool) → None

function FormatStringSearchCommand.post_load

post_load() → None

function FormatStringSearchCommand.pre_load

pre_load() → None

function FormatStringSearchCommand.usage

usage() → None

class GdbRemoveReadlineFinder


function GdbRemoveReadlineFinder.find_module

find_module(fullname, path=None)

function GdbRemoveReadlineFinder.load_module

load_module(fullname)

class Gef

The GEF root class, which serves as a entrypoint for all the debugging session attributes (architecture, memory, settings, etc.).

function Gef.__init__

__init__() → None

function Gef.reinitialize_managers

reinitialize_managers() → None

Reinitialize the managers. Avoid calling this function directly, using pi reset() is preferred


function Gef.reset_caches

reset_caches() → None

Recursively clean the cache of all the managers. Avoid calling this function directly, using reset-cache is preferred


function Gef.setup

setup() → None

Setup initialize the runtime setup, which may require for the gef to be not None.


class GefAlias

Simple aliasing wrapper because GDB doesn't do what it should.

function GefAlias.__init__

__init__(
    alias: str,
    command: str,
    completer_class: int = 0,
    command_class: int = -1
) → None

function GefAlias.invoke

invoke(args: Any, from_tty: bool) → None

function GefAlias.lookup_command

lookup_command(cmd: str) → Optional[Tuple[str, __main__.GenericCommand]]

class GefCommand

GEF main command: view all new commands by typing gef.

function GefCommand.__init__

__init__() → None

property GefCommand.loaded_command_names


property GefCommand.loaded_commands


property GefCommand.loaded_functions


property GefCommand.missing_commands


function GefCommand.add_context_pane

add_context_pane(
    pane_name: str,
    display_pane_function: Callable,
    pane_title_function: Callable,
    condition: Optional[Callable]
) → None

Add a new context pane to ContextCommand.


function GefCommand.invoke

invoke(args: Any, from_tty: bool) → None

function GefCommand.load

load() → None

Load all the commands and functions defined by GEF into GDB.


function GefCommand.load_extra_plugins

load_extra_plugins() → int

function GefCommand.setup

setup() → None

function GefCommand.show_banner

show_banner() → None

class GefConfigCommand

GEF configuration sub-command This command will help set/view GEF settings for the current debugging session. It is possible to make those changes permanent by running gef save (refer to this command help), and/or restore previously saved settings by running gef restore (refer help).

function GefConfigCommand.__init__

__init__() → None

function GefConfigCommand.complete

complete(text: str, word: str) → List[str]

function GefConfigCommand.invoke

invoke(args: str, from_tty: bool) → None

function GefConfigCommand.print_setting

print_setting(plugin_name: str, verbose: bool = False) → None

function GefConfigCommand.print_settings

print_settings() → None

function GefConfigCommand.set_setting

set_setting(argv: Tuple[str, Any]) → None

class GefFunctionsCommand

List the convenience functions provided by GEF.

function GefFunctionsCommand.__init__

__init__() → None

property GefFunctionsCommand.settings

Return the list of settings for this command.


function GefFunctionsCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function GefFunctionsCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function GefFunctionsCommand.do_invoke

do_invoke(argv) → None

function GefFunctionsCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function GefFunctionsCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function GefFunctionsCommand.invoke

invoke(args: str, from_tty: bool) → None

function GefFunctionsCommand.post_load

post_load() → None

function GefFunctionsCommand.pre_load

pre_load() → None

function GefFunctionsCommand.usage

usage() → None

class GefHeapManager

Class managing session heap.

function GefHeapManager.__init__

__init__() → None

property GefHeapManager.arenas


property GefHeapManager.base_address


property GefHeapManager.chunks


property GefHeapManager.main_arena


property GefHeapManager.malloc_alignment


property GefHeapManager.min_chunk_size


property GefHeapManager.selected_arena


handler GefHeapManager.find_main_arena_addr


function GefHeapManager.csize2tidx

csize2tidx(size: int) → int

function GefHeapManager.malloc_align_address

malloc_align_address(address: int) → int

Align addresses according to glibc's MALLOC_ALIGNMENT. See also Issue #689 on Github


function GefHeapManager.reset_caches

reset_caches() → None

function GefHeapManager.tidx2size

tidx2size(idx: int) → int

class GefHelpCommand

GEF help sub-command.

function GefHelpCommand.__init__

__init__() → None

function GefHelpCommand.invoke

invoke(args: Any, from_tty: bool) → None

class GefInstallExtraScriptCommand

gef install command: installs one or more scripts from the gef-extras script repo. Note that the command doesn't check for external dependencies the script(s) might require.

function GefInstallExtraScriptCommand.__init__

__init__() → None

function GefInstallExtraScriptCommand.invoke

invoke(argv: str, from_tty: bool) → None

class GefLibcManager

Class managing everything libc-related (except heap).

function GefLibcManager.__init__

__init__() → None

property GefLibcManager.version


handler GefLibcManager.find_libc_version


function GefLibcManager.reset_caches

reset_caches() → None

Reset the LRU-cached attributes


class GefManager


function GefManager.reset_caches

reset_caches() → None

Reset the LRU-cached attributes


class GefMemoryManager

Class that manages memory access for gef.

function GefMemoryManager.__init__

__init__() → None

property GefMemoryManager.maps


function GefMemoryManager.read

read(addr: int, length: int = 16) → bytes

Return a length long byte array with the copy of the process memory at addr.


function GefMemoryManager.read_ascii_string

read_ascii_string(address: int) → Optional[str]

Read an ASCII string from memory


function GefMemoryManager.read_cstring

read_cstring(
    address: int,
    max_length: int = 50,
    encoding: Optional[str] = None
) → str

Return a C-string read from memory.


function GefMemoryManager.read_integer

read_integer(addr: int) → int

Return an integer read from memory.


function GefMemoryManager.reset_caches

reset_caches() → None

function GefMemoryManager.write

write(address: int, buffer: ByteString, length: int = 16) → None

Write buffer at address address.


class GefMissingCommand

GEF missing sub-command Display the GEF commands that could not be loaded, along with the reason of why they could not be loaded.

function GefMissingCommand.__init__

__init__() → None

function GefMissingCommand.invoke

invoke(args: Any, from_tty: bool) → None

class GefRemoteSessionManager

Class for managing remote sessions with GEF. It will create a temporary environment designed to clone the remote one.

function GefRemoteSessionManager.__init__

__init__(
    host: str,
    port: int,
    pid: int = -1,
    qemu: Optional[pathlib.Path] = None
) → None

property GefRemoteSessionManager.auxiliary_vector


property GefRemoteSessionManager.canary

Return a tuple of the canary address and value, read from the canonical location if supported by the architecture. Otherwise, read from the auxiliary vector.


property GefRemoteSessionManager.cwd


property GefRemoteSessionManager.file

Path to the file being debugged as seen by the remote endpoint.


property GefRemoteSessionManager.lfile

Local path to the file being debugged.


property GefRemoteSessionManager.maps


property GefRemoteSessionManager.original_canary

Return a tuple of the initial canary address and value, read from the auxiliary vector.


property GefRemoteSessionManager.os

Return the current OS.


property GefRemoteSessionManager.pagesize

Get the system page size


property GefRemoteSessionManager.pid

Return the PID of the target process.


property GefRemoteSessionManager.root


property GefRemoteSessionManager.target


function GefRemoteSessionManager.close

close() → None

function GefRemoteSessionManager.connect

connect(pid: int) → bool

Connect to remote target. If in extended mode, also attach to the given PID.


function GefRemoteSessionManager.in_qemu_user

in_qemu_user() → bool

function GefRemoteSessionManager.remote_objfile_event_handler

remote_objfile_event_handler(evt: 'gdb.NewObjFileEvent') → None

function GefRemoteSessionManager.reset_caches

reset_caches() → None

function GefRemoteSessionManager.setup

setup() → bool

function GefRemoteSessionManager.sync

sync(src: str, dst: Optional[str] = None) → bool

Copy the src into the temporary chroot. If dst is provided, that path will be used instead of src.


class GefRestoreCommand

GEF restore sub-command. Loads settings from file '~/.gef.rc' and apply them to the configuration of GEF.

function GefRestoreCommand.__init__

__init__() → None

function GefRestoreCommand.invoke

invoke(args: str, from_tty: bool) → None

function GefRestoreCommand.reload

reload(quiet: bool)

class GefRunCommand

Override GDB run commands with the context from GEF. Simple wrapper for GDB run command to use arguments set from gef set args.

function GefRunCommand.__init__

__init__() → None

function GefRunCommand.invoke

invoke(args: Any, from_tty: bool) → None

class GefSaveCommand

GEF save sub-command. Saves the current configuration of GEF to disk (by default in file '~/.gef.rc').

function GefSaveCommand.__init__

__init__() → None

function GefSaveCommand.invoke

invoke(args: Any, from_tty: bool) → None

class GefSessionManager

Class managing the runtime properties of GEF.

function GefSessionManager.__init__

__init__() → None

property GefSessionManager.auxiliary_vector


property GefSessionManager.canary

Return a tuple of the canary address and value, read from the canonical location if supported by the architecture. Otherwise, read from the auxiliary vector.


property GefSessionManager.cwd


property GefSessionManager.file

Return a Path object of the target process.


property GefSessionManager.maps

Returns the Path to the procfs entry for the memory mapping.


property GefSessionManager.original_canary

Return a tuple of the initial canary address and value, read from the auxiliary vector.


property GefSessionManager.os

Return the current OS.


property GefSessionManager.pagesize

Get the system page size


property GefSessionManager.pid

Return the PID of the target process.


property GefSessionManager.root

Returns the path to the process's root directory.


function GefSessionManager.reset_caches

reset_caches() → None

class GefSetCommand

Override GDB set commands with the context from GEF.

function GefSetCommand.__init__

__init__() → None

function GefSetCommand.invoke

invoke(args: Any, from_tty: bool) → None

class GefSetting

Basic class for storing gef settings as objects

function GefSetting.__init__

__init__(
    value: Any,
    cls: Optional[type] = None,
    description: Optional[str] = None,
    hooks: Optional[Dict[str, Callable]] = None
) → None

class GefSettingsManager

GefSettings acts as a dict where the global settings are stored and can be read, written or deleted as any other dict. For instance, to read a specific command setting: gef.config[mycommand.mysetting]


function GefSettingsManager.raw_entry

raw_entry(name: str) → GefSetting

class GefThemeCommand

Customize GEF appearance.

function GefThemeCommand.__init__

__init__() → None

property GefThemeCommand.settings

Return the list of settings for this command.


function GefThemeCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function GefThemeCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function GefThemeCommand.do_invoke

do_invoke(args: List[str]) → None

function GefThemeCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function GefThemeCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function GefThemeCommand.invoke

invoke(args: str, from_tty: bool) → None

function GefThemeCommand.post_load

post_load() → None

function GefThemeCommand.pre_load

pre_load() → None

function GefThemeCommand.usage

usage() → None

class GefTmuxSetup

Setup a confortable tmux debugging environment.

function GefTmuxSetup.__init__

__init__() → None

function GefTmuxSetup.invoke

invoke(args: Any, from_tty: bool) → None

function GefTmuxSetup.screen_setup

screen_setup() → None

Hackish equivalent of the tmux_setup() function for screen.


function GefTmuxSetup.tmux_setup

tmux_setup() → None

Prepare the tmux environment by vertically splitting the current pane, and forcing the context to be redirected there.


class GefUiManager

Class managing UI settings.

function GefUiManager.__init__

__init__() → None

function GefUiManager.reset_caches

reset_caches() → None

Reset the LRU-cached attributes


class GenericArchitecture


property GenericArchitecture.endianness


property GenericArchitecture.fp


property GenericArchitecture.pc


property GenericArchitecture.ptrsize


property GenericArchitecture.registers


property GenericArchitecture.sp


function GenericArchitecture.canary_address

canary_address() → int

function GenericArchitecture.flag_register_to_human

flag_register_to_human(val: Optional[int] = None) → str

function GenericArchitecture.get_ith_parameter

get_ith_parameter(i: int, in_func: bool = True) → Tuple[str, Optional[int]]

Retrieves the correct parameter used for the current function call.


function GenericArchitecture.get_ra

get_ra(insn: __main__.Instruction, frame: 'gdb.Frame') → Optional[int]

function GenericArchitecture.is_branch_taken

is_branch_taken(insn: __main__.Instruction) → Tuple[bool, str]

function GenericArchitecture.is_call

is_call(insn: __main__.Instruction) → bool

function GenericArchitecture.is_conditional_branch

is_conditional_branch(insn: __main__.Instruction) → bool

function GenericArchitecture.is_ret

is_ret(insn: __main__.Instruction) → bool

function GenericArchitecture.mprotect_asm

mprotect_asm(addr: int, size: int, perm: __main__.Permission) → str

function GenericArchitecture.register

register(name: str) → int

function GenericArchitecture.reset_caches

reset_caches() → None

function GenericArchitecture.supports_gdb_arch

supports_gdb_arch(gdb_arch: str) → Optional[bool]

If implemented by a child Architecture, this function dictates if the current class supports the loaded ELF file (which can be accessed via gef.binary). This callback function will override any assumption made by GEF to determine the architecture.


class GenericCommand

This is an abstract class for invoking commands, should not be instantiated.

function GenericCommand.__init__

__init__(*args: Any, **kwargs: Any) → None

property GenericCommand.settings

Return the list of settings for this command.


function GenericCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function GenericCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function GenericCommand.do_invoke

do_invoke(argv: List[str]) → None

function GenericCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function GenericCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function GenericCommand.invoke

invoke(args: str, from_tty: bool) → None

function GenericCommand.post_load

post_load() → None

function GenericCommand.pre_load

pre_load() → None

function GenericCommand.usage

usage() → None

class GenericFunction

This is an abstract class for invoking convenience functions, should not be instantiated.

function GenericFunction.__init__

__init__() → None

function GenericFunction.arg_to_long

arg_to_long(args: List, index: int, default: int = 0) → int

function GenericFunction.do_invoke

do_invoke(args: Any) → int

function GenericFunction.invoke

invoke(*args: Any) → int

class GlibcArena

Glibc arena class

function GlibcArena.__init__

__init__(addr: str) → None

property GlibcArena.addr


property GlibcArena.address


property GlibcArena.attached_threads


property GlibcArena.binmap


property GlibcArena.bins


property GlibcArena.fastbinsY


property GlibcArena.last_remainder


property GlibcArena.max_system_mem


property GlibcArena.next


property GlibcArena.next_free


property GlibcArena.sizeof


property GlibcArena.system_mem


property GlibcArena.top


function GlibcArena.bin

bin(i: int) → Tuple[int, int]

function GlibcArena.bin_at

bin_at(i) → int

function GlibcArena.fastbin

fastbin(i: int) → Optional[ForwardRef('GlibcFastChunk')]

Return head chunk in fastbinsY[i].


function GlibcArena.get_heap_for_ptr

get_heap_for_ptr(ptr: int) → int

Find the corresponding heap for a given pointer (int). See https://github.com/bminor/glibc/blob/glibc-2.34/malloc/arena.c#L129


function GlibcArena.get_heap_info_list

get_heap_info_list() → Optional[List[__main__.GlibcHeapInfo]]

function GlibcArena.heap_addr

heap_addr(allow_unaligned: bool = False) → Optional[int]

function GlibcArena.is_main_arena

is_main_arena() → bool

function GlibcArena.malloc_state_t

malloc_state_t() → Type[_ctypes.Structure]

function GlibcArena.reset

reset()

function GlibcArena.verify

verify(addr: int) → bool

Verify that the address matches a possible valid GlibcArena


class GlibcChunk

Glibc chunk class. The default behavior (from_base=False) is to interpret the data starting at the memory address pointed to as the chunk data. Setting from_base to True instead treats that data as the chunk header. Ref: https://sploitfun.wordpress.com/2015/02/10/understanding-glibc-malloc/.

function GlibcChunk.__init__

__init__(
    addr: int,
    from_base: bool = False,
    allow_unaligned: bool = True
) → None

property GlibcChunk.bk


property GlibcChunk.bk_nextsize


property GlibcChunk.fd


property GlibcChunk.fd_nextsize


property GlibcChunk.flags


property GlibcChunk.prev_size


property GlibcChunk.size


property GlibcChunk.usable_size


function GlibcChunk.get_next_chunk

get_next_chunk(allow_unaligned: bool = False) → GlibcChunk

function GlibcChunk.get_next_chunk_addr

get_next_chunk_addr() → int

function GlibcChunk.get_prev_chunk_size

get_prev_chunk_size() → int

function GlibcChunk.get_usable_size

get_usable_size() → int

function GlibcChunk.has_m_bit

has_m_bit() → bool

function GlibcChunk.has_n_bit

has_n_bit() → bool

function GlibcChunk.has_p_bit

has_p_bit() → bool

function GlibcChunk.is_used

is_used() → bool

Check if the current block is used by: - checking the M bit is true - or checking that next chunk PREV_INUSE flag is true


function GlibcChunk.malloc_chunk_t

malloc_chunk_t() → Type[_ctypes.Structure]

function GlibcChunk.psprint

psprint() → str

function GlibcChunk.reset

reset()

class GlibcFastChunk

function GlibcFastChunk.__init__

__init__(
    addr: int,
    from_base: bool = False,
    allow_unaligned: bool = True
) → None

property GlibcFastChunk.bk


property GlibcFastChunk.bk_nextsize


property GlibcFastChunk.fd


property GlibcFastChunk.fd_nextsize


property GlibcFastChunk.flags


property GlibcFastChunk.prev_size


property GlibcFastChunk.size


property GlibcFastChunk.usable_size


function GlibcFastChunk.get_next_chunk

get_next_chunk(allow_unaligned: bool = False) → GlibcChunk

function GlibcFastChunk.get_next_chunk_addr

get_next_chunk_addr() → int

function GlibcFastChunk.get_prev_chunk_size

get_prev_chunk_size() → int

function GlibcFastChunk.get_usable_size

get_usable_size() → int

function GlibcFastChunk.has_m_bit

has_m_bit() → bool

function GlibcFastChunk.has_n_bit

has_n_bit() → bool

function GlibcFastChunk.has_p_bit

has_p_bit() → bool

function GlibcFastChunk.is_used

is_used() → bool

Check if the current block is used by: - checking the M bit is true - or checking that next chunk PREV_INUSE flag is true


function GlibcFastChunk.malloc_chunk_t

malloc_chunk_t() → Type[_ctypes.Structure]

function GlibcFastChunk.protect_ptr

protect_ptr(pos: int, pointer: int) → int

https://elixir.bootlin.com/glibc/glibc-2.32/source/malloc/malloc.c#L339


function GlibcFastChunk.psprint

psprint() → str

function GlibcFastChunk.reset

reset()

function GlibcFastChunk.reveal_ptr

reveal_ptr(pointer: int) → int

https://elixir.bootlin.com/glibc/glibc-2.32/source/malloc/malloc.c#L341


class GlibcHeapArenaCommand

Display information on a heap chunk.

function GlibcHeapArenaCommand.__init__

__init__(*args: Any, **kwargs: Any) → None

property GlibcHeapArenaCommand.settings

Return the list of settings for this command.


function GlibcHeapArenaCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function GlibcHeapArenaCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function GlibcHeapArenaCommand.do_invoke

do_invoke(_: List[str]) → None

function GlibcHeapArenaCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function GlibcHeapArenaCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function GlibcHeapArenaCommand.invoke

invoke(args: str, from_tty: bool) → None

function GlibcHeapArenaCommand.post_load

post_load() → None

function GlibcHeapArenaCommand.pre_load

pre_load() → None

function GlibcHeapArenaCommand.usage

usage() → None

class GlibcHeapBinsCommand

Display information on the bins on an arena (default: main_arena). See https://github.com/sploitfun/lsploits/blob/master/glibc/malloc/malloc.c#L1123.

function GlibcHeapBinsCommand.__init__

__init__() → None

property GlibcHeapBinsCommand.settings

Return the list of settings for this command.


function GlibcHeapBinsCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function GlibcHeapBinsCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function GlibcHeapBinsCommand.do_invoke

do_invoke(argv: List[str]) → None

function GlibcHeapBinsCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function GlibcHeapBinsCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function GlibcHeapBinsCommand.invoke

invoke(args: str, from_tty: bool) → None

function GlibcHeapBinsCommand.post_load

post_load() → None

function GlibcHeapBinsCommand.pprint_bin

pprint_bin(arena_addr: str, index: int, _type: str = '') → int

function GlibcHeapBinsCommand.pre_load

pre_load() → None

function GlibcHeapBinsCommand.usage

usage() → None

class GlibcHeapChunkCommand

Display information on a heap chunk. See https://github.com/sploitfun/lsploits/blob/master/glibc/malloc/malloc.c#L1123.

function GlibcHeapChunkCommand.__init__

__init__() → None

property GlibcHeapChunkCommand.settings

Return the list of settings for this command.


function GlibcHeapChunkCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function GlibcHeapChunkCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function GlibcHeapChunkCommand.wrapper

wrapper(*args: Any, **kwargs: Any) → Callable

function GlibcHeapChunkCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function GlibcHeapChunkCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function GlibcHeapChunkCommand.invoke

invoke(args: str, from_tty: bool) → None

function GlibcHeapChunkCommand.post_load

post_load() → None

function GlibcHeapChunkCommand.pre_load

pre_load() → None

function GlibcHeapChunkCommand.usage

usage() → None

class GlibcHeapChunksCommand

Display all heap chunks for the current arena. As an optional argument the base address of a different arena can be passed

function GlibcHeapChunksCommand.__init__

__init__() → None

property GlibcHeapChunksCommand.settings

Return the list of settings for this command.


function GlibcHeapChunksCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function GlibcHeapChunksCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function GlibcHeapChunksCommand.wrapper

wrapper(*args: Any, **kwargs: Any) → Callable

function GlibcHeapChunksCommand.dump_chunks_arena

dump_chunks_arena(
    arena: __main__.GlibcArena,
    print_arena: bool = False,
    allow_unaligned: bool = False
) → None

function GlibcHeapChunksCommand.dump_chunks_heap

dump_chunks_heap(
    start: int,
    end: int,
    arena: __main__.GlibcArena,
    allow_unaligned: bool = False
) → bool

function GlibcHeapChunksCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function GlibcHeapChunksCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function GlibcHeapChunksCommand.invoke

invoke(args: str, from_tty: bool) → None

function GlibcHeapChunksCommand.post_load

post_load() → None

function GlibcHeapChunksCommand.pre_load

pre_load() → None

function GlibcHeapChunksCommand.usage

usage() → None

class GlibcHeapCommand

Base command to get information about the Glibc heap structure.

function GlibcHeapCommand.__init__

__init__() → None

property GlibcHeapCommand.settings

Return the list of settings for this command.


function GlibcHeapCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function GlibcHeapCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function GlibcHeapCommand.do_invoke

do_invoke(_: List[str]) → None

function GlibcHeapCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function GlibcHeapCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function GlibcHeapCommand.invoke

invoke(args: str, from_tty: bool) → None

function GlibcHeapCommand.post_load

post_load() → None

function GlibcHeapCommand.pre_load

pre_load() → None

function GlibcHeapCommand.usage

usage() → None

class GlibcHeapFastbinsYCommand

Display information on the fastbinsY on an arena (default: main_arena). See https://github.com/sploitfun/lsploits/blob/master/glibc/malloc/malloc.c#L1123.

function GlibcHeapFastbinsYCommand.__init__

__init__() → None

property GlibcHeapFastbinsYCommand.settings

Return the list of settings for this command.


function GlibcHeapFastbinsYCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function GlibcHeapFastbinsYCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function GlibcHeapFastbinsYCommand.wrapper

wrapper(*args: Any, **kwargs: Any) → Callable

function GlibcHeapFastbinsYCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function GlibcHeapFastbinsYCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function GlibcHeapFastbinsYCommand.invoke

invoke(args: str, from_tty: bool) → None

function GlibcHeapFastbinsYCommand.post_load

post_load() → None

function GlibcHeapFastbinsYCommand.pre_load

pre_load() → None

function GlibcHeapFastbinsYCommand.usage

usage() → None

class GlibcHeapInfo

Glibc heap_info struct

function GlibcHeapInfo.__init__

__init__(addr: Union[str, int]) → None

property GlibcHeapInfo.addr


property GlibcHeapInfo.address


property GlibcHeapInfo.heap_end


property GlibcHeapInfo.heap_start


property GlibcHeapInfo.sizeof


function GlibcHeapInfo.heap_info_t

heap_info_t() → Type[_ctypes.Structure]

function GlibcHeapInfo.reset

reset()

class GlibcHeapLargeBinsCommand

Convenience command for viewing large bins.

function GlibcHeapLargeBinsCommand.__init__

__init__() → None

property GlibcHeapLargeBinsCommand.settings

Return the list of settings for this command.


function GlibcHeapLargeBinsCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function GlibcHeapLargeBinsCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function GlibcHeapLargeBinsCommand.wrapper

wrapper(*args: Any, **kwargs: Any) → Callable

function GlibcHeapLargeBinsCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function GlibcHeapLargeBinsCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function GlibcHeapLargeBinsCommand.invoke

invoke(args: str, from_tty: bool) → None

function GlibcHeapLargeBinsCommand.post_load

post_load() → None

function GlibcHeapLargeBinsCommand.pre_load

pre_load() → None

function GlibcHeapLargeBinsCommand.usage

usage() → None

class GlibcHeapSetArenaCommand

Set the address of the main_arena or the currently selected arena.

function GlibcHeapSetArenaCommand.__init__

__init__() → None

property GlibcHeapSetArenaCommand.settings

Return the list of settings for this command.


function GlibcHeapSetArenaCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function GlibcHeapSetArenaCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function GlibcHeapSetArenaCommand.wrapper

wrapper(*args: Any, **kwargs: Any) → Callable

function GlibcHeapSetArenaCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function GlibcHeapSetArenaCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function GlibcHeapSetArenaCommand.invoke

invoke(args: str, from_tty: bool) → None

function GlibcHeapSetArenaCommand.post_load

post_load() → None

function GlibcHeapSetArenaCommand.pre_load

pre_load() → None

function GlibcHeapSetArenaCommand.usage

usage() → None

class GlibcHeapSmallBinsCommand

Convenience command for viewing small bins.

function GlibcHeapSmallBinsCommand.__init__

__init__() → None

property GlibcHeapSmallBinsCommand.settings

Return the list of settings for this command.


function GlibcHeapSmallBinsCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function GlibcHeapSmallBinsCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function GlibcHeapSmallBinsCommand.wrapper

wrapper(*args: Any, **kwargs: Any) → Callable

function GlibcHeapSmallBinsCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function GlibcHeapSmallBinsCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function GlibcHeapSmallBinsCommand.invoke

invoke(args: str, from_tty: bool) → None

function GlibcHeapSmallBinsCommand.post_load

post_load() → None

function GlibcHeapSmallBinsCommand.pre_load

pre_load() → None

function GlibcHeapSmallBinsCommand.usage

usage() → None

class GlibcHeapTcachebinsCommand

Display information on the Tcachebins on an arena (default: main_arena). See https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=d5c3fafc4307c9b7a4c7d5cb381fcdbfad340bcc.

function GlibcHeapTcachebinsCommand.__init__

__init__() → None

property GlibcHeapTcachebinsCommand.settings

Return the list of settings for this command.


function GlibcHeapTcachebinsCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function GlibcHeapTcachebinsCommand.check_thread_ids

check_thread_ids(tids: List[int]) → List[int]

Check the validity, dedup, and return all valid tids.


function GlibcHeapTcachebinsCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function GlibcHeapTcachebinsCommand.do_invoke

do_invoke(argv: List[str]) → None

function GlibcHeapTcachebinsCommand.find_tcache

find_tcache() → int

Return the location of the current thread's tcache.


function GlibcHeapTcachebinsCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function GlibcHeapTcachebinsCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function GlibcHeapTcachebinsCommand.invoke

invoke(args: str, from_tty: bool) → None

function GlibcHeapTcachebinsCommand.post_load

post_load() → None

function GlibcHeapTcachebinsCommand.pre_load

pre_load() → None

function GlibcHeapTcachebinsCommand.tcachebin

tcachebin(
    tcache_base: int,
    i: int
) → Tuple[Optional[__main__.GlibcTcacheChunk], int]

Return the head chunk in tcache[i] and the number of chunks in the bin.


function GlibcHeapTcachebinsCommand.usage

usage() → None

class GlibcHeapUnsortedBinsCommand

Display information on the Unsorted Bins of an arena (default: main_arena). See: https://github.com/sploitfun/lsploits/blob/master/glibc/malloc/malloc.c#L1689.

function GlibcHeapUnsortedBinsCommand.__init__

__init__() → None

property GlibcHeapUnsortedBinsCommand.settings

Return the list of settings for this command.


function GlibcHeapUnsortedBinsCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function GlibcHeapUnsortedBinsCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function GlibcHeapUnsortedBinsCommand.wrapper

wrapper(*args: Any, **kwargs: Any) → Callable

function GlibcHeapUnsortedBinsCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function GlibcHeapUnsortedBinsCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function GlibcHeapUnsortedBinsCommand.invoke

invoke(args: str, from_tty: bool) → None

function GlibcHeapUnsortedBinsCommand.post_load

post_load() → None

function GlibcHeapUnsortedBinsCommand.pre_load

pre_load() → None

function GlibcHeapUnsortedBinsCommand.usage

usage() → None

class GlibcTcacheChunk

function GlibcTcacheChunk.__init__

__init__(
    addr: int,
    from_base: bool = False,
    allow_unaligned: bool = True
) → None

property GlibcTcacheChunk.bk


property GlibcTcacheChunk.bk_nextsize


property GlibcTcacheChunk.fd


property GlibcTcacheChunk.fd_nextsize


property GlibcTcacheChunk.flags


property GlibcTcacheChunk.prev_size


property GlibcTcacheChunk.size


property GlibcTcacheChunk.usable_size


function GlibcTcacheChunk.get_next_chunk

get_next_chunk(allow_unaligned: bool = False) → GlibcChunk

function GlibcTcacheChunk.get_next_chunk_addr

get_next_chunk_addr() → int

function GlibcTcacheChunk.get_prev_chunk_size

get_prev_chunk_size() → int

function GlibcTcacheChunk.get_usable_size

get_usable_size() → int

function GlibcTcacheChunk.has_m_bit

has_m_bit() → bool

function GlibcTcacheChunk.has_n_bit

has_n_bit() → bool

function GlibcTcacheChunk.has_p_bit

has_p_bit() → bool

function GlibcTcacheChunk.is_used

is_used() → bool

Check if the current block is used by: - checking the M bit is true - or checking that next chunk PREV_INUSE flag is true


function GlibcTcacheChunk.malloc_chunk_t

malloc_chunk_t() → Type[_ctypes.Structure]

function GlibcTcacheChunk.protect_ptr

protect_ptr(pos: int, pointer: int) → int

https://elixir.bootlin.com/glibc/glibc-2.32/source/malloc/malloc.c#L339


function GlibcTcacheChunk.psprint

psprint() → str

function GlibcTcacheChunk.reset

reset()

function GlibcTcacheChunk.reveal_ptr

reveal_ptr(pointer: int) → int

https://elixir.bootlin.com/glibc/glibc-2.32/source/malloc/malloc.c#L341


class GotBaseFunction

Return the current GOT base address plus the given offset.

function GotBaseFunction.__init__

__init__() → None

function GotBaseFunction.arg_to_long

arg_to_long(args: List, index: int, default: int = 0) → int

function GotBaseFunction.do_invoke

do_invoke(args: List) → int

function GotBaseFunction.invoke

invoke(*args: Any) → int

class GotCommand

Display current status of the got inside the process.

function GotCommand.__init__

__init__()

property GotCommand.settings

Return the list of settings for this command.


function GotCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function GotCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function GotCommand.do_invoke

do_invoke(argv: List[str]) → None

function GotCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function GotCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function GotCommand.invoke

invoke(args: str, from_tty: bool) → None

function GotCommand.post_load

post_load() → None

function GotCommand.pre_load

pre_load() → None

function GotCommand.usage

usage() → None

class HeapAnalysisCommand

Heap vulnerability analysis helper: this command aims to track dynamic heap allocation done through malloc()/free() to provide some insights on possible heap vulnerabilities. The following vulnerabilities are checked: - NULL free - Use-after-Free - Double Free - Heap overlap

function HeapAnalysisCommand.__init__

__init__() → None

property HeapAnalysisCommand.settings

Return the list of settings for this command.


function HeapAnalysisCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function HeapAnalysisCommand.clean

clean(_: 'gdb.Event') → None

function HeapAnalysisCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function HeapAnalysisCommand.do_invoke

do_invoke(argv: List[str]) → None

function HeapAnalysisCommand.dump_tracked_allocations

dump_tracked_allocations() → None

function HeapAnalysisCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function HeapAnalysisCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function HeapAnalysisCommand.invoke

invoke(args: str, from_tty: bool) → None

function HeapAnalysisCommand.post_load

post_load() → None

function HeapAnalysisCommand.pre_load

pre_load() → None

function HeapAnalysisCommand.setup

setup() → None

function HeapAnalysisCommand.usage

usage() → None

class HeapBaseFunction

Return the current heap base address plus an optional offset.

function HeapBaseFunction.__init__

__init__() → None

function HeapBaseFunction.arg_to_long

arg_to_long(args: List, index: int, default: int = 0) → int

function HeapBaseFunction.do_invoke

do_invoke(args: List) → int

function HeapBaseFunction.invoke

invoke(*args: Any) → int

class HexdumpByteCommand

Display SIZE lines of hexdump as BYTE from the memory location pointed by ADDRESS.

function HexdumpByteCommand.__init__

__init__() → None

property HexdumpByteCommand.settings

Return the list of settings for this command.


function HexdumpByteCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function HexdumpByteCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function HexdumpByteCommand.wrapper

wrapper(*args: Any, **kwargs: Any) → Callable

function HexdumpByteCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function HexdumpByteCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function HexdumpByteCommand.invoke

invoke(args: str, from_tty: bool) → None

function HexdumpByteCommand.post_load

post_load() → None

function HexdumpByteCommand.pre_load

pre_load() → None

function HexdumpByteCommand.usage

usage() → None

class HexdumpCommand

Display SIZE lines of hexdump from the memory location pointed by LOCATION.

function HexdumpCommand.__init__

__init__() → None

property HexdumpCommand.settings

Return the list of settings for this command.


function HexdumpCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function HexdumpCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function HexdumpCommand.wrapper

wrapper(*args: Any, **kwargs: Any) → Callable

function HexdumpCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function HexdumpCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function HexdumpCommand.invoke

invoke(args: str, from_tty: bool) → None

function HexdumpCommand.post_load

post_load() → None

function HexdumpCommand.pre_load

pre_load() → None

function HexdumpCommand.usage

usage() → None

class HexdumpDwordCommand

Display SIZE lines of hexdump as DWORD from the memory location pointed by ADDRESS.

function HexdumpDwordCommand.__init__

__init__() → None

property HexdumpDwordCommand.settings

Return the list of settings for this command.


function HexdumpDwordCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function HexdumpDwordCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function HexdumpDwordCommand.wrapper

wrapper(*args: Any, **kwargs: Any) → Callable

function HexdumpDwordCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function HexdumpDwordCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function HexdumpDwordCommand.invoke

invoke(args: str, from_tty: bool) → None

function HexdumpDwordCommand.post_load

post_load() → None

function HexdumpDwordCommand.pre_load

pre_load() → None

function HexdumpDwordCommand.usage

usage() → None

class HexdumpQwordCommand

Display SIZE lines of hexdump as QWORD from the memory location pointed by ADDRESS.

function HexdumpQwordCommand.__init__

__init__() → None

property HexdumpQwordCommand.settings

Return the list of settings for this command.


function HexdumpQwordCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function HexdumpQwordCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function HexdumpQwordCommand.wrapper

wrapper(*args: Any, **kwargs: Any) → Callable

function HexdumpQwordCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function HexdumpQwordCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function HexdumpQwordCommand.invoke

invoke(args: str, from_tty: bool) → None

function HexdumpQwordCommand.post_load

post_load() → None

function HexdumpQwordCommand.pre_load

pre_load() → None

function HexdumpQwordCommand.usage

usage() → None

class HexdumpWordCommand

Display SIZE lines of hexdump as WORD from the memory location pointed by ADDRESS.

function HexdumpWordCommand.__init__

__init__() → None

property HexdumpWordCommand.settings

Return the list of settings for this command.


function HexdumpWordCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function HexdumpWordCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function HexdumpWordCommand.wrapper

wrapper(*args: Any, **kwargs: Any) → Callable

function HexdumpWordCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function HexdumpWordCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function HexdumpWordCommand.invoke

invoke(args: str, from_tty: bool) → None

function HexdumpWordCommand.post_load

post_load() → None

function HexdumpWordCommand.pre_load

pre_load() → None

function HexdumpWordCommand.usage

usage() → None

class HighlightAddCommand

Add a match to the highlight table.

function HighlightAddCommand.__init__

__init__(*args: Any, **kwargs: Any) → None

property HighlightAddCommand.settings

Return the list of settings for this command.


function HighlightAddCommand.add_setting

add_setting(
    name: str,
    value: Tuple[Any, type, str],
    description: str = ''
) → None

add_setting is DEPRECATED and will be removed in the future. Use self[setting_name] = value instead


function HighlightAddCommand.del_setting

del_setting(name: str) → None

del_setting is DEPRECATED and will be removed in the future. Use del self[setting_name] instead


function HighlightAddCommand.do_invoke

do_invoke(argv: List[str]) → None

function HighlightAddCommand.get_setting

get_setting(name: str) → Any

get_setting is DEPRECATED and will be removed in the future. Use self[setting_name] instead


function HighlightAddCommand.has_setting

has_setting(name: str) → bool

has_setting is DEPRECATED and will be removed in the future. Use setting_name in self instead


function HighlightAddCommand.invoke

invoke(args: str, from_tty: bool) → None

function HighlightAddCommand.post_load

post_load() → None

function HighlightAddCommand.pre_load

pre_load() → None

function HighlightAddCommand.usage

usage() → None

class HighlightClearCommand

Clear the highlight table, remove all matches.

function HighlightClearCommand.__init__

__init__(*args: Any, **kwargs: Any) → Non