GEF - GDB Enhanced Features
GEF
(pronounced ʤɛf - "Jeff") is a kick-ass set of commands for X86, ARM,
MIPS, PowerPC and SPARC to make GDB cool again for exploit dev. It is aimed to
be used mostly by exploit developers and reverse-engineers, to provide
additional features to GDB using the Python API to assist during the process of
dynamic analysis and exploit development.
It has full support for both Python2 and Python3 indifferently (as more and more
distros start pushing gdb
compiled with Python3 support).
A few of GEF
features include:
- One single GDB script
- Entirely OS Agnostic, NO dependencies:
GEF
is battery-included and is installable instantly - Fast limiting the number of dependencies and optimizing code to make the commands as fast as possible
- Provides a great variety of commands to drastically change your experience in GDB.
- Easily extensible to create other commands by providing more comprehensible layout to GDB Python API.
- Full Python3 support (Python2 support was
dropped - see
gef-legacy
). - Built around an architecture abstraction layer, so all commands work in any GDB-supported architecture such as x86-32/64, ARMv5/6/7, AARCH64, SPARC, MIPS, PowerPC, etc.
- Suited for real-life debugging, exploit development, just as much as for CTFs
Check out the Screenshot page for more.
Or try it online (user:gef
/password:gef-demo
)
Setup
Quick install
Simply make sure you have GDB 8.0 or higher, compiled with Python 3.6 or higher.
$ bash -c "$(curl -fsSL http://gef.blah.cat/sh)"
For more details and other ways to install GEF please see ./config.md.
Run
Then just start playing (for local files):
$ gdb -q /path/to/my/bin
gef➤ gef help
Or (for remote debugging):
remote:~ $ gdbserver 0.0.0.0:1234 /path/to/file
Running as PID: 666
And:
local:~ $ gdb -q
gef➤ gef-remote -t your.ip.address:1234 -p 666
Update
If your host/VM is connected to the Internet, you can update gef
easily to the
latest version (even without git
installed). with
python /path/to/gef.py --update
$ python ~/.gdbinit-gef.py --update
Updated
This will deploy the latest version of gef
's master branch from Github.
If no updates are available, gef
will respond No update
instead.
Install via Git
To install from Git, simply clone this repository and specify the path to
gef.py
inside the ~/.gdbinit
file:
$ git clone https://github.com/hugsy/gef.git
$ echo source `pwd`/gef/gef.py >> ~/.gdbinit
If you like living on the edge, you can then switch to the dev
branch:
$ git checkout dev
Dependencies
There are none: GEF
works out of the box!
However, to enjoy all the coolest features from some commands, it is recommended to install:
For a quick installation, simply use the pip
packaged version:
$ pip3 install capstone unicorn keystone-engine ropper
Just make sure you are using the pip
corresponding to the version of Python
your GDB was compiled with. If you are experiencing issues installing them,
post an issue on the GitHub of the respective projects. If your bug is not
related to GEF
, you will not get an answer.
Additional commands
GEF was built to also provide a solid base for external scripts. The
repository gef-extras
is an open
repository where anyone can freely submit their own commands to extend GDB via
GEF's API.
To benefit from it:
# via the install script
$ bash -c "$(wget https://github.com/hugsy/gef/raw/master/scripts/gef-extras.sh -O -)"
# manually
# clone the repo
$ https://github.com/hugsy/gef-extras.git
# specify gef to load this directory
$ gdb -ex 'gef config gef.extra_plugins_dir "/path/to/gef-extras/scripts"' -ex 'gef save' -ex quit
[+] Configuration saved
You can also use the structures defined from this repository:
$ gdb -ex 'gef config pcustom.struct_path "/path/to/gef-extras/structs"' -ex 'gef save' -ex quit
[+] Configuration saved
There, you're now fully equipped epic pwnage with all GEF's goodness!!
Bugs & Feedbacks
To discuss gef
, gdb
, exploitation or other topics, feel free to join our Discord channel.
For bugs or feature requests, just go here and provide a thorough description if you want help.
Side Note: GEF
fully relies on the GDB API and other Linux-specific sources of information (such as /proc/<pid>
). As a consequence, some of the features might not work on custom or hardened systems such as GrSec.
Contribution
gef
was created and maintained by myself, @_hugsy_
, but kept fresh thanks to all the contributors.
Or if you just like the tool, feel free to drop a simple "thanks" on Discord, Twitter or other, it is always very appreciated.
Sponsors
We would like to thank in particular the following people who've been sponsoring GEF allowing us to dedicate more time and resources to the project:
Extra Credits
- The GEF logo was designed by TheZakMan