gef
Command gef
GEF Base Command
Displays a list of GEF commands and their descriptions.
gef➤ gef
─────────────────────────────────── GEF - GDB Enhanced Features ───────────────────────────────────
$ -- SmartEval: Smart eval (vague approach to mimic WinDBG `?`).
aslr -- View/modify the ASLR setting of GDB. By default, GDB will disable ASLR when it starts the process. (i.e. not
attached). This command allows to change that setting.
assemble -- Inline code assemble. Architecture can be set in GEF runtime config (default x86-32). (alias: asm)
bincompare -- BincompareCommand: compare an binary file with the memory position looking for badchars.
bytearray -- BytearrayCommand: Generate a bytearray to be compared with possible badchars.
[...snip...]
GEF Missing Command
GEF is fully battery-included. However in some rare cases, it is possible that not all commands be loaded. If that's the case the command gef missing
will detail which command failed to load, along with a (likely) reason. Read the documentation for a solution, or reach out on the Discord.
gef➤ gef missing
[*] Command `XXXX` is missing, reason → YYYYY.
GEF Config Command
Allows the user to set/view settings for the current debugging session. For
making the changes persistent see the gef save
entry.
Using gef config
by itself just shows all of the available settings and their
values.
gef➤ gef config
──────────────────────────────────── GEF configuration settings ────────────────────────────────────
context.clear_screen (bool) = False
context.enable (bool) = True
context.grow_stack_down (bool) = False
context.ignore_registers (str) = ""
context.layout (str) = "-code -stack"
context.libc_args (bool) = False
[...snip...]
To filter the config settings you can use gef config [setting]
.
gef➤ gef config theme
─────────────────────────── GEF configuration settings matching 'theme' ───────────────────────────
theme.context_title_line (str) = "gray"
theme.context_title_message (str) = "cyan"
theme.default_title_line (str) = "gray"
theme.default_title_message (str) = "cyan"
[...snip...]
You can use gef config [setting] [value]
to set a setting for the current
session (see example below).
gef➤ gef config theme.address_stack blue
GEF Save Command
The gef save
command saves the current settings (set with gef config
) to
the user's ~/.gef.rc
file (making the changes persistent).
gef➤ gef save
[+] Configuration saved to '/home/michael/.gef.rc'
GEF Restore Command
Using gef restore
loads and applies settings from the ~/.gef.rc
file to the
current session. This is useful if you are modifying your GEF configuration
file and want to see the changes without completely reloading GEF.
gef➤ gef restore
[+] Configuration from '/home/michael/.gef.rc' restored
GEF Set Command
The GEF set command allows the user to use GEF context within GDB set commands. This is useful when you want to make a convenient variable which can be set and referenced later.
gef➤ gef set $a=1
GEF Run Command
The GEF run command is a wrapper around GDB's run command, allowing the user to use GEF context within the command.
gef➤ gef run ./binary
GEF Install Command
gef install
allows to install one (or more) specific script(s) from gef-extras
. The new scripts will be downloaded and sourced to be used immediately after by GEF. The syntax is straight forward:
gef➤ gef install SCRIPTNAME1 [SCRIPTNAME2...]
Where SCRIPTNAME1
... are the names of script from the gef-extras
repository.
gef➤ gef install remote windbg stack
[+] Searching for 'remote.py' in `gef-extras@main`...
[+] Installed file '/tmp/gef/remote.py', new command(s) available: `rpyc-remote`
[+] Searching for 'windbg.py' in `gef-extras@main`...
[+] Installed file '/tmp/gef/windbg.py', new command(s) available: `pt`, `hh`, `tt`, `ptc`, `sxe`, `u`, `xs`, `tc`, `pc`, `g`, `r`
[+] Searching for 'stack.py' in `gef-extras@main`...
[+] Installed file '/tmp/gef/stack.py', new command(s) available: `current-stack-frame`
gef➤
This makes it easier to deploy new functionalities in limited environment. By default, the command looks up for script names in the main
branch of gef-extras
. However you can change specify a different branch through the gef.default_branch
configuration setting:
gef➤ gef config gef.default_branch dev
The files will be dowloaded in the path configured in the gef.extra_plugins_dir
setting, allowing to reload it easily without having to re-download.