GEF Base Command
Displays a list of GEF commands and their descriptions.
gef➤ gef ─────────────────────────────────── GEF - GDB Enhanced Features ─────────────────────────────────── $ -- SmartEval: Smart eval (vague approach to mimic WinDBG `?`). aslr -- View/modify the ASLR setting of GDB. By default, GDB will disable ASLR when it starts the process. (i.e. not attached). This command allows to change that setting. assemble -- Inline code assemble. Architecture can be set in GEF runtime config (default x86-32). (alias: asm) bincompare -- BincompareCommand: compare an binary file with the memory position looking for badchars. bytearray -- BytearrayCommand: Generate a bytearray to be compared with possible badchars. [...snip...]
GEF Missing Command
GEF is fully battery-included. However in some rare cases, it is possible that not all commands be
loaded. If that's the case the command
gef missing will detail which command failed to load, along
with a (likely) reason. Read the documentation for a solution, or reach out on the Discord.
gef➤ gef missing [*] Command `XXXX` is missing, reason → YYYYY.
GEF Config Command
Allows the user to set/view settings for the current debugging session. For making the changes
persistent see the
gef save entry.
gef config by itself just shows all of the available settings and their values.
gef➤ gef config ──────────────────────────────────── GEF configuration settings ──────────────────────────────────── context.clear_screen (bool) = False context.enable (bool) = True context.grow_stack_down (bool) = False context.ignore_registers (str) = "" context.layout (str) = "-code -stack" context.libc_args (bool) = False [...snip...]
To filter the config settings you can use
gef config [setting].
gef➤ gef config theme ─────────────────────────── GEF configuration settings matching 'theme' ─────────────────────────── theme.context_title_line (str) = "gray" theme.context_title_message (str) = "cyan" theme.default_title_line (str) = "gray" theme.default_title_message (str) = "cyan" [...snip...]
You can use
gef config [setting] [value] to set a setting for the current session (see example
gef➤ gef config theme.address_stack blue
GEF Save Command
gef save command saves the current settings (set with
gef config) to the user's
file (making the changes persistent).
gef➤ gef save [+] Configuration saved to '/home/michael/.gef.rc'
GEF Restore Command
gef restore loads and applies settings from the
~/.gef.rc file to the current session.
This is useful if you are modifying your GEF configuration file and want to see the changes without
completely reloading GEF.
gef➤ gef restore [+] Configuration from '/home/michael/.gef.rc' restored
GEF Set Command
The GEF set command allows the user to use GEF context within GDB set commands. This is useful when you want to make a convenient variable which can be set and referenced later.
gef➤ gef set $a=1
GEF Run Command
The GEF run command is a wrapper around GDB's run command, allowing the user to use GEF context within the command.
gef➤ gef run ./binary
GEF Install Command
gef install allows to install one (or more) specific script(s) from
gef-extras. The new scripts
will be downloaded and sourced to be used immediately after by GEF. The syntax is straight forward:
gef➤ gef install SCRIPTNAME1 [SCRIPTNAME2...]
SCRIPTNAME1 ... are the names of script from the
gef➤ gef install remote windbg stack [+] Searching for 'remote.py' in `gef-extras@main`... [+] Installed file '/tmp/gef/remote.py', new command(s) available: `rpyc-remote` [+] Searching for 'windbg.py' in `gef-extras@main`... [+] Installed file '/tmp/gef/windbg.py', new command(s) available: `pt`, `hh`, `tt`, `ptc`, `sxe`, `u`, `xs`, `tc`, `pc`, `g`, `r` [+] Searching for 'stack.py' in `gef-extras@main`... [+] Installed file '/tmp/gef/stack.py', new command(s) available: `current-stack-frame` gef➤
This makes it easier to deploy new functionalities in limited environment. By default, the command
looks up for script names in the
main branch of
gef-extras. However you can change specify a
different branch through the
gef.default_branch configuration setting:
gef➤ gef config gef.default_branch my_other_branch
The files will be dowloaded in the path configured in the
gef.extra_plugins_dir setting, allowing
to reload it easily without having to re-download.