TL;DR: GEF
is a kick-ass set of commands for X86, ARM, MIPS, PowerPC and SPARC to
make GDB cool again for exploit dev.
GEF
is aimed to be used mostly by exploiters and reverse-engineers. It
provides additional features to GDB using the Python API to assist during the
process of dynamic analysis or exploit development.
GEF
fully relies on GDB API and other Linux specific source of information
(such as /proc/pid
). As a consequence, some of the features might not work on
custom or harden systems such as GrSec.
It has fully support for Python2 and Python3 indifferently (as more and more
distro start pushing gdb
compiled with Python3 support).
Simply make sure you're having a GDB 7.x .
# via the install script
$ wget -q -O- https://github.com/hugsy/gef/raw/master/gef.sh | sh
# manually
$ wget -q -O ~/.gdbinit-gef.py https://github.com/hugsy/gef/raw/master/gef.py
$ echo source ~/.gdbinit-gef.py >> ~/.gdbinit
Then just start playing (for local files):
$ gdb -q /path/to/my/bin
gef> gef help
Or (for remote debugging)
remote:~ $ gdbserver 0.0.0.0:1234 /path/to/file
Running as PID: 666
And
local:~ $ gdb -q
gef> gef-remote -t your.ip.address:1234 -p 666
If your host/VM is connected to Internet, you can update gef
easily to the latest version (even without git
installed)
$ python /path/to/gef.py --update
Updated
If no updates are available, gef
will respond No update
instead.
There are none: GEF
works out of the box! However, to enjoy all the coolest features, it is highly recommended to install:
capstone
(by Nguyen Anh Quynh)is an alternative disassembly engine, and keystone
is an (arguably the best) assembly engine.
You can use pip
to simply and quickly install it.
$ pip2 install capstone # for Python2.x
$ pip3 install capstone # for Python3.x
capstone
and keystone
are under very active development and improvement, so it is recommended to compile and install them from git.
$ git clone https://github.com/keystone-engine/keystone.git
$ mkdir -p keystone/build && keystone/build
$ cmake .. && make -j8
$ sudo make install
$ cd ../bindings/python && sudo make install # or sudo make install3 for Python3
capstone
provides an alternative to the gdb
disassembler, which could be useful specifically when dealing with complex/uncommon instructions.
keystone
allows to generate opcodes, which can, for example, then be used as part of a shellcode.
unicorn
(also written by Nguyen Anh Quynh) is a lightweight Qemu-based framework to emulate any architecture currently supported by GDB
(and even some more).
Install is simple through the released packages but I would recommend instead to rely on the GIT master branch.
$ git clone https://github.com/unicorn-engine/unicorn.git && cd unicorn && ./make.sh && sudo ./make.sh install
unicorn
integration in gef
allows to emulate the behaviour to specific instructions (or block of instructions) based on the runtime context, without actually running it, and therefore sparing the trouble of saving the context/running the new context/restoring the old context. Additionally, gef
can generate a standalone unicorn
Python script, if you want/need to reproduce steps outside the debugger.
ROPgadget
(written by Jonathan Salwan) is simply the best cross-platform ROP gadget finder. It has been totally integrated inside gef
to benefit of all of its awesomeness.
$ pip[23] install ropgadget
Simply run this
$ pip install ropgadget capstone keystone
Yes ! Why not ?! PEDA is a fantastic tool to
do the same, but is only to be used for x86-32 or x86-64. On the other hand,
GEF
supports all the architecture supported by GDB
(x86, ARM, MIPS, PowerPC,
SPARC, and so on).
Go here