
In preparation for the OSCE, I recently started working on the SLAE (SecurityTube Linux Assembly Expert) and have thrown together some of my notes on using the gdb debugger in Linux.
In order to avoid having to type “set disassembly-flavor intel” each time you launch gdb, add it to the gdbinit file
slae@slae:~$ cat /etc/gdb/gdbinit # System-wide GDB initialization file. set disassembly-flavor intel
Run a shell command within gdb
(gdb) shell whoami slae (gdb)
View contents of common registers, and view the contents of ALL registers
(gdb) info registers (gdb) info all-registers
View the functions available within a program
(gdb) info functions
Define a hook-stop (kind of a “macro” that runs every time execution is paused)
(gdb) define hook-stop Type commands for definition of "hook-stop". End with a line saying just "end". >print/x $eax ;print the contents of eax >print/x $ebx ;print the contents of ebx >some other command would go here >end (gdb)