In preparation for the OSCE, I recently started working on the SLAE (SecurityTube Linux Assembly Expert) and have thrown together some of my notes on using the gdb debugger in Linux.

In order to avoid having to type “set disassembly-flavor intel” each time you launch gdb, add it to the gdbinit file

slae@slae:~$ cat /etc/gdb/gdbinit
# System-wide GDB initialization file.
set disassembly-flavor intel

Run a shell command within gdb

(gdb) shell whoami
slae
(gdb)

View contents of common registers, and view the contents of ALL registers

(gdb) info registers 
(gdb) info all-registers 

View the functions available within a program

(gdb) info functions

Define a hook-stop (kind of a “macro” that runs every time execution is paused)

(gdb) define hook-stop
Type commands for definition of "hook-stop".
End with a line saying just "end".
>print/x $eax ;print the contents of eax
>print/x $ebx ;print the contents of ebx
>some other command would go here
>end
(gdb)