GEF
http_gethttp_get(url: str) → Optional[bytes]
+Basic HTTP wrapper for GET request. Return the body of the page if HTTP code is OK, otherwise return None.
+update_gefupdate_gef(argv: List[str]) → int
+Try to update gef to the latest version pushed on GitHub main branch. Return 0 on success, 1 on failure.
reset_all_cachesreset_all_caches() → None
+Free all caches. If an object is cached, it will have a callable attribute cache_clear which will be invoked to purge the function cache.
resetreset() → None
+highlight_texthighlight_text(text: str) → str
+Highlight text using gef.ui.highlight_table { match -> color } settings.
If RegEx is enabled it will create a match group around all items in the gef.ui.highlight_table and wrap the specified color in the gef.ui.highlight_table around those matches.
If RegEx is disabled, split by ANSI codes and 'colorify' each match found within the specified string.
+gef_printgef_print(*args: str, end='\n', sep=' ', **kwargs: Any) → None
+Wrapper around print(), using string buffering feature.
+bufferizebufferize(f: Callable) → Callable
+Store the content to be printed for a function in memory, and flush it on function exit.
+p8p8(
+ x: int,
+ s: bool = False,
+ e: Optional[ForwardRef('Endianness')] = None
+) → bytes
+Pack one byte respecting the current architecture endianness.
+p16p16(
+ x: int,
+ s: bool = False,
+ e: Optional[ForwardRef('Endianness')] = None
+) → bytes
+Pack one word respecting the current architecture endianness.
+p32p32(
+ x: int,
+ s: bool = False,
+ e: Optional[ForwardRef('Endianness')] = None
+) → bytes
+Pack one dword respecting the current architecture endianness.
+p64p64(
+ x: int,
+ s: bool = False,
+ e: Optional[ForwardRef('Endianness')] = None
+) → bytes
+Pack one qword respecting the current architecture endianness.
+u8u8(
+ x: bytes,
+ s: bool = False,
+ e: Optional[ForwardRef('Endianness')] = None
+) → int
+Unpack one byte respecting the current architecture endianness.
+u16u16(
+ x: bytes,
+ s: bool = False,
+ e: Optional[ForwardRef('Endianness')] = None
+) → int
+Unpack one word respecting the current architecture endianness.
+u32u32(
+ x: bytes,
+ s: bool = False,
+ e: Optional[ForwardRef('Endianness')] = None
+) → int
+Unpack one dword respecting the current architecture endianness.
+u64u64(
+ x: bytes,
+ s: bool = False,
+ e: Optional[ForwardRef('Endianness')] = None
+) → int
+Unpack one qword respecting the current architecture endianness.
+is_ascii_stringis_ascii_string(address: int) → bool
+Helper function to determine if the buffer pointed by address is an ASCII string (in GDB)
is_aliveis_alive() → bool
+Check if GDB is running.
+calling_functioncalling_function() → Optional[str]
+Return the name of the calling function
+only_if_gdb_runningonly_if_gdb_running(f: Callable) → Callable
+Decorator wrapper to check if GDB is running.
+only_if_gdb_target_localonly_if_gdb_target_local(f: Callable) → Callable
+Decorator wrapper to check if GDB is running locally (target not remote).
+deprecateddeprecated(solution: str = '') → Callable
+Decorator to add a warning when a command is obsolete and will be removed.
+experimental_featureexperimental_feature(f: Callable) → Callable
+Decorator to add a warning when a feature is experimental.
+only_if_events_supportedonly_if_events_supported(event_type: str) → Callable
+Checks if GDB supports events without crashing.
+wrapped_fwrapped_f(*args: Any, **kwargs: Any) → Any
+wrapped_fwrapped_f(*args: Any, **kwargs: Any) → Any
+wrapped_fwrapped_f(*args: Any, **kwargs: Any) → Any
+wrapped_fwrapped_f(*args: Any, **kwargs: Any) → Any
+wrapped_fwrapped_f(*args: Any, **kwargs: Any) → Any
+wrapped_fwrapped_f(*args: Any, **kwargs: Any) → Any
+wrapped_fwrapped_f(*args: Any, **kwargs: Any) → Any
+wrapped_fwrapped_f(*args: Any, **kwargs: Any) → Any
+wrapped_fwrapped_f(*args: Any, **kwargs: Any) → Any
+wrapped_fwrapped_f(*args: Any, **kwargs: Any) → Any
+wrapped_fwrapped_f(*args: Any, **kwargs: Any) → Any
+wrapped_fwrapped_f(*args: Any, **kwargs: Any) → Any
+wrapped_fwrapped_f(*args: Any, **kwargs: Any) → Any
+wrapped_fwrapped_f(*args: Any, **kwargs: Any) → Any
+FakeExitFakeExit(*args: Any, **kwargs: Any) → NoReturn
+parse_argumentsparse_arguments(
+ required_arguments: Dict[Union[str, Tuple[str, str]], Any],
+ optional_arguments: Dict[Union[str, Tuple[str, str]], Any]
+) → Callable
+Argument parsing decorator.
+search_for_main_arenasearch_for_main_arena() → int
+search_for_main_arena is DEPRECATED and will be removed in the future.
+ Use GefHeapManager.find_main_arena_addr()
get_libc_versionget_libc_version() → Tuple[int, ...]
+get_libc_version is DEPRECATED and will be removed in the future.
+ Use GefLibcManager.find_libc_version()
titlifytitlify(
+ text: str,
+ color: Optional[str] = None,
+ msg_color: Optional[str] = None
+) → str
+Print a centered title.
+dbgdbg(msg: str) → None
+errerr(msg: str) → None
+warnwarn(msg: str) → None
+okok(msg: str) → None
+infoinfo(msg: str) → None
+push_context_messagepush_context_message(level: str, message: str) → None
+Push the message to be displayed the next time the context is invoked.
+show_last_exceptionshow_last_exception() → None
+Display the last Python exception.
+gef_pystringgef_pystring(x: bytes) → str
+Returns a sanitized version as string of the bytes list given in input.
+gef_pybytesgef_pybytes(x: str) → bytes
+Returns an immutable bytes list from the string given as input.
+style_bytestyle_byte(b: int, color: bool = True) → str
+hexdumphexdump(
+ source: ByteString,
+ length: int = 16,
+ separator: str = '.',
+ show_raw: bool = False,
+ show_symbol: bool = True,
+ base: int = 0
+) → str
+Return the hexdump of src argument. @param source MUST be of type bytes or bytearray @param length is the length of items per line @param separator is the default character to use if one byte is not printable @param show_raw if True, do not add the line nor the text translation @param base is the start address of the block being hexdump @return a string with the hexdump
is_debugis_debug() → bool
+Check if debug mode is enabled.
+buffer_outputbuffer_output() → bool
+Check if output should be buffered until command completion.
+hide_contexthide_context() → bool
+Helper function to hide the context pane.
+unhide_contextunhide_context() → bool
+Helper function to unhide the context pane.
+enable_redirect_outputenable_redirect_output(to_file: str = '/dev/null') → None
+Redirect all GDB output to to_file parameter. By default, to_file redirects to /dev/null.
disable_redirect_outputdisable_redirect_output() → None
+Disable the output redirection, if any.
+gef_makedirsgef_makedirs(path: str, mode: int = 493) → Path
+Recursive mkdir() creation. If successful, return the absolute path of the directory created.
+gdb_disassemblegdb_disassemble(
+ start_pc: int,
+ **kwargs: int
+) → Generator[__main__.Instruction, NoneType, NoneType]
+Disassemble instructions from start_pc (Integer). Accepts the following named
parameters:
+end_pc (Integer) only instructions whose start address fall in the interval from start_pc to end_pc are returned. count (Integer) list at most this many disassembled instructions If end_pc and count are not provided, the function will behave as if count=1. Return an iterator of Instruction objects gdb_get_nth_previous_instruction_addressgdb_get_nth_previous_instruction_address(addr: int, n: int) → Optional[int]
+Return the address (Integer) of the n-th instruction before addr.
gdb_get_nth_next_instruction_addressgdb_get_nth_next_instruction_address(addr: int, n: int) → int
+Return the address of the n-th instruction after addr.
+ gdb_get_nth_next_instruction_address is DEPRECATED and will be removed in the future.
+ Use gef_instruction_n().address
gef_instruction_ngef_instruction_n(addr: int, n: int) → Instruction
+Return the n-th instruction after addr as an Instruction object. Note that n is treated as an positive index, starting from 0 (current instruction address)
gef_get_instruction_atgef_get_instruction_at(addr: int) → Instruction
+Return the full Instruction found at the specified address.
+gef_current_instructiongef_current_instruction(addr: int) → Instruction
+Return the current instruction as an Instruction object.
+gef_next_instructiongef_next_instruction(addr: int) → Instruction
+Return the next instruction as an Instruction object.
+gef_disassemblegef_disassemble(
+ addr: int,
+ nb_insn: int,
+ nb_prev: int = 0
+) → Generator[__main__.Instruction, NoneType, NoneType]
+Disassemble nb_insn instructions after addr and nb_prev before addr. Return an iterator of Instruction objects.
gef_execute_externalgef_execute_external(
+ command: Sequence[str],
+ as_list: bool = False,
+ **kwargs: Any
+) → Union[str, List[str]]
+Execute an external command and return the result.
+gef_execute_gdb_scriptgef_execute_gdb_script(commands: str) → None
+Execute the parameter source as GDB command. This is done by writing commands to a temporary file, which is then executed via GDB source command. The tempfile is then deleted.
checksecchecksec(filename: str) → Dict[str, bool]
+checksec is DEPRECATED and will be removed in the future.
+ Use Elf(fname).checksec()
get_entry_pointget_entry_point() → Optional[int]
+Return the binary entry point.
+ get_entry_point is DEPRECATED and will be removed in the future.
+ Use gef.binary.entry_point instead
is_pieis_pie(fpath: str) → bool
+is_big_endianis_big_endian() → bool
+is_big_endian is DEPRECATED and will be removed in the future.
+ Prefer gef.arch.endianness == Endianness.BIG_ENDIAN
is_little_endianis_little_endian() → bool
+is_little_endian is DEPRECATED and will be removed in the future.
+ gef.arch.endianness == Endianness.LITTLE_ENDIAN
flags_to_humanflags_to_human(reg_value: int, value_table: Dict[int, str]) → str
+Return a human readable string showing the flag states.
+register_architectureregister_architecture(
+ cls: Type[ForwardRef('Architecture')]
+) → Type[ForwardRef('Architecture')]
+register_architecture is DEPRECATED and will be removed in the future.
+ Using the decorator register_architecture is unecessary
copy_to_clipboardcopy_to_clipboard(data: bytes) → None
+Helper function to submit data to the clipboard
+use_stdtypeuse_stdtype() → str
+use_default_typeuse_default_type() → str
+use_golang_typeuse_golang_type() → str
+use_rust_typeuse_rust_type() → str
+to_unsigned_longto_unsigned_long(v: gdb.Value) → int
+Cast a gdb.Value to unsigned long.
+get_path_from_info_procget_path_from_info_proc() → Optional[str]
+get_osget_os() → str
+get_os is DEPRECATED and will be removed in the future.
+ Use gef.session.os
get_filepathget_filepath() → Optional[str]
+Return the local absolute path of the file currently debugged.
+get_function_lengthget_function_length(sym: str) → int
+Attempt to get the length of the raw bytes of a function.
+process_lookup_addressprocess_lookup_address(address: int) → Optional[__main__.Section]
+Look up for an address in memory. Return an Address object if found, None otherwise.
+xorxor(data: ByteString, key: str) → bytearray
+Return data xor-ed with key.
is_hexis_hex(pattern: str) → bool
+Return whether provided string is a hexadecimal value.
+continue_handlercontinue_handler(_: 'gdb.ContinueEvent') → None
+GDB event handler for new object continue cases.
+hook_stop_handlerhook_stop_handler(_: 'gdb.StopEvent') → None
+GDB event handler for stop cases.
+new_objfile_handlernew_objfile_handler(evt: Optional[ForwardRef('gdb.NewObjFileEvent')]) → None
+GDB event handler for new object file cases.
+exit_handlerexit_handler(_: 'gdb.ExitedEvent') → None
+GDB event handler for exit cases.
+memchanged_handlermemchanged_handler(_: 'gdb.MemoryChangedEvent') → None
+GDB event handler for mem changes cases.
+regchanged_handlerregchanged_handler(_: 'gdb.RegisterChangedEvent') → None
+GDB event handler for reg changes cases.
+get_terminal_sizeget_terminal_size() → Tuple[int, int]
+Return the current terminal size.
+reset_architecturereset_architecture(arch: Optional[str] = None) → None
+Sets the current architecture. If an architecture is explicitly specified by parameter, try to use that one. If this fails, an OSError exception will occur. If no architecture is specified, then GEF will attempt to determine automatically based on the current ELF target. If this fails, an OSError exception will occur.
get_memory_alignmentget_memory_alignment(in_bits: bool = False) → int
+Try to determine the size of a pointer on this system. First, try to parse it out of the ELF header. Next, use the size of size_t. Finally, try the size of $pc. If in_bits is set to True, the result is returned in bits, otherwise in bytes.
+ get_memory_alignment is DEPRECATED and will be removed in the future.
+ Use gef.arch.ptrsize instead
clear_screenclear_screen(tty: str = '') → None
+Clear the screen.
+format_addressformat_address(addr: int) → str
+Format the address according to its size.
+format_address_spacesformat_address_spaces(addr: int, left: bool = True) → str
+Format the address according to its size, but with spaces instead of zeroes.
+align_addressalign_address(address: int) → int
+Align the provided address to the process's native length.
+align_address_to_sizealign_address_to_size(address: int, align: int) → int
+Align the address to the given size.
+align_address_to_pagealign_address_to_page(address: int) → int
+Align the address to a page.
+parse_addressparse_address(address: str) → int
+Parse an address and return it as an Integer.
+is_in_x86_kernelis_in_x86_kernel(address: int) → bool
+is_remote_debugis_remote_debug() → bool
+"Return True is the current debugging session is running through GDB remote session.
+de_bruijnde_bruijn(alphabet: bytes, n: int) → Generator[str, NoneType, NoneType]
+De Bruijn sequence for alphabet and subsequences of length n (for compat. w/ pwnlib).
+generate_cyclic_patterngenerate_cyclic_pattern(length: int, cycle: int = 4) → bytearray
+Create a length byte bytearray of a de Bruijn cyclic pattern.
safe_parse_and_evalsafe_parse_and_eval(value: str) → Optional[ForwardRef('gdb.Value')]
+GEF wrapper for gdb.parse_and_eval(): this function returns None instead of raising gdb.error if the eval failed.
+gef_conveniencegef_convenience(value: Union[str, bytes]) → str
+Defines a new convenience value.
+parse_string_rangeparse_string_range(s: str) → Iterator[int]
+Parses an address range (e.g. 0x400000-0x401000)
+gef_get_pie_breakpointgef_get_pie_breakpoint(num: int) → PieVirtualBreakpoint
+gef_get_pie_breakpoint is DEPRECATED and will be removed in the future.
+ Use gef.session.pie_breakpoints[num]
endian_strendian_str() → str
+endian_str is DEPRECATED and will be removed in the future.
+ Use str(gef.arch.endianness) instead
get_gef_settingget_gef_setting(name: str) → Any
+get_gef_setting is DEPRECATED and will be removed in the future.
+ Use gef.config[key]
set_gef_settingset_gef_setting(name: str, value: Any) → None
+set_gef_setting is DEPRECATED and will be removed in the future.
+ Use gef.config[key] = value
gef_getpagesizegef_getpagesize() → int
+gef_getpagesize is DEPRECATED and will be removed in the future.
+ Use gef.session.pagesize
gef_read_canarygef_read_canary() → Optional[Tuple[int, int]]
+gef_read_canary is DEPRECATED and will be removed in the future.
+ Use gef.session.canary
get_pidget_pid() → int
+get_pid is DEPRECATED and will be removed in the future.
+ Use gef.session.pid
get_filenameget_filename() → str
+get_filename is DEPRECATED and will be removed in the future.
+ Use gef.session.file.name
get_glibc_arenaget_glibc_arena() → Optional[__main__.GlibcArena]
+get_glibc_arena is DEPRECATED and will be removed in the future.
+ Use gef.heap.main_arena
get_registerget_register(regname) → Optional[int]
+get_register is DEPRECATED and will be removed in the future.
+ Use gef.arch.register(regname)
get_process_mapsget_process_maps() → List[__main__.Section]
+get_process_maps is DEPRECATED and will be removed in the future.
+ Use gef.memory.maps
set_archset_arch(arch: Optional[str] = None, _: Optional[str] = None) → None
+set_arch is DEPRECATED and will be removed in the future.
+ Use reset_architecture
register_external_context_paneregister_external_context_pane(
+ pane_name: str,
+ display_pane_function: Callable[[], NoneType],
+ pane_title_function: Callable[[], Optional[str]],
+ condition: Optional[Callable[[], bool]] = None
+) → None
+Registering function for new GEF Context View. pane_name: a string that has no spaces (used in settings) display_pane_function: a function that uses gef_print() to print strings pane_title_function: a function that returns a string or None, which will be displayed as the title. If None, no title line is displayed. condition: an optional callback: if not None, the callback will be executed first. If it returns true, then only the pane title and content will displayed. Otherwise, it's simply skipped.
+Example usage for a simple text to show when we hit a syscall: def only_syscall(): return gef_current_instruction(gef.arch.pc).is_syscall() def display_pane(): gef_print("Wow, I am a context pane!") def pane_title(): return "example:pane" register_external_context_pane("example_pane", display_pane, pane_title, only_syscall)
+register_external_commandregister_external_command(
+ cls: Type[ForwardRef('GenericCommand')]
+) → Type[ForwardRef('GenericCommand')]
+Registering function for new GEF (sub-)command to GDB.
+ register_external_command is DEPRECATED and will be removed in the future.
+ Use register(), and inherit from GenericCommand instead
register_commandregister_command(
+ cls: Type[ForwardRef('GenericCommand')]
+) → Type[ForwardRef('GenericCommand')]
+Decorator for registering new GEF (sub-)command to GDB.
+ register_command is DEPRECATED and will be removed in the future.
+ Use register(), and inherit from GenericCommand instead
register_priority_commandregister_priority_command(
+ cls: Type[ForwardRef('GenericCommand')]
+) → Type[ForwardRef('GenericCommand')]
+Decorator for registering new command with priority, meaning that it must loaded before the other generic commands.
+ register_priority_command is DEPRECATED and will be removed in the future.
registerregister(
+ cls: Union[Type[ForwardRef('GenericCommand')], Type[ForwardRef('GenericFunction')]]
+) → Union[Type[ForwardRef('GenericCommand')], Type[ForwardRef('GenericFunction')]]
+register_functionregister_function(
+ cls: Type[ForwardRef('GenericFunction')]
+) → Type[ForwardRef('GenericFunction')]
+Decorator for registering a new convenience function to GDB.
+ register_function is DEPRECATED and will be removed in the future.
AARCH64Determine the size of pointer from the current CPU mode
+AARCH64.canary_addresscanary_address() → int
+AARCH64.flag_register_to_humanflag_register_to_human(val: Optional[int] = None) → str
+AARCH64.get_ith_parameterget_ith_parameter(i: int, in_func: bool = True) → Tuple[str, Optional[int]]
+Retrieves the correct parameter used for the current function call.
+AARCH64.get_raget_ra(insn: __main__.Instruction, frame: 'gdb.Frame') → int
+AARCH64.is_aarch32is_aarch32() → bool
+Determine if the CPU is currently in AARCH32 mode from runtime.
+AARCH64.is_branch_takenis_branch_taken(insn: __main__.Instruction) → Tuple[bool, str]
+AARCH64.is_callis_call(insn: __main__.Instruction) → bool
+AARCH64.is_conditional_branchis_conditional_branch(insn: __main__.Instruction) → bool
+AARCH64.is_retis_ret(insn: __main__.Instruction) → bool
+AARCH64.is_thumbis_thumb() → bool
+Determine if the machine is currently in THUMB mode.
+AARCH64.is_thumb32is_thumb32() → bool
+Determine if the CPU is currently in THUMB32 mode from runtime.
+AARCH64.mprotect_asmmprotect_asm(addr: int, size: int, perm: __main__.Permission) → str
+AARCH64.registerregister(name: str) → int
+AARCH64.reset_cachesreset_caches() → None
+AARCH64.supports_gdb_archsupports_gdb_arch(gdb_arch: str) → Optional[bool]
+If implemented by a child Architecture, this function dictates if the current class supports the loaded ELF file (which can be accessed via gef.binary). This callback function will override any assumption made by GEF to determine the architecture.
ARMARM.canary_addresscanary_address() → int
+ARM.flag_register_to_humanflag_register_to_human(val: Optional[int] = None) → str
+ARM.get_ith_parameterget_ith_parameter(i: int, in_func: bool = True) → Tuple[str, Optional[int]]
+Retrieves the correct parameter used for the current function call.
+ARM.get_raget_ra(insn: __main__.Instruction, frame: 'gdb.Frame') → int
+ARM.is_branch_takenis_branch_taken(insn: __main__.Instruction) → Tuple[bool, str]
+ARM.is_callis_call(insn: __main__.Instruction) → bool
+ARM.is_conditional_branchis_conditional_branch(insn: __main__.Instruction) → bool
+ARM.is_retis_ret(insn: __main__.Instruction) → bool
+ARM.is_thumbis_thumb() → bool
+Determine if the machine is currently in THUMB mode.
+ARM.mprotect_asmmprotect_asm(addr: int, size: int, perm: __main__.Permission) → str
+ARM.registerregister(name: str) → int
+ARM.reset_cachesreset_caches() → None
+ARM.supports_gdb_archsupports_gdb_arch(gdb_arch: str) → Optional[bool]
+If implemented by a child Architecture, this function dictates if the current class supports the loaded ELF file (which can be accessed via gef.binary). This callback function will override any assumption made by GEF to determine the architecture.
ASLRCommandView/modify the ASLR setting of GDB. By default, GDB will disable ASLR when it starts the process. (i.e. not attached). This command allows to change that setting.
+ASLRCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+ASLRCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
ASLRCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
ASLRCommand.do_invokedo_invoke(argv: List[str]) → None
+ASLRCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
ASLRCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
ASLRCommand.invokeinvoke(args: str, from_tty: bool) → None
+ASLRCommand.post_loadpost_load() → None
+ASLRCommand.pre_loadpre_load() → None
+ASLRCommand.usageusage() → None
+AddressGEF representation of memory addresses.
+Address.__init____init__(**kwargs: Any) → None
+Address.dereferencedereference() → Optional[int]
+Address.is_in_heap_segmentis_in_heap_segment() → bool
+Address.is_in_stack_segmentis_in_stack_segment() → bool
+Address.is_in_text_segmentis_in_text_segment() → bool
+AliasesAddCommandCommand to add aliases.
+AliasesAddCommand.__init____init__() → None
+Return the list of settings for this command.
+AliasesAddCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
AliasesAddCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
AliasesAddCommand.do_invokedo_invoke(argv: List[str]) → None
+AliasesAddCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
AliasesAddCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
AliasesAddCommand.invokeinvoke(args: str, from_tty: bool) → None
+AliasesAddCommand.post_loadpost_load() → None
+AliasesAddCommand.pre_loadpre_load() → None
+AliasesAddCommand.usageusage() → None
+AliasesCommandBase command to add, remove, or list aliases.
+AliasesCommand.__init____init__() → None
+Return the list of settings for this command.
+AliasesCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
AliasesCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
AliasesCommand.do_invokedo_invoke(_: List[str]) → None
+AliasesCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
AliasesCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
AliasesCommand.invokeinvoke(args: str, from_tty: bool) → None
+AliasesCommand.post_loadpost_load() → None
+AliasesCommand.pre_loadpre_load() → None
+AliasesCommand.usageusage() → None
+AliasesListCommandCommand to list aliases.
+AliasesListCommand.__init____init__() → None
+Return the list of settings for this command.
+AliasesListCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
AliasesListCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
AliasesListCommand.do_invokedo_invoke(_: List[str]) → None
+AliasesListCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
AliasesListCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
AliasesListCommand.invokeinvoke(args: str, from_tty: bool) → None
+AliasesListCommand.post_loadpost_load() → None
+AliasesListCommand.pre_loadpre_load() → None
+AliasesListCommand.usageusage() → None
+AliasesRmCommandCommand to remove aliases.
+AliasesRmCommand.__init____init__() → None
+Return the list of settings for this command.
+AliasesRmCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
AliasesRmCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
AliasesRmCommand.do_invokedo_invoke(argv: List[str]) → None
+AliasesRmCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
AliasesRmCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
AliasesRmCommand.invokeinvoke(args: str, from_tty: bool) → None
+AliasesRmCommand.post_loadpost_load() → None
+AliasesRmCommand.pre_loadpre_load() → None
+AliasesRmCommand.usageusage() → None
+ArchitectureGeneric metaclass for the architecture supported by GEF.
+Architecture.canary_addresscanary_address() → int
+Architecture.flag_register_to_humanflag_register_to_human(val: Optional[int] = None) → str
+Architecture.get_ith_parameterget_ith_parameter(i: int, in_func: bool = True) → Tuple[str, Optional[int]]
+Retrieves the correct parameter used for the current function call.
+Architecture.get_raget_ra(insn: __main__.Instruction, frame: 'gdb.Frame') → Optional[int]
+Architecture.is_branch_takenis_branch_taken(insn: __main__.Instruction) → Tuple[bool, str]
+Architecture.is_callis_call(insn: __main__.Instruction) → bool
+Architecture.is_conditional_branchis_conditional_branch(insn: __main__.Instruction) → bool
+Architecture.is_retis_ret(insn: __main__.Instruction) → bool
+Architecture.mprotect_asmmprotect_asm(addr: int, size: int, perm: __main__.Permission) → str
+Architecture.registerregister(name: str) → int
+Architecture.reset_cachesreset_caches() → None
+Architecture.supports_gdb_archsupports_gdb_arch(gdb_arch: str) → Optional[bool]
+If implemented by a child Architecture, this function dictates if the current class supports the loaded ELF file (which can be accessed via gef.binary). This callback function will override any assumption made by GEF to determine the architecture.
ArchitectureBaseClass decorator for declaring an architecture to GEF.
+BssBaseFunctionReturn the current bss base address plus the given offset.
+BssBaseFunction.__init____init__() → None
+BssBaseFunction.arg_to_longarg_to_long(args: List, index: int, default: int = 0) → int
+BssBaseFunction.do_invokedo_invoke(args: List) → int
+BssBaseFunction.invokeinvoke(*args: Any) → int
+CanaryCommandShows the canary value of the current process.
+CanaryCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+CanaryCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
CanaryCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
CanaryCommand.do_invokedo_invoke(argv: List[str]) → None
+CanaryCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
CanaryCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
CanaryCommand.invokeinvoke(args: str, from_tty: bool) → None
+CanaryCommand.post_loadpost_load() → None
+CanaryCommand.pre_loadpre_load() → None
+CanaryCommand.usageusage() → None
+ChangeFdCommandChangeFdCommand: redirect file descriptor during runtime.
+ChangeFdCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+ChangeFdCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
ChangeFdCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
ChangeFdCommand.do_invokedo_invoke(argv: List[str]) → None
+ChangeFdCommand.get_fd_from_resultget_fd_from_result(res: str) → int
+ChangeFdCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
ChangeFdCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
ChangeFdCommand.invokeinvoke(args: str, from_tty: bool) → None
+ChangeFdCommand.post_loadpost_load() → None
+ChangeFdCommand.pre_loadpre_load() → None
+ChangeFdCommand.usageusage() → None
+ChangePermissionBreakpointWhen hit, this temporary breakpoint will restore the original code, and position $pc correctly.
+ChangePermissionBreakpoint.__init____init__(loc: str, code: ByteString, pc: int) → None
+ChangePermissionBreakpoint.stopstop() → bool
+ChecksecCommandChecksec the security properties of the current executable or passed as argument. The command checks for the following protections: +- PIE +- NX +- RelRO +- Glibc Stack Canaries +- Fortify Source
+ChecksecCommand.__init____init__() → None
+Return the list of settings for this command.
+ChecksecCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
ChecksecCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
ChecksecCommand.do_invokedo_invoke(argv: List[str]) → None
+ChecksecCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
ChecksecCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
ChecksecCommand.invokeinvoke(args: str, from_tty: bool) → None
+ChecksecCommand.post_loadpost_load() → None
+ChecksecCommand.pre_loadpre_load() → None
+ChecksecCommand.print_security_propertiesprint_security_properties(filename: str) → None
+ChecksecCommand.usageusage() → None
+ColorUsed to colorify terminal output.
+Color.blinkifyblinkify(msg: str) → str
+Color.blueifyblueify(msg: str) → str
+Color.boldifyboldify(msg: str) → str
+Color.colorifycolorify(text: str, attrs: str) → str
+Color text according to the given attributes.
+Color.cyanifycyanify(msg: str) → str
+Color.grayifygrayify(msg: str) → str
+Color.greenifygreenify(msg: str) → str
+Color.highlightifyhighlightify(msg: str) → str
+Color.light_grayifylight_grayify(msg: str) → str
+Color.pinkifypinkify(msg: str) → str
+Color.redifyredify(msg: str) → str
+Color.underlinifyunderlinify(msg: str) → str
+Color.yellowifyyellowify(msg: str) → str
+ContextCommandDisplays a comprehensive and modular summary of runtime context. Unless setting enable is set to False, this command will be spawned automatically every time GDB hits a breakpoint, a watchpoint, or any kind of interrupt. By default, it will show panes that contain the register states, the stack, and the disassembly code around $pc.
ContextCommand.__init____init__() → None
+Return the list of settings for this command.
+ContextCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
ContextCommand.addr_has_breakpointaddr_has_breakpoint(address: int, bp_locations: List[str]) → bool
+ContextCommand.context_additional_informationcontext_additional_information() → None
+ContextCommand.context_argscontext_args() → None
+ContextCommand.context_codecontext_code() → None
+ContextCommand.context_memorycontext_memory() → None
+ContextCommand.context_regscontext_regs() → None
+ContextCommand.context_sourcecontext_source() → None
+ContextCommand.context_stackcontext_stack() → None
+ContextCommand.context_threadscontext_threads() → None
+ContextCommand.context_titlecontext_title(m: Optional[str]) → None
+ContextCommand.context_tracecontext_trace() → None
+ContextCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
ContextCommand.do_invokedo_invoke(argv: List[str]) → None
+ContextCommand.empty_extra_messagesempty_extra_messages(_) → None
+ContextCommand.get_pc_context_infoget_pc_context_info(pc: int, line: str) → str
+ContextCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
ContextCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
ContextCommand.invokeinvoke(args: str, from_tty: bool) → None
+ContextCommand.line_has_breakpointline_has_breakpoint(
+ file_name: str,
+ line_number: int,
+ bp_locations: List[str]
+) → bool
+ContextCommand.post_loadpost_load() → None
+ContextCommand.pre_loadpre_load() → None
+ContextCommand.print_arguments_from_symbolprint_arguments_from_symbol(function_name: str, symbol: 'gdb.Symbol') → None
+If symbols were found, parse them and print the argument adequately.
+ContextCommand.print_guessed_argumentsprint_guessed_arguments(function_name: str) → None
+When no symbol, read the current basic block and look for "interesting" instructions.
+ContextCommand.show_legendshow_legend() → None
+ContextCommand.update_registersupdate_registers(_) → None
+ContextCommand.usageusage() → None
+DereferenceCommandDereference recursively from an address and display information. This acts like WinDBG dps command.
DereferenceCommand.__init____init__() → None
+Return the list of settings for this command.
+DereferenceCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
DereferenceCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
DereferenceCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+DereferenceCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
DereferenceCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
DereferenceCommand.invokeinvoke(args: str, from_tty: bool) → None
+DereferenceCommand.post_loadpost_load() → None
+DereferenceCommand.pprint_dereferencedpprint_dereferenced(addr: int, idx: int, base_offset: int = 0) → str
+DereferenceCommand.pre_loadpre_load() → None
+DereferenceCommand.usageusage() → None
+DetailRegistersCommandDisplay full details on one, many or all registers value from current architecture.
+DetailRegistersCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+DetailRegistersCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
DetailRegistersCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
DetailRegistersCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+DetailRegistersCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
DetailRegistersCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
DetailRegistersCommand.invokeinvoke(args: str, from_tty: bool) → None
+DetailRegistersCommand.post_loadpost_load() → None
+DetailRegistersCommand.pre_loadpre_load() → None
+DetailRegistersCommand.usageusage() → None
+DisableContextOutputContextElfBasic ELF parsing. Ref: +- http://www.skyfree.org/linux/references/ELF_Format.pdf +- https://refspecs.linuxfoundation.org/elf/elfspec_ppc.pdf +- https://refspecs.linuxfoundation.org/ELF/ppc64/PPC-elf64abi.html
+Elf.__init____init__(path: Union[str, pathlib.Path]) → None
+Instantiate an ELF object. A valid ELF must be provided, or an exception will be thrown.
+Check the security property of the ELF binary. The following properties are: +- Canary +- NX +- PIE +- Fortify +- Partial/Full RelRO. Return a dict() with the different keys mentioned above, and the boolean associated whether the protection was found.
+Elf.is_validis_valid(path: pathlib.Path) → bool
+Elf.readread(size: int) → bytes
+Elf.read_and_unpackread_and_unpack(fmt: str) → Tuple[Any, ...]
+Elf.seekseek(off: int) → None
+ElfInfoCommandDisplay a limited subset of ELF header information. If no argument is provided, the command will show information about the current ELF being debugged.
+ElfInfoCommand.__init____init__() → None
+Return the list of settings for this command.
+ElfInfoCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
ElfInfoCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
ElfInfoCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+ElfInfoCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
ElfInfoCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
ElfInfoCommand.invokeinvoke(args: str, from_tty: bool) → None
+ElfInfoCommand.post_loadpost_load() → None
+ElfInfoCommand.pre_loadpre_load() → None
+ElfInfoCommand.usageusage() → None
+EndiannessAn enumeration.
+EntryBreakBreakpointBreakpoint used internally to stop execution at the most convenient entry point.
+EntryBreakBreakpoint.__init____init__(location: str) → None
+EntryBreakBreakpoint.stopstop() → bool
+EntryPointBreakCommandTries to find best entry point and sets a temporary breakpoint on it. The command will test for well-known symbols for entry points, such as main, _main, __libc_start_main, etc. defined by the setting entrypoint_symbols.
EntryPointBreakCommand.__init____init__() → None
+Return the list of settings for this command.
+EntryPointBreakCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
EntryPointBreakCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
EntryPointBreakCommand.do_invokedo_invoke(argv: List[str]) → None
+EntryPointBreakCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
EntryPointBreakCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
EntryPointBreakCommand.invokeinvoke(args: str, from_tty: bool) → None
+EntryPointBreakCommand.post_loadpost_load() → None
+EntryPointBreakCommand.pre_loadpre_load() → None
+EntryPointBreakCommand.set_init_tbreakset_init_tbreak(addr: int) → EntryBreakBreakpoint
+EntryPointBreakCommand.set_init_tbreak_pieset_init_tbreak_pie(addr: int, argv: List[str]) → EntryBreakBreakpoint
+EntryPointBreakCommand.usageusage() → None
+ExternalStructureManagerExternalStructureManager.__init____init__() → None
+ExternalStructureManager.clear_cachesclear_caches() → None
+FileFormatFileFormat.__init____init__(path: Union[str, pathlib.Path]) → None
+FileFormat.is_validis_valid(path: pathlib.Path) → bool
+FileFormatSectionFlagsCommandEdit flags in a human friendly way.
+FlagsCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+FlagsCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
FlagsCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
FlagsCommand.do_invokedo_invoke(argv: List[str]) → None
+FlagsCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
FlagsCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
FlagsCommand.invokeinvoke(args: str, from_tty: bool) → None
+FlagsCommand.post_loadpost_load() → None
+FlagsCommand.pre_loadpre_load() → None
+FlagsCommand.usageusage() → None
+FormatStringBreakpointInspect stack for format string.
+FormatStringBreakpoint.__init____init__(spec: str, num_args: int) → None
+FormatStringBreakpoint.stopstop() → bool
+FormatStringSearchCommandExploitable format-string helper: this command will set up specific breakpoints at well-known dangerous functions (printf, snprintf, etc.), and check if the pointer holding the format string is writable, and therefore susceptible to format string attacks if an attacker can control its content.
+FormatStringSearchCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+FormatStringSearchCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
FormatStringSearchCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
FormatStringSearchCommand.do_invokedo_invoke(_: List[str]) → None
+FormatStringSearchCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
FormatStringSearchCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
FormatStringSearchCommand.invokeinvoke(args: str, from_tty: bool) → None
+FormatStringSearchCommand.post_loadpost_load() → None
+FormatStringSearchCommand.pre_loadpre_load() → None
+FormatStringSearchCommand.usageusage() → None
+GdbRemoveReadlineFinderGdbRemoveReadlineFinder.find_modulefind_module(fullname, path=None)
+GdbRemoveReadlineFinder.load_moduleload_module(fullname)
+GefThe GEF root class, which serves as a entrypoint for all the debugging session attributes (architecture, memory, settings, etc.).
+Gef.__init____init__() → None
+Gef.reinitialize_managersreinitialize_managers() → None
+Reinitialize the managers. Avoid calling this function directly, using pi reset() is preferred
Gef.reset_cachesreset_caches() → None
+Recursively clean the cache of all the managers. Avoid calling this function directly, using reset-cache is preferred
Gef.setupsetup() → None
+Setup initialize the runtime setup, which may require for the gef to be not None.
GefAliasSimple aliasing wrapper because GDB doesn't do what it should.
+GefAlias.__init____init__(
+ alias: str,
+ command: str,
+ completer_class: int = 0,
+ command_class: int = -1
+) → None
+GefAlias.invokeinvoke(args: Any, from_tty: bool) → None
+GefAlias.lookup_commandlookup_command(cmd: str) → Optional[Tuple[str, __main__.GenericCommand]]
+GefCommandGEF main command: view all new commands by typing gef.
GefCommand.__init____init__() → None
+GefCommand.add_context_paneadd_context_pane(
+ pane_name: str,
+ display_pane_function: Callable,
+ pane_title_function: Callable,
+ condition: Optional[Callable]
+) → None
+Add a new context pane to ContextCommand.
+GefCommand.invokeinvoke(args: Any, from_tty: bool) → None
+GefCommand.loadload() → None
+Load all the commands and functions defined by GEF into GDB.
+GefCommand.load_extra_pluginsload_extra_plugins() → int
+GefCommand.setupsetup() → None
+GefCommand.show_bannershow_banner() → None
+GefConfigCommandGEF configuration sub-command This command will help set/view GEF settings for the current debugging session. It is possible to make those changes permanent by running gef save (refer to this command help), and/or restore previously saved settings by running gef restore (refer help).
GefConfigCommand.__init____init__() → None
+GefConfigCommand.completecomplete(text: str, word: str) → List[str]
+GefConfigCommand.invokeinvoke(args: str, from_tty: bool) → None
+GefConfigCommand.print_settingprint_setting(plugin_name: str, verbose: bool = False) → None
+GefConfigCommand.print_settingsprint_settings() → None
+GefConfigCommand.set_settingset_setting(argv: Tuple[str, Any]) → None
+GefFunctionsCommandList the convenience functions provided by GEF.
+GefFunctionsCommand.__init____init__() → None
+Return the list of settings for this command.
+GefFunctionsCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
GefFunctionsCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
GefFunctionsCommand.do_invokedo_invoke(argv) → None
+GefFunctionsCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
GefFunctionsCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
GefFunctionsCommand.invokeinvoke(args: str, from_tty: bool) → None
+GefFunctionsCommand.post_loadpost_load() → None
+GefFunctionsCommand.pre_loadpre_load() → None
+GefFunctionsCommand.usageusage() → None
+GefHeapManagerClass managing session heap.
+GefHeapManager.__init____init__() → None
+GefHeapManager.csize2tidxcsize2tidx(size: int) → int
+GefHeapManager.malloc_align_addressmalloc_align_address(address: int) → int
+Align addresses according to glibc's MALLOC_ALIGNMENT. See also Issue #689 on Github
+GefHeapManager.reset_cachesreset_caches() → None
+GefHeapManager.tidx2sizetidx2size(idx: int) → int
+GefHelpCommandGEF help sub-command.
+GefHelpCommand.__init____init__() → None
+GefHelpCommand.invokeinvoke(args: Any, from_tty: bool) → None
+GefInstallExtraScriptCommandgef install command: installs one or more scripts from the gef-extras script repo. Note that the command doesn't check for external dependencies the script(s) might require.
GefInstallExtraScriptCommand.__init____init__() → None
+GefInstallExtraScriptCommand.invokeinvoke(argv: str, from_tty: bool) → None
+GefLibcManagerClass managing everything libc-related (except heap).
+GefLibcManager.__init____init__() → None
+GefLibcManager.reset_cachesreset_caches() → None
+Reset the LRU-cached attributes
+GefManagerGefManager.reset_cachesreset_caches() → None
+Reset the LRU-cached attributes
+GefMemoryManagerClass that manages memory access for gef.
+GefMemoryManager.__init____init__() → None
+GefMemoryManager.readread(addr: int, length: int = 16) → bytes
+Return a length long byte array with the copy of the process memory at addr.
GefMemoryManager.read_ascii_stringread_ascii_string(address: int) → Optional[str]
+Read an ASCII string from memory
+GefMemoryManager.read_cstringread_cstring(
+ address: int,
+ max_length: int = 50,
+ encoding: Optional[str] = None
+) → str
+Return a C-string read from memory.
+GefMemoryManager.read_integerread_integer(addr: int) → int
+Return an integer read from memory.
+GefMemoryManager.reset_cachesreset_caches() → None
+GefMemoryManager.writewrite(address: int, buffer: ByteString, length: Optional[int] = None) → None
+Write buffer at address address.
GefMissingCommandGEF missing sub-command Display the GEF commands that could not be loaded, along with the reason of why they could not be loaded.
+GefMissingCommand.__init____init__() → None
+GefMissingCommand.invokeinvoke(args: Any, from_tty: bool) → None
+GefRemoteSessionManagerClass for managing remote sessions with GEF. It will create a temporary environment designed to clone the remote one.
+GefRemoteSessionManager.__init____init__(
+ host: str,
+ port: int,
+ pid: int = -1,
+ qemu: Optional[pathlib.Path] = None
+) → None
+Return a tuple of the canary address and value, read from the canonical location if supported by the architecture. Otherwise, read from the auxiliary vector.
+Path to the file being debugged as seen by the remote endpoint.
+Local path to the file being debugged.
+Return a tuple of the initial canary address and value, read from the auxiliary vector.
+Return the current OS.
+Get the system page size
+Return the PID of the target process.
+GefRemoteSessionManager.closeclose() → None
+GefRemoteSessionManager.connectconnect(pid: int) → bool
+Connect to remote target. If in extended mode, also attach to the given PID.
+GefRemoteSessionManager.in_qemu_userin_qemu_user() → bool
+GefRemoteSessionManager.remote_objfile_event_handlerremote_objfile_event_handler(evt: 'gdb.NewObjFileEvent') → None
+GefRemoteSessionManager.reset_cachesreset_caches() → None
+GefRemoteSessionManager.setupsetup() → bool
+GefRemoteSessionManager.syncsync(src: str, dst: Optional[str] = None) → bool
+Copy the src into the temporary chroot. If dst is provided, that path will be used instead of src.
GefRestoreCommandGEF restore sub-command. Loads settings from file '~/.gef.rc' and apply them to the configuration of GEF.
+GefRestoreCommand.__init____init__() → None
+GefRestoreCommand.invokeinvoke(args: str, from_tty: bool) → None
+GefRestoreCommand.reloadreload(quiet: bool)
+GefRunCommandOverride GDB run commands with the context from GEF. Simple wrapper for GDB run command to use arguments set from gef set args.
GefRunCommand.__init____init__() → None
+GefRunCommand.invokeinvoke(args: Any, from_tty: bool) → None
+GefSaveCommandGEF save sub-command. Saves the current configuration of GEF to disk (by default in file '~/.gef.rc').
+GefSaveCommand.__init____init__() → None
+GefSaveCommand.invokeinvoke(args: Any, from_tty: bool) → None
+GefSessionManagerClass managing the runtime properties of GEF.
+GefSessionManager.__init____init__() → None
+Return a tuple of the canary address and value, read from the canonical location if supported by the architecture. Otherwise, read from the auxiliary vector.
+Return a Path object of the target process.
+Returns the Path to the procfs entry for the memory mapping.
+Return a tuple of the initial canary address and value, read from the auxiliary vector.
+Return the current OS.
+Get the system page size
+Return the PID of the target process.
+Returns the path to the process's root directory.
+GefSessionManager.reset_cachesreset_caches() → None
+GefSetCommandOverride GDB set commands with the context from GEF.
+GefSetCommand.__init____init__() → None
+GefSetCommand.invokeinvoke(args: Any, from_tty: bool) → None
+GefSettingBasic class for storing gef settings as objects
+GefSetting.__init____init__(
+ value: Any,
+ cls: Optional[type] = None,
+ description: Optional[str] = None,
+ hooks: Optional[Dict[str, Callable]] = None
+) → None
+GefSettingsManagerGefSettings acts as a dict where the global settings are stored and can be read, written or deleted as any other dict. For instance, to read a specific command setting: gef.config[mycommand.mysetting]
GefSettingsManager.raw_entryraw_entry(name: str) → GefSetting
+GefThemeCommandCustomize GEF appearance.
+GefThemeCommand.__init____init__() → None
+Return the list of settings for this command.
+GefThemeCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
GefThemeCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
GefThemeCommand.do_invokedo_invoke(args: List[str]) → None
+GefThemeCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
GefThemeCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
GefThemeCommand.invokeinvoke(args: str, from_tty: bool) → None
+GefThemeCommand.post_loadpost_load() → None
+GefThemeCommand.pre_loadpre_load() → None
+GefThemeCommand.usageusage() → None
+GefTmuxSetupSetup a confortable tmux debugging environment.
+GefTmuxSetup.__init____init__() → None
+GefTmuxSetup.invokeinvoke(args: Any, from_tty: bool) → None
+GefTmuxSetup.screen_setupscreen_setup() → None
+Hackish equivalent of the tmux_setup() function for screen.
+GefTmuxSetup.tmux_setuptmux_setup() → None
+Prepare the tmux environment by vertically splitting the current pane, and forcing the context to be redirected there.
+GefUiManagerClass managing UI settings.
+GefUiManager.__init____init__() → None
+GefUiManager.reset_cachesreset_caches() → None
+Reset the LRU-cached attributes
+GenericArchitectureGenericArchitecture.canary_addresscanary_address() → int
+GenericArchitecture.flag_register_to_humanflag_register_to_human(val: Optional[int] = None) → str
+GenericArchitecture.get_ith_parameterget_ith_parameter(i: int, in_func: bool = True) → Tuple[str, Optional[int]]
+Retrieves the correct parameter used for the current function call.
+GenericArchitecture.get_raget_ra(insn: __main__.Instruction, frame: 'gdb.Frame') → Optional[int]
+GenericArchitecture.is_branch_takenis_branch_taken(insn: __main__.Instruction) → Tuple[bool, str]
+GenericArchitecture.is_callis_call(insn: __main__.Instruction) → bool
+GenericArchitecture.is_conditional_branchis_conditional_branch(insn: __main__.Instruction) → bool
+GenericArchitecture.is_retis_ret(insn: __main__.Instruction) → bool
+GenericArchitecture.mprotect_asmmprotect_asm(addr: int, size: int, perm: __main__.Permission) → str
+GenericArchitecture.registerregister(name: str) → int
+GenericArchitecture.reset_cachesreset_caches() → None
+GenericArchitecture.supports_gdb_archsupports_gdb_arch(gdb_arch: str) → Optional[bool]
+If implemented by a child Architecture, this function dictates if the current class supports the loaded ELF file (which can be accessed via gef.binary). This callback function will override any assumption made by GEF to determine the architecture.
GenericCommandThis is an abstract class for invoking commands, should not be instantiated.
+GenericCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+GenericCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
GenericCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
GenericCommand.do_invokedo_invoke(argv: List[str]) → None
+GenericCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
GenericCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
GenericCommand.invokeinvoke(args: str, from_tty: bool) → None
+GenericCommand.post_loadpost_load() → None
+GenericCommand.pre_loadpre_load() → None
+GenericCommand.usageusage() → None
+GenericFunctionThis is an abstract class for invoking convenience functions, should not be instantiated.
+GenericFunction.__init____init__() → None
+GenericFunction.arg_to_longarg_to_long(args: List, index: int, default: int = 0) → int
+GenericFunction.do_invokedo_invoke(args: Any) → int
+GenericFunction.invokeinvoke(*args: Any) → int
+GlibcArenaGlibc arena class
+GlibcArena.__init____init__(addr: str) → None
+GlibcArena.binbin(i: int) → Tuple[int, int]
+GlibcArena.bin_atbin_at(i) → int
+GlibcArena.fastbinfastbin(i: int) → Optional[ForwardRef('GlibcFastChunk')]
+Return head chunk in fastbinsY[i].
+GlibcArena.get_heap_for_ptrget_heap_for_ptr(ptr: int) → int
+Find the corresponding heap for a given pointer (int). See https://github.com/bminor/glibc/blob/glibc-2.34/malloc/arena.c#L129
+GlibcArena.get_heap_info_listget_heap_info_list() → Optional[List[__main__.GlibcHeapInfo]]
+GlibcArena.heap_addrheap_addr(allow_unaligned: bool = False) → Optional[int]
+GlibcArena.is_main_arenais_main_arena() → bool
+GlibcArena.malloc_state_tmalloc_state_t() → Type[_ctypes.Structure]
+GlibcArena.resetreset()
+GlibcArena.verifyverify(addr: int) → bool
+Verify that the address matches a possible valid GlibcArena
+GlibcChunkGlibc chunk class. The default behavior (from_base=False) is to interpret the data starting at the memory address pointed to as the chunk data. Setting from_base to True instead treats that data as the chunk header. Ref: https://sploitfun.wordpress.com/2015/02/10/understanding-glibc-malloc/.
+GlibcChunk.__init____init__(
+ addr: int,
+ from_base: bool = False,
+ allow_unaligned: bool = True
+) → None
+GlibcChunk.get_next_chunkget_next_chunk(allow_unaligned: bool = False) → GlibcChunk
+GlibcChunk.get_next_chunk_addrget_next_chunk_addr() → int
+GlibcChunk.get_prev_chunk_sizeget_prev_chunk_size() → int
+GlibcChunk.get_usable_sizeget_usable_size() → int
+GlibcChunk.has_m_bithas_m_bit() → bool
+GlibcChunk.has_n_bithas_n_bit() → bool
+GlibcChunk.has_p_bithas_p_bit() → bool
+GlibcChunk.is_usedis_used() → bool
+Check if the current block is used by: +- checking the M bit is true +- or checking that next chunk PREV_INUSE flag is true
+GlibcChunk.malloc_chunk_tmalloc_chunk_t() → Type[_ctypes.Structure]
+GlibcChunk.psprintpsprint() → str
+GlibcChunk.resetreset()
+GlibcFastChunkGlibcFastChunk.__init____init__(
+ addr: int,
+ from_base: bool = False,
+ allow_unaligned: bool = True
+) → None
+GlibcFastChunk.get_next_chunkget_next_chunk(allow_unaligned: bool = False) → GlibcChunk
+GlibcFastChunk.get_next_chunk_addrget_next_chunk_addr() → int
+GlibcFastChunk.get_prev_chunk_sizeget_prev_chunk_size() → int
+GlibcFastChunk.get_usable_sizeget_usable_size() → int
+GlibcFastChunk.has_m_bithas_m_bit() → bool
+GlibcFastChunk.has_n_bithas_n_bit() → bool
+GlibcFastChunk.has_p_bithas_p_bit() → bool
+GlibcFastChunk.is_usedis_used() → bool
+Check if the current block is used by: +- checking the M bit is true +- or checking that next chunk PREV_INUSE flag is true
+GlibcFastChunk.malloc_chunk_tmalloc_chunk_t() → Type[_ctypes.Structure]
+GlibcFastChunk.protect_ptrprotect_ptr(pos: int, pointer: int) → int
+https://elixir.bootlin.com/glibc/glibc-2.32/source/malloc/malloc.c#L339
+GlibcFastChunk.psprintpsprint() → str
+GlibcFastChunk.resetreset()
+GlibcFastChunk.reveal_ptrreveal_ptr(pointer: int) → int
+https://elixir.bootlin.com/glibc/glibc-2.32/source/malloc/malloc.c#L341
+GlibcHeapArenaCommandDisplay information on a heap chunk.
+GlibcHeapArenaCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+GlibcHeapArenaCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
GlibcHeapArenaCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
GlibcHeapArenaCommand.do_invokedo_invoke(_: List[str]) → None
+GlibcHeapArenaCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
GlibcHeapArenaCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
GlibcHeapArenaCommand.invokeinvoke(args: str, from_tty: bool) → None
+GlibcHeapArenaCommand.post_loadpost_load() → None
+GlibcHeapArenaCommand.pre_loadpre_load() → None
+GlibcHeapArenaCommand.usageusage() → None
+GlibcHeapBinsCommandDisplay information on the bins on an arena (default: main_arena). See https://github.com/sploitfun/lsploits/blob/master/glibc/malloc/malloc.c#L1123.
+GlibcHeapBinsCommand.__init____init__() → None
+Return the list of settings for this command.
+GlibcHeapBinsCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
GlibcHeapBinsCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
GlibcHeapBinsCommand.do_invokedo_invoke(argv: List[str]) → None
+GlibcHeapBinsCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
GlibcHeapBinsCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
GlibcHeapBinsCommand.invokeinvoke(args: str, from_tty: bool) → None
+GlibcHeapBinsCommand.post_loadpost_load() → None
+GlibcHeapBinsCommand.pprint_binpprint_bin(arena_addr: str, index: int, _type: str = '') → int
+GlibcHeapBinsCommand.pre_loadpre_load() → None
+GlibcHeapBinsCommand.usageusage() → None
+GlibcHeapChunkCommandDisplay information on a heap chunk. See https://github.com/sploitfun/lsploits/blob/master/glibc/malloc/malloc.c#L1123.
+GlibcHeapChunkCommand.__init____init__() → None
+Return the list of settings for this command.
+GlibcHeapChunkCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
GlibcHeapChunkCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
GlibcHeapChunkCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+GlibcHeapChunkCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
GlibcHeapChunkCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
GlibcHeapChunkCommand.invokeinvoke(args: str, from_tty: bool) → None
+GlibcHeapChunkCommand.post_loadpost_load() → None
+GlibcHeapChunkCommand.pre_loadpre_load() → None
+GlibcHeapChunkCommand.usageusage() → None
+GlibcHeapChunksCommandDisplay all heap chunks for the current arena. As an optional argument the base address of a different arena can be passed
+GlibcHeapChunksCommand.__init____init__() → None
+Return the list of settings for this command.
+GlibcHeapChunksCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
GlibcHeapChunksCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
GlibcHeapChunksCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+GlibcHeapChunksCommand.dump_chunks_arenadump_chunks_arena(
+ arena: __main__.GlibcArena,
+ print_arena: bool = False,
+ allow_unaligned: bool = False
+) → None
+GlibcHeapChunksCommand.dump_chunks_heapdump_chunks_heap(
+ start: int,
+ end: int,
+ arena: __main__.GlibcArena,
+ allow_unaligned: bool = False
+) → bool
+GlibcHeapChunksCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
GlibcHeapChunksCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
GlibcHeapChunksCommand.invokeinvoke(args: str, from_tty: bool) → None
+GlibcHeapChunksCommand.post_loadpost_load() → None
+GlibcHeapChunksCommand.pre_loadpre_load() → None
+GlibcHeapChunksCommand.usageusage() → None
+GlibcHeapCommandBase command to get information about the Glibc heap structure.
+GlibcHeapCommand.__init____init__() → None
+Return the list of settings for this command.
+GlibcHeapCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
GlibcHeapCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
GlibcHeapCommand.do_invokedo_invoke(_: List[str]) → None
+GlibcHeapCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
GlibcHeapCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
GlibcHeapCommand.invokeinvoke(args: str, from_tty: bool) → None
+GlibcHeapCommand.post_loadpost_load() → None
+GlibcHeapCommand.pre_loadpre_load() → None
+GlibcHeapCommand.usageusage() → None
+GlibcHeapFastbinsYCommandDisplay information on the fastbinsY on an arena (default: main_arena). See https://github.com/sploitfun/lsploits/blob/master/glibc/malloc/malloc.c#L1123.
+GlibcHeapFastbinsYCommand.__init____init__() → None
+Return the list of settings for this command.
+GlibcHeapFastbinsYCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
GlibcHeapFastbinsYCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
GlibcHeapFastbinsYCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+GlibcHeapFastbinsYCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
GlibcHeapFastbinsYCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
GlibcHeapFastbinsYCommand.invokeinvoke(args: str, from_tty: bool) → None
+GlibcHeapFastbinsYCommand.post_loadpost_load() → None
+GlibcHeapFastbinsYCommand.pre_loadpre_load() → None
+GlibcHeapFastbinsYCommand.usageusage() → None
+GlibcHeapInfoGlibc heap_info struct
+GlibcHeapInfo.__init____init__(addr: Union[str, int]) → None
+GlibcHeapInfo.heap_info_theap_info_t() → Type[_ctypes.Structure]
+GlibcHeapInfo.resetreset()
+GlibcHeapLargeBinsCommandConvenience command for viewing large bins.
+GlibcHeapLargeBinsCommand.__init____init__() → None
+Return the list of settings for this command.
+GlibcHeapLargeBinsCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
GlibcHeapLargeBinsCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
GlibcHeapLargeBinsCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+GlibcHeapLargeBinsCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
GlibcHeapLargeBinsCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
GlibcHeapLargeBinsCommand.invokeinvoke(args: str, from_tty: bool) → None
+GlibcHeapLargeBinsCommand.post_loadpost_load() → None
+GlibcHeapLargeBinsCommand.pre_loadpre_load() → None
+GlibcHeapLargeBinsCommand.usageusage() → None
+GlibcHeapSetArenaCommandSet the address of the main_arena or the currently selected arena.
+GlibcHeapSetArenaCommand.__init____init__() → None
+Return the list of settings for this command.
+GlibcHeapSetArenaCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
GlibcHeapSetArenaCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
GlibcHeapSetArenaCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+GlibcHeapSetArenaCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
GlibcHeapSetArenaCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
GlibcHeapSetArenaCommand.invokeinvoke(args: str, from_tty: bool) → None
+GlibcHeapSetArenaCommand.post_loadpost_load() → None
+GlibcHeapSetArenaCommand.pre_loadpre_load() → None
+GlibcHeapSetArenaCommand.usageusage() → None
+GlibcHeapSmallBinsCommandConvenience command for viewing small bins.
+GlibcHeapSmallBinsCommand.__init____init__() → None
+Return the list of settings for this command.
+GlibcHeapSmallBinsCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
GlibcHeapSmallBinsCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
GlibcHeapSmallBinsCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+GlibcHeapSmallBinsCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
GlibcHeapSmallBinsCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
GlibcHeapSmallBinsCommand.invokeinvoke(args: str, from_tty: bool) → None
+GlibcHeapSmallBinsCommand.post_loadpost_load() → None
+GlibcHeapSmallBinsCommand.pre_loadpre_load() → None
+GlibcHeapSmallBinsCommand.usageusage() → None
+GlibcHeapTcachebinsCommandDisplay information on the Tcachebins on an arena (default: main_arena). See https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=d5c3fafc4307c9b7a4c7d5cb381fcdbfad340bcc.
+GlibcHeapTcachebinsCommand.__init____init__() → None
+Return the list of settings for this command.
+GlibcHeapTcachebinsCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
GlibcHeapTcachebinsCommand.check_thread_idscheck_thread_ids(tids: List[int]) → List[int]
+Return the subset of tids that are currently valid.
+GlibcHeapTcachebinsCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
GlibcHeapTcachebinsCommand.do_invokedo_invoke(argv: List[str]) → None
+GlibcHeapTcachebinsCommand.find_tcachefind_tcache() → int
+Return the location of the current thread's tcache.
+GlibcHeapTcachebinsCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
GlibcHeapTcachebinsCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
GlibcHeapTcachebinsCommand.invokeinvoke(args: str, from_tty: bool) → None
+GlibcHeapTcachebinsCommand.post_loadpost_load() → None
+GlibcHeapTcachebinsCommand.pre_loadpre_load() → None
+GlibcHeapTcachebinsCommand.tcachebintcachebin(
+ tcache_base: int,
+ i: int
+) → Tuple[Optional[__main__.GlibcTcacheChunk], int]
+Return the head chunk in tcache[i] and the number of chunks in the bin.
+GlibcHeapTcachebinsCommand.usageusage() → None
+GlibcHeapUnsortedBinsCommandDisplay information on the Unsorted Bins of an arena (default: main_arena). See: https://github.com/sploitfun/lsploits/blob/master/glibc/malloc/malloc.c#L1689.
+GlibcHeapUnsortedBinsCommand.__init____init__() → None
+Return the list of settings for this command.
+GlibcHeapUnsortedBinsCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
GlibcHeapUnsortedBinsCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
GlibcHeapUnsortedBinsCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+GlibcHeapUnsortedBinsCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
GlibcHeapUnsortedBinsCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
GlibcHeapUnsortedBinsCommand.invokeinvoke(args: str, from_tty: bool) → None
+GlibcHeapUnsortedBinsCommand.post_loadpost_load() → None
+GlibcHeapUnsortedBinsCommand.pre_loadpre_load() → None
+GlibcHeapUnsortedBinsCommand.usageusage() → None
+GlibcTcacheChunkGlibcTcacheChunk.__init____init__(
+ addr: int,
+ from_base: bool = False,
+ allow_unaligned: bool = True
+) → None
+GlibcTcacheChunk.get_next_chunkget_next_chunk(allow_unaligned: bool = False) → GlibcChunk
+GlibcTcacheChunk.get_next_chunk_addrget_next_chunk_addr() → int
+GlibcTcacheChunk.get_prev_chunk_sizeget_prev_chunk_size() → int
+GlibcTcacheChunk.get_usable_sizeget_usable_size() → int
+GlibcTcacheChunk.has_m_bithas_m_bit() → bool
+GlibcTcacheChunk.has_n_bithas_n_bit() → bool
+GlibcTcacheChunk.has_p_bithas_p_bit() → bool
+GlibcTcacheChunk.is_usedis_used() → bool
+Check if the current block is used by: +- checking the M bit is true +- or checking that next chunk PREV_INUSE flag is true
+GlibcTcacheChunk.malloc_chunk_tmalloc_chunk_t() → Type[_ctypes.Structure]
+GlibcTcacheChunk.protect_ptrprotect_ptr(pos: int, pointer: int) → int
+https://elixir.bootlin.com/glibc/glibc-2.32/source/malloc/malloc.c#L339
+GlibcTcacheChunk.psprintpsprint() → str
+GlibcTcacheChunk.resetreset()
+GlibcTcacheChunk.reveal_ptrreveal_ptr(pointer: int) → int
+https://elixir.bootlin.com/glibc/glibc-2.32/source/malloc/malloc.c#L341
+GotBaseFunctionReturn the current GOT base address plus the given offset.
+GotBaseFunction.__init____init__() → None
+GotBaseFunction.arg_to_longarg_to_long(args: List, index: int, default: int = 0) → int
+GotBaseFunction.do_invokedo_invoke(args: List) → int
+GotBaseFunction.invokeinvoke(*args: Any) → int
+GotCommandDisplay current status of the got inside the process.
+GotCommand.__init____init__()
+Return the list of settings for this command.
+GotCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
GotCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
GotCommand.do_invokedo_invoke(argv: List[str]) → None
+GotCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
GotCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
GotCommand.invokeinvoke(args: str, from_tty: bool) → None
+GotCommand.post_loadpost_load() → None
+GotCommand.pre_loadpre_load() → None
+GotCommand.usageusage() → None
+HeapAnalysisCommandHeap vulnerability analysis helper: this command aims to track dynamic heap allocation done through malloc()/free() to provide some insights on possible heap vulnerabilities. The following vulnerabilities are checked: +- NULL free +- Use-after-Free +- Double Free +- Heap overlap
+HeapAnalysisCommand.__init____init__() → None
+Return the list of settings for this command.
+HeapAnalysisCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
HeapAnalysisCommand.cleanclean(_: 'gdb.Event') → None
+HeapAnalysisCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
HeapAnalysisCommand.do_invokedo_invoke(argv: List[str]) → None
+HeapAnalysisCommand.dump_tracked_allocationsdump_tracked_allocations() → None
+HeapAnalysisCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
HeapAnalysisCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
HeapAnalysisCommand.invokeinvoke(args: str, from_tty: bool) → None
+HeapAnalysisCommand.post_loadpost_load() → None
+HeapAnalysisCommand.pre_loadpre_load() → None
+HeapAnalysisCommand.setupsetup() → None
+HeapAnalysisCommand.usageusage() → None
+HeapBaseFunctionReturn the current heap base address plus an optional offset.
+HeapBaseFunction.__init____init__() → None
+HeapBaseFunction.arg_to_longarg_to_long(args: List, index: int, default: int = 0) → int
+HeapBaseFunction.do_invokedo_invoke(args: List) → int
+HeapBaseFunction.invokeinvoke(*args: Any) → int
+HexdumpByteCommandDisplay SIZE lines of hexdump as BYTE from the memory location pointed by ADDRESS.
+HexdumpByteCommand.__init____init__() → None
+Return the list of settings for this command.
+HexdumpByteCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
HexdumpByteCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
HexdumpByteCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+HexdumpByteCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
HexdumpByteCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
HexdumpByteCommand.invokeinvoke(args: str, from_tty: bool) → None
+HexdumpByteCommand.post_loadpost_load() → None
+HexdumpByteCommand.pre_loadpre_load() → None
+HexdumpByteCommand.usageusage() → None
+HexdumpCommandDisplay SIZE lines of hexdump from the memory location pointed by LOCATION.
+HexdumpCommand.__init____init__() → None
+Return the list of settings for this command.
+HexdumpCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
HexdumpCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
HexdumpCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+HexdumpCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
HexdumpCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
HexdumpCommand.invokeinvoke(args: str, from_tty: bool) → None
+HexdumpCommand.post_loadpost_load() → None
+HexdumpCommand.pre_loadpre_load() → None
+HexdumpCommand.usageusage() → None
+HexdumpDwordCommandDisplay SIZE lines of hexdump as DWORD from the memory location pointed by ADDRESS.
+HexdumpDwordCommand.__init____init__() → None
+Return the list of settings for this command.
+HexdumpDwordCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
HexdumpDwordCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
HexdumpDwordCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+HexdumpDwordCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
HexdumpDwordCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
HexdumpDwordCommand.invokeinvoke(args: str, from_tty: bool) → None
+HexdumpDwordCommand.post_loadpost_load() → None
+HexdumpDwordCommand.pre_loadpre_load() → None
+HexdumpDwordCommand.usageusage() → None
+HexdumpQwordCommandDisplay SIZE lines of hexdump as QWORD from the memory location pointed by ADDRESS.
+HexdumpQwordCommand.__init____init__() → None
+Return the list of settings for this command.
+HexdumpQwordCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
HexdumpQwordCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
HexdumpQwordCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+HexdumpQwordCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
HexdumpQwordCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
HexdumpQwordCommand.invokeinvoke(args: str, from_tty: bool) → None
+HexdumpQwordCommand.post_loadpost_load() → None
+HexdumpQwordCommand.pre_loadpre_load() → None
+HexdumpQwordCommand.usageusage() → None
+HexdumpWordCommandDisplay SIZE lines of hexdump as WORD from the memory location pointed by ADDRESS.
+HexdumpWordCommand.__init____init__() → None
+Return the list of settings for this command.
+HexdumpWordCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
HexdumpWordCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
HexdumpWordCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+HexdumpWordCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
HexdumpWordCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
HexdumpWordCommand.invokeinvoke(args: str, from_tty: bool) → None
+HexdumpWordCommand.post_loadpost_load() → None
+HexdumpWordCommand.pre_loadpre_load() → None
+HexdumpWordCommand.usageusage() → None
+HighlightAddCommandAdd a match to the highlight table.
+HighlightAddCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+HighlightAddCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
HighlightAddCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
HighlightAddCommand.do_invokedo_invoke(argv: List[str]) → None
+HighlightAddCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
HighlightAddCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
HighlightAddCommand.invokeinvoke(args: str, from_tty: bool) → None
+HighlightAddCommand.post_loadpost_load() → None
+HighlightAddCommand.pre_loadpre_load() → None
+HighlightAddCommand.usageusage() → None
+HighlightClearCommandClear the highlight table, remove all matches.
+HighlightClearCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+HighlightClearCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
HighlightClearCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
HighlightClearCommand.do_invokedo_invoke(_: List[str]) → None
+HighlightClearCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
HighlightClearCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
HighlightClearCommand.invokeinvoke(args: str, from_tty: bool) → None
+HighlightClearCommand.post_loadpost_load() → None
+HighlightClearCommand.pre_loadpre_load() → None
+HighlightClearCommand.usageusage() → None
+HighlightCommandHighlight user-defined text matches in GEF output universally.
+HighlightCommand.__init____init__() → None
+Return the list of settings for this command.
+HighlightCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
HighlightCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
HighlightCommand.do_invokedo_invoke(_: List[str]) → None
+HighlightCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
HighlightCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
HighlightCommand.invokeinvoke(args: str, from_tty: bool) → None
+HighlightCommand.post_loadpost_load() → None
+HighlightCommand.pre_loadpre_load() → None
+HighlightCommand.usageusage() → None
+HighlightListCommandShow the current highlight table with matches to colors.
+HighlightListCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+HighlightListCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
HighlightListCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
HighlightListCommand.do_invokedo_invoke(_: List[str]) → None
+HighlightListCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
HighlightListCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
HighlightListCommand.invokeinvoke(args: str, from_tty: bool) → None
+HighlightListCommand.post_loadpost_load() → None
+HighlightListCommand.pre_loadpre_load() → None
+HighlightListCommand.print_highlight_tableprint_highlight_table() → None
+HighlightListCommand.usageusage() → None
+HighlightRemoveCommandRemove a match in the highlight table.
+HighlightRemoveCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+HighlightRemoveCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
HighlightRemoveCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
HighlightRemoveCommand.do_invokedo_invoke(argv: List[str]) → None
+HighlightRemoveCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
HighlightRemoveCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
HighlightRemoveCommand.invokeinvoke(args: str, from_tty: bool) → None
+HighlightRemoveCommand.post_loadpost_load() → None
+HighlightRemoveCommand.pre_loadpre_load() → None
+HighlightRemoveCommand.usageusage() → None
+InstructionGEF representation of a CPU instruction.
+Instruction.__init____init__(
+ address: int,
+ location: str,
+ mnemo: str,
+ operands: List[str],
+ opcodes: bytes
+) → None
+Instruction.is_validis_valid() → bool
+Instruction.nextnext() → Instruction
+Instruction.sizesize() → int
+MIPSMIPS.canary_addresscanary_address() → int
+MIPS.flag_register_to_humanflag_register_to_human(val: Optional[int] = None) → str
+MIPS.get_ith_parameterget_ith_parameter(i: int, in_func: bool = True) → Tuple[str, Optional[int]]
+Retrieves the correct parameter used for the current function call.
+MIPS.get_raget_ra(insn: __main__.Instruction, frame: 'gdb.Frame') → Optional[int]
+MIPS.is_branch_takenis_branch_taken(insn: __main__.Instruction) → Tuple[bool, str]
+MIPS.is_callis_call(insn: __main__.Instruction) → bool
+MIPS.is_conditional_branchis_conditional_branch(insn: __main__.Instruction) → bool
+MIPS.is_retis_ret(insn: __main__.Instruction) → bool
+MIPS.mprotect_asmmprotect_asm(addr: int, size: int, perm: __main__.Permission) → str
+MIPS.registerregister(name: str) → int
+MIPS.reset_cachesreset_caches() → None
+MIPS.supports_gdb_archsupports_gdb_arch(gdb_arch: str) → Optional[bool]
+If implemented by a child Architecture, this function dictates if the current class supports the loaded ELF file (which can be accessed via gef.binary). This callback function will override any assumption made by GEF to determine the architecture.
MIPS64MIPS64.canary_addresscanary_address() → int
+MIPS64.flag_register_to_humanflag_register_to_human(val: Optional[int] = None) → str
+MIPS64.get_ith_parameterget_ith_parameter(i: int, in_func: bool = True) → Tuple[str, Optional[int]]
+Retrieves the correct parameter used for the current function call.
+MIPS64.get_raget_ra(insn: __main__.Instruction, frame: 'gdb.Frame') → Optional[int]
+MIPS64.is_branch_takenis_branch_taken(insn: __main__.Instruction) → Tuple[bool, str]
+MIPS64.is_callis_call(insn: __main__.Instruction) → bool
+MIPS64.is_conditional_branchis_conditional_branch(insn: __main__.Instruction) → bool
+MIPS64.is_retis_ret(insn: __main__.Instruction) → bool
+MIPS64.mprotect_asmmprotect_asm(addr: int, size: int, perm: __main__.Permission) → str
+MIPS64.registerregister(name: str) → int
+MIPS64.reset_cachesreset_caches() → None
+MIPS64.supports_gdb_archsupports_gdb_arch(gdb_arch: str) → Optional[bool]
+MemoryCommandAdd or remove address ranges to the memory view.
+MemoryCommand.__init____init__() → None
+Return the list of settings for this command.
+MemoryCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
MemoryCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
MemoryCommand.do_invokedo_invoke(argv: List[str]) → None
+MemoryCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
MemoryCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
MemoryCommand.invokeinvoke(args: str, from_tty: bool) → None
+MemoryCommand.post_loadpost_load() → None
+MemoryCommand.pre_loadpre_load() → None
+MemoryCommand.usageusage() → None
+MemoryUnwatchCommandRemoves address ranges to the memory view.
+MemoryUnwatchCommand.__init____init__() → None
+Return the list of settings for this command.
+MemoryUnwatchCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
MemoryUnwatchCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
MemoryUnwatchCommand.do_invokedo_invoke(argv: List[str]) → None
+MemoryUnwatchCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
MemoryUnwatchCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
MemoryUnwatchCommand.invokeinvoke(args: str, from_tty: bool) → None
+MemoryUnwatchCommand.post_loadpost_load() → None
+MemoryUnwatchCommand.pre_loadpre_load() → None
+MemoryUnwatchCommand.usageusage() → None
+MemoryWatchCommandAdds address ranges to the memory view.
+MemoryWatchCommand.__init____init__() → None
+Return the list of settings for this command.
+MemoryWatchCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
MemoryWatchCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
MemoryWatchCommand.do_invokedo_invoke(argv: List[str]) → None
+MemoryWatchCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
MemoryWatchCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
MemoryWatchCommand.invokeinvoke(args: str, from_tty: bool) → None
+MemoryWatchCommand.post_loadpost_load() → None
+MemoryWatchCommand.pre_loadpre_load() → None
+MemoryWatchCommand.usageusage() → None
+MemoryWatchListCommandLists all watchpoints to display in context layout.
+MemoryWatchListCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+MemoryWatchListCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
MemoryWatchListCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
MemoryWatchListCommand.do_invokedo_invoke(_: List[str]) → None
+MemoryWatchListCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
MemoryWatchListCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
MemoryWatchListCommand.invokeinvoke(args: str, from_tty: bool) → None
+MemoryWatchListCommand.post_loadpost_load() → None
+MemoryWatchListCommand.pre_loadpre_load() → None
+MemoryWatchListCommand.usageusage() → None
+MemoryWatchResetCommandRemoves all watchpoints.
+MemoryWatchResetCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+MemoryWatchResetCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
MemoryWatchResetCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
MemoryWatchResetCommand.do_invokedo_invoke(_: List[str]) → None
+MemoryWatchResetCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
MemoryWatchResetCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
MemoryWatchResetCommand.invokeinvoke(args: str, from_tty: bool) → None
+MemoryWatchResetCommand.post_loadpost_load() → None
+MemoryWatchResetCommand.pre_loadpre_load() → None
+MemoryWatchResetCommand.usageusage() → None
+NamedBreakpointBreakpoint which shows a specified name, when hit.
+NamedBreakpoint.__init____init__(location: str, name: str) → None
+NamedBreakpoint.stopstop() → bool
+NamedBreakpointCommandSets a breakpoint and assigns a name to it, which will be shown, when it's hit.
+NamedBreakpointCommand.__init____init__() → None
+Return the list of settings for this command.
+NamedBreakpointCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
NamedBreakpointCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
NamedBreakpointCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+NamedBreakpointCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
NamedBreakpointCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
NamedBreakpointCommand.invokeinvoke(args: str, from_tty: bool) → None
+NamedBreakpointCommand.post_loadpost_load() → None
+NamedBreakpointCommand.pre_loadpre_load() → None
+NamedBreakpointCommand.usageusage() → None
+NopCommandPatch the instruction(s) pointed by parameters with NOP. Note: this command is architecture aware.
+NopCommand.__init____init__() → None
+Return the list of settings for this command.
+NopCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
NopCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
NopCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+NopCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
NopCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
NopCommand.invokeinvoke(args: str, from_tty: bool) → None
+NopCommand.post_loadpost_load() → None
+NopCommand.pre_loadpre_load() → None
+NopCommand.usageusage() → None
+PCustomCommandDump user defined structure. This command attempts to reproduce WinDBG awesome dt command for GDB and allows to apply structures (from symbols or custom) directly to an address. Custom structures can be defined in pure Python using ctypes, and should be stored in a specific directory, whose path must be stored in the pcustom.struct_path configuration setting.
PCustomCommand.__init____init__() → None
+Return the list of settings for this command.
+PCustomCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
PCustomCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
PCustomCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+PCustomCommand.explode_typeexplode_type(arg: str) → Tuple[str, str]
+PCustomCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
PCustomCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
PCustomCommand.invokeinvoke(args: str, from_tty: bool) → None
+PCustomCommand.post_loadpost_load() → None
+PCustomCommand.pre_loadpre_load() → None
+PCustomCommand.usageusage() → None
+PCustomEditCommandPCustom: edit the content of a given structure
+PCustomEditCommand.__init____init__() → None
+Return the list of settings for this command.
+PCustomEditCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
PCustomEditCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
PCustomEditCommand.do_invokedo_invoke(argv: List[str]) → None
+PCustomEditCommand.explode_typeexplode_type(arg: str) → Tuple[str, str]
+PCustomEditCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
PCustomEditCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
PCustomEditCommand.invokeinvoke(args: str, from_tty: bool) → None
+PCustomEditCommand.post_loadpost_load() → None
+PCustomEditCommand.pre_loadpre_load() → None
+PCustomEditCommand.usageusage() → None
+PCustomListCommandPCustom: list available structures
+PCustomListCommand.__init____init__() → None
+Return the list of settings for this command.
+PCustomListCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
PCustomListCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
PCustomListCommand.do_invokedo_invoke(_: List) → None
+Dump the list of all the structures and their respective.
+PCustomListCommand.explode_typeexplode_type(arg: str) → Tuple[str, str]
+PCustomListCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
PCustomListCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
PCustomListCommand.invokeinvoke(args: str, from_tty: bool) → None
+PCustomListCommand.post_loadpost_load() → None
+PCustomListCommand.pre_loadpre_load() → None
+PCustomListCommand.usageusage() → None
+PCustomShowCommandPCustom: show the content of a given structure
+PCustomShowCommand.__init____init__() → None
+Return the list of settings for this command.
+PCustomShowCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
PCustomShowCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
PCustomShowCommand.do_invokedo_invoke(argv: List[str]) → None
+PCustomShowCommand.explode_typeexplode_type(arg: str) → Tuple[str, str]
+PCustomShowCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
PCustomShowCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
PCustomShowCommand.invokeinvoke(args: str, from_tty: bool) → None
+PCustomShowCommand.post_loadpost_load() → None
+PCustomShowCommand.pre_loadpre_load() → None
+PCustomShowCommand.usageusage() → None
+PatchByteCommandWrite specified BYTE to the specified address.
+PatchByteCommand.__init____init__() → None
+Return the list of settings for this command.
+PatchByteCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
PatchByteCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
PatchByteCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+PatchByteCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
PatchByteCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
PatchByteCommand.invokeinvoke(args: str, from_tty: bool) → None
+PatchByteCommand.post_loadpost_load() → None
+PatchByteCommand.pre_loadpre_load() → None
+PatchByteCommand.usageusage() → None
+PatchCommandWrite specified values to the specified address.
+PatchCommand.__init____init__() → None
+Return the list of settings for this command.
+PatchCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
PatchCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
PatchCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+PatchCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
PatchCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
PatchCommand.invokeinvoke(args: str, from_tty: bool) → None
+PatchCommand.post_loadpost_load() → None
+PatchCommand.pre_loadpre_load() → None
+PatchCommand.usageusage() → None
+PatchDwordCommandWrite specified DWORD to the specified address.
+PatchDwordCommand.__init____init__() → None
+Return the list of settings for this command.
+PatchDwordCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
PatchDwordCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
PatchDwordCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+PatchDwordCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
PatchDwordCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
PatchDwordCommand.invokeinvoke(args: str, from_tty: bool) → None
+PatchDwordCommand.post_loadpost_load() → None
+PatchDwordCommand.pre_loadpre_load() → None
+PatchDwordCommand.usageusage() → None
+PatchQwordCommandWrite specified QWORD to the specified address.
+PatchQwordCommand.__init____init__() → None
+Return the list of settings for this command.
+PatchQwordCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
PatchQwordCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
PatchQwordCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+PatchQwordCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
PatchQwordCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
PatchQwordCommand.invokeinvoke(args: str, from_tty: bool) → None
+PatchQwordCommand.post_loadpost_load() → None
+PatchQwordCommand.pre_loadpre_load() → None
+PatchQwordCommand.usageusage() → None
+PatchStringCommandWrite specified string to the specified memory location pointed by ADDRESS.
+PatchStringCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+PatchStringCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
PatchStringCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
PatchStringCommand.do_invokedo_invoke(argv: List[str]) → None
+PatchStringCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
PatchStringCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
PatchStringCommand.invokeinvoke(args: str, from_tty: bool) → None
+PatchStringCommand.post_loadpost_load() → None
+PatchStringCommand.pre_loadpre_load() → None
+PatchStringCommand.usageusage() → None
+PatchWordCommandWrite specified WORD to the specified address.
+PatchWordCommand.__init____init__() → None
+Return the list of settings for this command.
+PatchWordCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
PatchWordCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
PatchWordCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+PatchWordCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
PatchWordCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
PatchWordCommand.invokeinvoke(args: str, from_tty: bool) → None
+PatchWordCommand.post_loadpost_load() → None
+PatchWordCommand.pre_loadpre_load() → None
+PatchWordCommand.usageusage() → None
+PatternCommandGenerate or Search a De Bruijn Sequence of unique substrings of length N and a total length of LENGTH. The default value of N is set to match the currently loaded architecture.
+PatternCommand.__init____init__() → None
+Return the list of settings for this command.
+PatternCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
PatternCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
PatternCommand.do_invokedo_invoke(_: List[str]) → None
+PatternCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
PatternCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
PatternCommand.invokeinvoke(args: str, from_tty: bool) → None
+PatternCommand.post_loadpost_load() → None
+PatternCommand.pre_loadpre_load() → None
+PatternCommand.usageusage() → None
+PatternCreateCommandGenerate a De Bruijn Sequence of unique substrings of length N and a total length of LENGTH. The default value of N is set to match the currently loaded architecture.
+PatternCreateCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+PatternCreateCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
PatternCreateCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
PatternCreateCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+PatternCreateCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
PatternCreateCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
PatternCreateCommand.invokeinvoke(args: str, from_tty: bool) → None
+PatternCreateCommand.post_loadpost_load() → None
+PatternCreateCommand.pre_loadpre_load() → None
+PatternCreateCommand.usageusage() → None
+PatternSearchCommandSearch a De Bruijn Sequence of unique substrings of length N and a maximum total length of MAX_LENGTH. The default value of N is set to match the currently loaded architecture. The PATTERN argument can be a GDB symbol (such as a register name), a string or a hexadecimal value
+PatternSearchCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+PatternSearchCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
PatternSearchCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
PatternSearchCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+PatternSearchCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
PatternSearchCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
PatternSearchCommand.invokeinvoke(args: str, from_tty: bool) → None
+PatternSearchCommand.post_loadpost_load() → None
+PatternSearchCommand.pre_loadpre_load() → None
+PatternSearchCommand.searchsearch(pattern: str, size: int, period: int) → None
+PatternSearchCommand.usageusage() → None
+PermissionGEF representation of Linux permission.
+PhdrPhdr.__init____init__(elf: __main__.Elf, off: int) → None
+PieAttachCommandDo attach with PIE breakpoint support.
+PieAttachCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+PieAttachCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
PieAttachCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
PieAttachCommand.do_invokedo_invoke(argv: List[str]) → None
+PieAttachCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
PieAttachCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
PieAttachCommand.invokeinvoke(args: str, from_tty: bool) → None
+PieAttachCommand.post_loadpost_load() → None
+PieAttachCommand.pre_loadpre_load() → None
+PieAttachCommand.usageusage() → None
+PieBreakpointCommandSet a PIE breakpoint at an offset from the target binaries base address.
+PieBreakpointCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+PieBreakpointCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
PieBreakpointCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
PieBreakpointCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+PieBreakpointCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
PieBreakpointCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
PieBreakpointCommand.invokeinvoke(args: str, from_tty: bool) → None
+PieBreakpointCommand.post_loadpost_load() → None
+PieBreakpointCommand.pre_loadpre_load() → None
+PieBreakpointCommand.set_pie_breakpointset_pie_breakpoint(set_func: Callable[[int], str], addr: int) → None
+PieBreakpointCommand.usageusage() → None
+PieCommandPIE breakpoint support.
+PieCommand.__init____init__() → None
+Return the list of settings for this command.
+PieCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
PieCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
PieCommand.do_invokedo_invoke(argv: List[str]) → None
+PieCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
PieCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
PieCommand.invokeinvoke(args: str, from_tty: bool) → None
+PieCommand.post_loadpost_load() → None
+PieCommand.pre_loadpre_load() → None
+PieCommand.usageusage() → None
+PieDeleteCommandDelete a PIE breakpoint.
+PieDeleteCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+PieDeleteCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
PieDeleteCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
PieDeleteCommand.delete_bpdelete_bp(breakpoints: List[__main__.PieVirtualBreakpoint]) → None
+PieDeleteCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+PieDeleteCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
PieDeleteCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
PieDeleteCommand.invokeinvoke(args: str, from_tty: bool) → None
+PieDeleteCommand.post_loadpost_load() → None
+PieDeleteCommand.pre_loadpre_load() → None
+PieDeleteCommand.usageusage() → None
+PieInfoCommandDisplay breakpoint info.
+PieInfoCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+PieInfoCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
PieInfoCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
PieInfoCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+PieInfoCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
PieInfoCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
PieInfoCommand.invokeinvoke(args: str, from_tty: bool) → None
+PieInfoCommand.post_loadpost_load() → None
+PieInfoCommand.pre_loadpre_load() → None
+PieInfoCommand.usageusage() → None
+PieRemoteCommandAttach to a remote connection with PIE breakpoint support.
+PieRemoteCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+PieRemoteCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
PieRemoteCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
PieRemoteCommand.do_invokedo_invoke(argv: List[str]) → None
+PieRemoteCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
PieRemoteCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
PieRemoteCommand.invokeinvoke(args: str, from_tty: bool) → None
+PieRemoteCommand.post_loadpost_load() → None
+PieRemoteCommand.pre_loadpre_load() → None
+PieRemoteCommand.usageusage() → None
+PieRunCommandRun process with PIE breakpoint support.
+PieRunCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+PieRunCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
PieRunCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
PieRunCommand.do_invokedo_invoke(argv: List[str]) → None
+PieRunCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
PieRunCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
PieRunCommand.invokeinvoke(args: str, from_tty: bool) → None
+PieRunCommand.post_loadpost_load() → None
+PieRunCommand.pre_loadpre_load() → None
+PieRunCommand.usageusage() → None
+PieVirtualBreakpointPIE virtual breakpoint (not real breakpoint).
+PieVirtualBreakpoint.__init____init__(set_func: Callable[[int], str], vbp_num: int, addr: int) → None
+PieVirtualBreakpoint.destroydestroy() → None
+PieVirtualBreakpoint.instantiateinstantiate(base: int) → None
+PowerPCPowerPC.canary_addresscanary_address() → int
+PowerPC.flag_register_to_humanflag_register_to_human(val: Optional[int] = None) → str
+PowerPC.get_ith_parameterget_ith_parameter(i: int, in_func: bool = True) → Tuple[str, Optional[int]]
+Retrieves the correct parameter used for the current function call.
+PowerPC.get_raget_ra(insn: __main__.Instruction, frame: 'gdb.Frame') → Optional[int]
+PowerPC.is_branch_takenis_branch_taken(insn: __main__.Instruction) → Tuple[bool, str]
+PowerPC.is_callis_call(insn: __main__.Instruction) → bool
+PowerPC.is_conditional_branchis_conditional_branch(insn: __main__.Instruction) → bool
+PowerPC.is_retis_ret(insn: __main__.Instruction) → bool
+PowerPC.mprotect_asmmprotect_asm(addr: int, size: int, perm: __main__.Permission) → str
+PowerPC.registerregister(name: str) → int
+PowerPC.reset_cachesreset_caches() → None
+PowerPC.supports_gdb_archsupports_gdb_arch(gdb_arch: str) → Optional[bool]
+If implemented by a child Architecture, this function dictates if the current class supports the loaded ELF file (which can be accessed via gef.binary). This callback function will override any assumption made by GEF to determine the architecture.
PowerPC64PowerPC64.canary_addresscanary_address() → int
+PowerPC64.flag_register_to_humanflag_register_to_human(val: Optional[int] = None) → str
+PowerPC64.get_ith_parameterget_ith_parameter(i: int, in_func: bool = True) → Tuple[str, Optional[int]]
+Retrieves the correct parameter used for the current function call.
+PowerPC64.get_raget_ra(insn: __main__.Instruction, frame: 'gdb.Frame') → Optional[int]
+PowerPC64.is_branch_takenis_branch_taken(insn: __main__.Instruction) → Tuple[bool, str]
+PowerPC64.is_callis_call(insn: __main__.Instruction) → bool
+PowerPC64.is_conditional_branchis_conditional_branch(insn: __main__.Instruction) → bool
+PowerPC64.is_retis_ret(insn: __main__.Instruction) → bool
+PowerPC64.mprotect_asmmprotect_asm(addr: int, size: int, perm: __main__.Permission) → str
+PowerPC64.registerregister(name: str) → int
+PowerPC64.reset_cachesreset_caches() → None
+PowerPC64.supports_gdb_archsupports_gdb_arch(gdb_arch: str) → Optional[bool]
+If implemented by a child Architecture, this function dictates if the current class supports the loaded ELF file (which can be accessed via gef.binary). This callback function will override any assumption made by GEF to determine the architecture.
PrintFormatCommandPrint bytes format in commonly used formats, such as literals in high level languages.
+PrintFormatCommand.__init____init__() → None
+Return the list of settings for this command.
+PrintFormatCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
PrintFormatCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
PrintFormatCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+PrintFormatCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
PrintFormatCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
PrintFormatCommand.invokeinvoke(args: str, from_tty: bool) → None
+PrintFormatCommand.post_loadpost_load() → None
+PrintFormatCommand.pre_loadpre_load() → None
+PrintFormatCommand.usageusage() → None
+ProcessListingCommandList and filter process. If a PATTERN is given as argument, results shown will be grepped by this pattern.
+ProcessListingCommand.__init____init__() → None
+Return the list of settings for this command.
+ProcessListingCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
ProcessListingCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
ProcessListingCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+ProcessListingCommand.get_processesget_processes() → Generator[Dict[str, str], NoneType, NoneType]
+ProcessListingCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
ProcessListingCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
ProcessListingCommand.invokeinvoke(args: str, from_tty: bool) → None
+ProcessListingCommand.post_loadpost_load() → None
+ProcessListingCommand.pre_loadpre_load() → None
+ProcessListingCommand.usageusage() → None
+ProcessStatusCommandExtends the info given by GDB info proc, by giving an exhaustive description of the process status (file descriptors, ancestor, descendants, etc.).
ProcessStatusCommand.__init____init__() → None
+Return the list of settings for this command.
+ProcessStatusCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
ProcessStatusCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
ProcessStatusCommand.do_invokedo_invoke(argv: List[str]) → None
+ProcessStatusCommand.get_children_pidsget_children_pids(pid: int) → List[int]
+ProcessStatusCommand.get_cmdline_ofget_cmdline_of(pid: int) → str
+ProcessStatusCommand.get_process_path_ofget_process_path_of(pid: int) → str
+ProcessStatusCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
ProcessStatusCommand.get_state_ofget_state_of(pid: int) → Dict[str, str]
+ProcessStatusCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
ProcessStatusCommand.invokeinvoke(args: str, from_tty: bool) → None
+ProcessStatusCommand.list_socketslist_sockets(pid: int) → List[int]
+ProcessStatusCommand.parse_ip_portparse_ip_port(addr: str) → Tuple[str, int]
+ProcessStatusCommand.post_loadpost_load() → None
+ProcessStatusCommand.pre_loadpre_load() → None
+ProcessStatusCommand.show_ancestorshow_ancestor() → None
+ProcessStatusCommand.show_connectionsshow_connections() → None
+ProcessStatusCommand.show_descendantsshow_descendants() → None
+ProcessStatusCommand.show_fdsshow_fds() → None
+ProcessStatusCommand.show_info_procshow_info_proc() → None
+ProcessStatusCommand.usageusage() → None
+RISCVRISCV.canary_addresscanary_address() → int
+RISCV.flag_register_to_humanflag_register_to_human(val: Optional[int] = None) → str
+RISCV.get_ith_parameterget_ith_parameter(i: int, in_func: bool = True) → Tuple[str, Optional[int]]
+Retrieves the correct parameter used for the current function call.
+RISCV.get_raget_ra(insn: __main__.Instruction, frame: 'gdb.Frame') → Optional[int]
+RISCV.is_branch_takenis_branch_taken(insn: __main__.Instruction) → Tuple[bool, str]
+RISCV.is_callis_call(insn: __main__.Instruction) → bool
+RISCV.is_conditional_branchis_conditional_branch(insn: __main__.Instruction) → bool
+RISCV.is_retis_ret(insn: __main__.Instruction) → bool
+RISCV.mprotect_asmmprotect_asm(addr: int, size: int, perm: __main__.Permission) → str
+RISCV.registerregister(name: str) → int
+RISCV.reset_cachesreset_caches() → None
+RISCV.supports_gdb_archsupports_gdb_arch(gdb_arch: str) → Optional[bool]
+If implemented by a child Architecture, this function dictates if the current class supports the loaded ELF file (which can be accessed via gef.binary). This callback function will override any assumption made by GEF to determine the architecture.
RedirectOutputContextRedirectOutputContext.__init____init__(to: str = '/dev/null') → None
+RemoteCommandGDB target remote command on steroids. This command will use the remote procfs to create a local copy of the execution environment, including the target binary and its libraries in the local temporary directory (the value by default is in gef.config.tempdir). Additionally, it will fetch all the /proc/PID/maps and loads all its information. If procfs is not available remotely, the command will likely fail. You can however still use the limited command provided by GDB target remote.
RemoteCommand.__init____init__() → None
+Return the list of settings for this command.
+RemoteCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
RemoteCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
RemoteCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+RemoteCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
RemoteCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
RemoteCommand.invokeinvoke(args: str, from_tty: bool) → None
+RemoteCommand.post_loadpost_load() → None
+RemoteCommand.pre_loadpre_load() → None
+RemoteCommand.usageusage() → None
+ResetCacheCommandReset cache of all stored data. This command is here for debugging and test purposes, GEF handles properly the cache reset under "normal" scenario.
+ResetCacheCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+ResetCacheCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
ResetCacheCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
ResetCacheCommand.do_invokedo_invoke(_: List[str]) → None
+ResetCacheCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
ResetCacheCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
ResetCacheCommand.invokeinvoke(args: str, from_tty: bool) → None
+ResetCacheCommand.post_loadpost_load() → None
+ResetCacheCommand.pre_loadpre_load() → None
+ResetCacheCommand.usageusage() → None
+SPARCRefs: +- https://www.cse.scu.edu/~atkinson/teaching/sp05/259/sparc.pdf
+SPARC.canary_addresscanary_address() → int
+SPARC.flag_register_to_humanflag_register_to_human(val: Optional[int] = None) → str
+SPARC.get_ith_parameterget_ith_parameter(i: int, in_func: bool = True) → Tuple[str, Optional[int]]
+Retrieves the correct parameter used for the current function call.
+SPARC.get_raget_ra(insn: __main__.Instruction, frame: 'gdb.Frame') → Optional[int]
+SPARC.is_branch_takenis_branch_taken(insn: __main__.Instruction) → Tuple[bool, str]
+SPARC.is_callis_call(insn: __main__.Instruction) → bool
+SPARC.is_conditional_branchis_conditional_branch(insn: __main__.Instruction) → bool
+SPARC.is_retis_ret(insn: __main__.Instruction) → bool
+SPARC.mprotect_asmmprotect_asm(addr: int, size: int, perm: __main__.Permission) → str
+SPARC.registerregister(name: str) → int
+SPARC.reset_cachesreset_caches() → None
+SPARC.supports_gdb_archsupports_gdb_arch(gdb_arch: str) → Optional[bool]
+If implemented by a child Architecture, this function dictates if the current class supports the loaded ELF file (which can be accessed via gef.binary). This callback function will override any assumption made by GEF to determine the architecture.
SPARC64Refs: +- http://math-atlas.sourceforge.net/devel/assembly/abi_sysV_sparc.pdf +- https://cr.yp.to/2005-590/sparcv9.pdf
+SPARC64.canary_addresscanary_address() → int
+SPARC64.flag_register_to_humanflag_register_to_human(val: Optional[int] = None) → str
+SPARC64.get_ith_parameterget_ith_parameter(i: int, in_func: bool = True) → Tuple[str, Optional[int]]
+Retrieves the correct parameter used for the current function call.
+SPARC64.get_raget_ra(insn: __main__.Instruction, frame: 'gdb.Frame') → Optional[int]
+SPARC64.is_branch_takenis_branch_taken(insn: __main__.Instruction) → Tuple[bool, str]
+SPARC64.is_callis_call(insn: __main__.Instruction) → bool
+SPARC64.is_conditional_branchis_conditional_branch(insn: __main__.Instruction) → bool
+SPARC64.is_retis_ret(insn: __main__.Instruction) → bool
+SPARC64.mprotect_asmmprotect_asm(addr: int, size: int, perm: __main__.Permission) → str
+SPARC64.registerregister(name: str) → int
+SPARC64.reset_cachesreset_caches() → None
+SPARC64.supports_gdb_archsupports_gdb_arch(gdb_arch: str) → Optional[bool]
+If implemented by a child Architecture, this function dictates if the current class supports the loaded ELF file (which can be accessed via gef.binary). This callback function will override any assumption made by GEF to determine the architecture.
ScanSectionCommandSearch for addresses that are located in a memory mapping (haystack) that belonging to another (needle).
+ScanSectionCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+ScanSectionCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
ScanSectionCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
ScanSectionCommand.do_invokedo_invoke(argv: List[str]) → None
+ScanSectionCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
ScanSectionCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
ScanSectionCommand.invokeinvoke(args: str, from_tty: bool) → None
+ScanSectionCommand.post_loadpost_load() → None
+ScanSectionCommand.pre_loadpre_load() → None
+ScanSectionCommand.usageusage() → None
+SearchPatternCommandSearchPatternCommand: search a pattern in memory. If given an hex value (starting with 0x) the command will also try to look for upwards cross-references to this address.
+SearchPatternCommand.__init____init__() → None
+Return the list of settings for this command.
+SearchPatternCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
SearchPatternCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
SearchPatternCommand.do_invokedo_invoke(argv: List[str]) → None
+SearchPatternCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
SearchPatternCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
SearchPatternCommand.invokeinvoke(args: str, from_tty: bool) → None
+SearchPatternCommand.post_loadpost_load() → None
+SearchPatternCommand.pre_loadpre_load() → None
+SearchPatternCommand.print_locprint_loc(loc: Tuple[int, int, str]) → None
+SearchPatternCommand.print_sectionprint_section(section: __main__.Section) → None
+SearchPatternCommand.search_binpattern_by_addresssearch_binpattern_by_address(
+ binpattern: bytes,
+ start_address: int,
+ end_address: int
+) → List[Tuple[int, int, Optional[str]]]
+Search a binary pattern within a range defined by arguments.
+SearchPatternCommand.search_patternsearch_pattern(pattern: str, section_name: str) → None
+Search a pattern within the whole userland memory.
+SearchPatternCommand.search_pattern_by_addresssearch_pattern_by_address(
+ pattern: str,
+ start_address: int,
+ end_address: int
+) → List[Tuple[int, int, Optional[str]]]
+Search a pattern within a range defined by arguments.
+SearchPatternCommand.usageusage() → None
+SectionGEF representation of process memory sections.
+Section.__init____init__(**kwargs: Any) → None
+Section.is_executableis_executable() → bool
+Section.is_readableis_readable() → bool
+Section.is_writableis_writable() → bool
+SectionBaseFunctionReturn the matching file's base address plus an optional offset. Defaults to current file. Note that quotes need to be escaped
+SectionBaseFunction.__init____init__() → None
+SectionBaseFunction.arg_to_longarg_to_long(args: List, index: int, default: int = 0) → int
+SectionBaseFunction.do_invokedo_invoke(args: List) → int
+SectionBaseFunction.invokeinvoke(*args: Any) → int
+ShdrShdr.__init____init__(elf: Optional[__main__.Elf], off: int) → None
+ShellcodeCommandShellcodeCommand uses @JonathanSalwan simple-yet-awesome shellcode API to download shellcodes.
+ShellcodeCommand.__init____init__() → None
+Return the list of settings for this command.
+ShellcodeCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
ShellcodeCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
ShellcodeCommand.do_invokedo_invoke(_: List[str]) → None
+ShellcodeCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
ShellcodeCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
ShellcodeCommand.invokeinvoke(args: str, from_tty: bool) → None
+ShellcodeCommand.post_loadpost_load() → None
+ShellcodeCommand.pre_loadpre_load() → None
+ShellcodeCommand.usageusage() → None
+ShellcodeGetCommandDownload shellcode from shell-storm's shellcode database.
+ShellcodeGetCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+ShellcodeGetCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
ShellcodeGetCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
ShellcodeGetCommand.do_invokedo_invoke(argv: List[str]) → None
+ShellcodeGetCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
ShellcodeGetCommand.get_shellcodeget_shellcode(sid: int) → None
+ShellcodeGetCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
ShellcodeGetCommand.invokeinvoke(args: str, from_tty: bool) → None
+ShellcodeGetCommand.post_loadpost_load() → None
+ShellcodeGetCommand.pre_loadpre_load() → None
+ShellcodeGetCommand.usageusage() → None
+ShellcodeSearchCommandSearch pattern in shell-storm's shellcode database.
+ShellcodeSearchCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+ShellcodeSearchCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
ShellcodeSearchCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
ShellcodeSearchCommand.do_invokedo_invoke(argv: List[str]) → None
+ShellcodeSearchCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
ShellcodeSearchCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
ShellcodeSearchCommand.invokeinvoke(args: str, from_tty: bool) → None
+ShellcodeSearchCommand.post_loadpost_load() → None
+ShellcodeSearchCommand.pre_loadpre_load() → None
+ShellcodeSearchCommand.search_shellcodesearch_shellcode(search_options: List) → None
+ShellcodeSearchCommand.usageusage() → None
+SkipiCommandSkip N instruction(s) execution
+SkipiCommand.__init____init__() → None
+Return the list of settings for this command.
+SkipiCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
SkipiCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
SkipiCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+SkipiCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
SkipiCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
SkipiCommand.invokeinvoke(args: str, from_tty: bool) → None
+SkipiCommand.post_loadpost_load() → None
+SkipiCommand.pre_loadpre_load() → None
+SkipiCommand.usageusage() → None
+SmartEvalCommandSmartEval: Smart eval (vague approach to mimic WinDBG ?).
SmartEvalCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+SmartEvalCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
SmartEvalCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
SmartEvalCommand.distancedistance(args: Tuple[str, str]) → None
+SmartEvalCommand.do_invokedo_invoke(argv: List[str]) → None
+SmartEvalCommand.evaluateevaluate(expr: List[str]) → None
+SmartEvalCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
SmartEvalCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
SmartEvalCommand.invokeinvoke(args: str, from_tty: bool) → None
+SmartEvalCommand.post_loadpost_load() → None
+SmartEvalCommand.pre_loadpre_load() → None
+SmartEvalCommand.usageusage() → None
+SolveKernelSymbolCommandSolve kernel symbols from kallsyms table.
+SolveKernelSymbolCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+SolveKernelSymbolCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
SolveKernelSymbolCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
SolveKernelSymbolCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+SolveKernelSymbolCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
SolveKernelSymbolCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
SolveKernelSymbolCommand.invokeinvoke(args: str, from_tty: bool) → None
+SolveKernelSymbolCommand.post_loadpost_load() → None
+SolveKernelSymbolCommand.pre_loadpre_load() → None
+SolveKernelSymbolCommand.usageusage() → None
+StackOffsetFunctionReturn the current stack base address plus an optional offset.
+StackOffsetFunction.__init____init__() → None
+StackOffsetFunction.arg_to_longarg_to_long(args: List, index: int, default: int = 0) → int
+StackOffsetFunction.do_invokedo_invoke(args: List) → int
+StackOffsetFunction.invokeinvoke(*args: Any) → int
+StubBreakpointCreate a breakpoint to permanently disable a call (fork/alarm/signal/etc.).
+StubBreakpoint.__init____init__(func: str, retval: Optional[int]) → None
+StubBreakpoint.stopstop() → bool
+StubCommandStub out the specified function. This function is useful when needing to skip one function to be called and disrupt your runtime flow (ex. fork).
+StubCommand.__init____init__() → None
+Return the list of settings for this command.
+StubCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
StubCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
StubCommand.wrapperwrapper(*args: Any, **kwargs: Any) → Callable
+StubCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
StubCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
StubCommand.invokeinvoke(args: str, from_tty: bool) → None
+StubCommand.post_loadpost_load() → None
+StubCommand.pre_loadpre_load() → None
+StubCommand.usageusage() → None
+TraceFreeBreakpointTrack calls to free() and attempts to detect inconsistencies.
+TraceFreeBreakpoint.__init____init__() → None
+TraceFreeBreakpoint.stopstop() → bool
+TraceFreeRetBreakpointInternal temporary breakpoint to track free()d values.
+TraceFreeRetBreakpoint.__init____init__(addr: int) → None
+TraceFreeRetBreakpoint.stopstop() → bool
+TraceMallocBreakpointTrack allocations done with malloc() or calloc().
+TraceMallocBreakpoint.__init____init__(name: str) → None
+TraceMallocBreakpoint.stopstop() → bool
+TraceMallocRetBreakpointInternal temporary breakpoint to retrieve the return value of malloc().
+TraceMallocRetBreakpoint.__init____init__(size: int, name: str) → None
+TraceMallocRetBreakpoint.stopstop() → bool
+TraceReallocBreakpointTrack re-allocations done with realloc().
+TraceReallocBreakpoint.__init____init__() → None
+TraceReallocBreakpoint.stopstop() → bool
+TraceReallocRetBreakpointInternal temporary breakpoint to retrieve the return value of realloc().
+TraceReallocRetBreakpoint.__init____init__(ptr: int, size: int) → None
+TraceReallocRetBreakpoint.stopstop() → bool
+TraceRunCommandCreate a runtime trace of all instructions executed from $pc to LOCATION specified. The trace is stored in a text file that can be next imported in IDA Pro to visualize the runtime path.
+TraceRunCommand.__init____init__() → None
+Return the list of settings for this command.
+TraceRunCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
TraceRunCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
TraceRunCommand.do_invokedo_invoke(argv: List[str]) → None
+TraceRunCommand.get_frames_sizeget_frames_size() → int
+TraceRunCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
TraceRunCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
TraceRunCommand.invokeinvoke(args: str, from_tty: bool) → None
+TraceRunCommand.post_loadpost_load() → None
+TraceRunCommand.pre_loadpre_load() → None
+TraceRunCommand.start_tracingstart_tracing(loc_start: int, loc_end: int, depth: int) → None
+TraceRunCommand.tracetrace(loc_start: int, loc_end: int, depth: int) → None
+TraceRunCommand.usageusage() → None
+UafWatchpointCustom watchpoints set TraceFreeBreakpoint() to monitor free()d pointers being used.
+UafWatchpoint.__init____init__(addr: int) → None
+UafWatchpoint.stopstop() → bool
+If this method is triggered, we likely have a UaF. Break the execution and report it.
+VMMapCommandDisplay a comprehensive layout of the virtual memory mapping. If a filter argument, GEF will filter out the mapping whose pathname do not match that filter.
+VMMapCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+VMMapCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
VMMapCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
VMMapCommand.do_invokedo_invoke(argv: List[str]) → None
+VMMapCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
VMMapCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
VMMapCommand.invokeinvoke(args: str, from_tty: bool) → None
+VMMapCommand.is_integeris_integer(n: str) → bool
+VMMapCommand.post_loadpost_load() → None
+VMMapCommand.pre_loadpre_load() → None
+VMMapCommand.print_entryprint_entry(entry: __main__.Section) → None
+VMMapCommand.show_legendshow_legend() → None
+VMMapCommand.usageusage() → None
+VersionCommandDisplay GEF version info.
+VersionCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+VersionCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
VersionCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
VersionCommand.do_invokedo_invoke(argv: List[str]) → None
+VersionCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
VersionCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
VersionCommand.invokeinvoke(args: str, from_tty: bool) → None
+VersionCommand.post_loadpost_load() → None
+VersionCommand.pre_loadpre_load() → None
+VersionCommand.usageusage() → None
+X86X86.canary_addresscanary_address() → int
+X86.flag_register_to_humanflag_register_to_human(val: Optional[int] = None) → str
+X86.get_ith_parameterget_ith_parameter(i: int, in_func: bool = True) → Tuple[str, Optional[int]]
+X86.get_raget_ra(insn: __main__.Instruction, frame: 'gdb.Frame') → Optional[int]
+X86.is_branch_takenis_branch_taken(insn: __main__.Instruction) → Tuple[bool, str]
+X86.is_callis_call(insn: __main__.Instruction) → bool
+X86.is_conditional_branchis_conditional_branch(insn: __main__.Instruction) → bool
+X86.is_retis_ret(insn: __main__.Instruction) → bool
+X86.mprotect_asmmprotect_asm(addr: int, size: int, perm: __main__.Permission) → str
+X86.registerregister(name: str) → int
+X86.reset_cachesreset_caches() → None
+X86.supports_gdb_archsupports_gdb_arch(gdb_arch: str) → Optional[bool]
+If implemented by a child Architecture, this function dictates if the current class supports the loaded ELF file (which can be accessed via gef.binary). This callback function will override any assumption made by GEF to determine the architecture.
X86_64X86_64.canary_addresscanary_address() → int
+X86_64.flag_register_to_humanflag_register_to_human(val: Optional[int] = None) → str
+X86_64.get_ith_parameterget_ith_parameter(i: int, in_func: bool = True) → Tuple[str, Optional[int]]
+Retrieves the correct parameter used for the current function call.
+X86_64.get_raget_ra(insn: __main__.Instruction, frame: 'gdb.Frame') → Optional[int]
+X86_64.is_branch_takenis_branch_taken(insn: __main__.Instruction) → Tuple[bool, str]
+X86_64.is_callis_call(insn: __main__.Instruction) → bool
+X86_64.is_conditional_branchis_conditional_branch(insn: __main__.Instruction) → bool
+X86_64.is_retis_ret(insn: __main__.Instruction) → bool
+X86_64.mprotect_asmmprotect_asm(addr: int, size: int, perm: __main__.Permission) → str
+X86_64.registerregister(name: str) → int
+X86_64.reset_cachesreset_caches() → None
+X86_64.supports_gdb_archsupports_gdb_arch(gdb_arch: str) → Optional[bool]
+If implemented by a child Architecture, this function dictates if the current class supports the loaded ELF file (which can be accessed via gef.binary). This callback function will override any assumption made by GEF to determine the architecture.
XAddressInfoCommandRetrieve and display runtime information for the location(s) given as parameter.
+XAddressInfoCommand.__init____init__() → None
+Return the list of settings for this command.
+XAddressInfoCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
XAddressInfoCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
XAddressInfoCommand.do_invokedo_invoke(argv: List[str]) → None
+XAddressInfoCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
XAddressInfoCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
XAddressInfoCommand.infosinfos(address: int) → None
+XAddressInfoCommand.invokeinvoke(args: str, from_tty: bool) → None
+XAddressInfoCommand.post_loadpost_load() → None
+XAddressInfoCommand.pre_loadpre_load() → None
+XAddressInfoCommand.usageusage() → None
+XFilesCommandShows all libraries (and sections) loaded by binary. This command extends the GDB command info files, by retrieving more information from extra sources, and providing a better display. If an argument FILE is given, the output will grep information related to only that file. If an argument name is also given, the output will grep to the name within FILE.
XFilesCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+XFilesCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
XFilesCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
XFilesCommand.do_invokedo_invoke(argv: List[str]) → None
+XFilesCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
XFilesCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
XFilesCommand.invokeinvoke(args: str, from_tty: bool) → None
+XFilesCommand.post_loadpost_load() → None
+XFilesCommand.pre_loadpre_load() → None
+XFilesCommand.usageusage() → None
+XorMemoryCommandXOR a block of memory. The command allows to simply display the result, or patch it runtime at runtime.
+XorMemoryCommand.__init____init__() → None
+Return the list of settings for this command.
+XorMemoryCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
XorMemoryCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
XorMemoryCommand.do_invokedo_invoke(_: List[str]) → None
+XorMemoryCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
XorMemoryCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
XorMemoryCommand.invokeinvoke(args: str, from_tty: bool) → None
+XorMemoryCommand.post_loadpost_load() → None
+XorMemoryCommand.pre_loadpre_load() → None
+XorMemoryCommand.usageusage() → None
+XorMemoryDisplayCommandDisplay a block of memory pointed by ADDRESS by xor-ing each byte with KEY. The key must be provided in hexadecimal format.
+XorMemoryDisplayCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+XorMemoryDisplayCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
XorMemoryDisplayCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
XorMemoryDisplayCommand.do_invokedo_invoke(argv: List[str]) → None
+XorMemoryDisplayCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
XorMemoryDisplayCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
XorMemoryDisplayCommand.invokeinvoke(args: str, from_tty: bool) → None
+XorMemoryDisplayCommand.post_loadpost_load() → None
+XorMemoryDisplayCommand.pre_loadpre_load() → None
+XorMemoryDisplayCommand.usageusage() → None
+XorMemoryPatchCommandPatch a block of memory pointed by ADDRESS by xor-ing each byte with KEY. The key must be provided in hexadecimal format.
+XorMemoryPatchCommand.__init____init__(*args: Any, **kwargs: Any) → None
+Return the list of settings for this command.
+XorMemoryPatchCommand.add_settingadd_setting(
+ name: str,
+ value: Tuple[Any, type, str],
+ description: str = ''
+) → None
+add_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] = value instead
XorMemoryPatchCommand.del_settingdel_setting(name: str) → None
+del_setting is DEPRECATED and will be removed in the future.
+ Use del self[setting_name] instead
XorMemoryPatchCommand.do_invokedo_invoke(argv: List[str]) → None
+XorMemoryPatchCommand.get_settingget_setting(name: str) → Any
+get_setting is DEPRECATED and will be removed in the future.
+ Use self[setting_name] instead
XorMemoryPatchCommand.has_settinghas_setting(name: str) → bool
+has_setting is DEPRECATED and will be removed in the future.
+ Use setting_name in self instead
XorMemoryPatchCommand.invokeinvoke(args: str, from_tty: bool) → None
+XorMemoryPatchCommand.post_loadpost_load() → None
+XorMemoryPatchCommand.pre_loadpre_load() → None
+XorMemoryPatchCommand.usageusage() → None
+ZoneZone(name, zone_start, zone_end, filename)
+classpropertyMake the attribute a classproperty.
This file was automatically generated via lazydocs.
+ + + + + + +GEF intends to provide a battery-included, quickly installable and crazy fast debugging
+environment sitting on top of GDB.
But it most importantly provides all the primitives required to allow hackers to quickly create
+their own commands. This page intends to summarize how to create advanced GDB commands in moments
+using GEF as a library.
A dedicated repository was born to host external
+scripts. This repo is open to all for
+contributions, no restrictions and the most valuable ones will be integrated into gef.py.
Here is the most basic skeleton for creating a new GEF command named newcmd:
class NewCommand(GenericCommand):
+ """Dummy new command."""
+ _cmdline_ = "newcmd"
+ _syntax_ = f"{_cmdline_}"
+
+ @only_if_gdb_running # not required, ensures that the debug session is started
+ def do_invoke(self, argv):
+ # let's say we want to print some info about the architecture of the current binary
+ print(f"gef.arch={gef.arch}")
+ # or showing the current $pc
+ print(f"gef.arch.pc={gef.arch.pc:#x}")
+ return
+
+register_external_command(NewCommand())
+Loading it in GEF is as easy as
gef➤ source /path/to/newcmd.py
+[+] Loading 'NewCommand'
+We can call it:
+gef➤ newcmd
+gef.arch=<__main__.X86_64 object at 0x7fd5583571c0>
+gef.arch.pc=0x55555555a7d0
+Yes, that's it! Check out the complete API to see what else GEF offers.
+Our new command must be a class that inherits from GEF's GenericCommand. The only requirements are:
_cmdline_ attribute (the command to type on the GDB prompt)._syntax_ attribute, which GEF will use to auto-generate the help menu.do_invoke(self, args) which will be executed when the command is invoked. args is a
+ list of the command line args provided when invoked.We make GEF aware of this new command by registering it in the __main__ section of the script, by
+invoking the global function register_external_command().
Now you have a new GEF command which you can load, either from cli:
+gef➤ source /path/to/newcmd.py
+or add to your ~/.gdbinit:
echo source /path/to/newcmd.py >> ~/.gdbinit
+Sometimes you want something similar to a command to run on each break-like event and display itself +as a part of the GEF context. Here is a simple example of how to make a custom context pane:
+__start_time__ = int(time.time())
+def wasted_time_debugging():
+ gef_print("You have wasted {} seconds!".format(int(time.time()) - __start_time__))
+
+def wasted_time_debugging_title():
+ return "wasted:time:debugging:{}".format(int(time.time()) - __start_time__)
+
+register_external_context_pane("wasted_time_debugging", wasted_time_debugging, wasted_time_debugging_title)
+Loading it in GEF is as easy as loading a command
gef➤ source /path/to/custom_context_pane.py
+It can even be included in the same file as a Command. Now on each break you will notice a new pane
+near the bottom of the context. The order can be modified in the GEF context config.
The API demonstrated above requires very specific argument types:
+register_external_context_pane(pane_name, display_pane_function, pane_title_function)
pane_name: a string that will be used as the panes setting namedisplay_pane_function: a function that uses gef_print() to print content in the panepane_title_function: a function that returns the title string or None to hide the titleSome of the most important parts of the API for creating new commands are mentioned (but not limited
+to) below. To see the full help of a function, open GDB and GEF, and use the embedded Python
+interpreter's help command.
For example:
+gef➤ pi help(Architecture)
+or even from outside GDB:
+gdb -q -ex 'pi help(hexdump)' -ex quit
+The GEF API aims to provide a simpler and more Pythonic approach to GDB's.
+Some basic examples:
+gef ➤ pi print(hexdump( gef.memory.read(parse_address("$pc"), length=0x20 )))
+0x0000000000000000 f3 0f 1e fa 31 ed 49 89 d1 5e 48 89 e2 48 83 e4 ....1.I..^H..H..
+0x0000000000000010 f0 50 54 4c 8d 05 66 0d 01 00 48 8d 0d ef 0c 01 .PTL..f...H.....
+gef ➤ pi print('\n'.join([ f"{x.page_start:#x} -> {x.page_end:#x}" for x in gef.memory.maps]))
+0x555555554000 -> 0x555555558000
+0x555555558000 -> 0x55555556c000
+0x55555556c000 -> 0x555555575000
+0x555555576000 -> 0x555555577000
+0x555555577000 -> 0x555555578000
+0x555555578000 -> 0x55555559a000
+0x7ffff7cd8000 -> 0x7ffff7cda000
+0x7ffff7cda000 -> 0x7ffff7ce1000
+0x7ffff7ce1000 -> 0x7ffff7cf2000
+0x7ffff7cf2000 -> 0x7ffff7cf7000
+[...]
+The API also offers a number of decorators to simplify the creation of new/existing commands, such as:
+@only_if_gdb_running to execute only if a GDB session is running.@only_if_gdb_target_local to check if the target is local i.e. not debugging using GDB remote.For a complete reference of the API offered by GEF, visit docs/api/gef.md.
@parse_arguments( {"required_argument_1": DefaultValue1, ...}, {"--optional-argument-1": DefaultValue1, ...} )
+This decorator aims to facilitate the argument passing to a command. If added, it will use the
+argparse module to parse arguments, and will store them in the kwargs["arguments"] of the
+calling function (therefore the function must have *args, **kwargs added to its signature).
+Argument type is inferred directly from the default value except for boolean, where a value of
+True corresponds to argparse's store_true action. For more details on argparse, refer to its
+Python documentation.
Values given for the parameters also allow list of arguments being past. This can be useful in the
+case where the number of exact option values is known in advance. This can be achieved simply by
+using a type of tuple or list for the default value. parse_arguments will determine the type
+of what to expect based on the first default value of the iterable, so make sure it's not empty. For
+instance:
@parse_arguments( {"instructions": ["nop", "int3", "hlt"], }, {"--arch": "x64", } )
+Argument flags are also supported, allowing to write simpler version of the flag such as
+@parse_arguments( {}, {("--long-argument", "-l"): value, } )
+A basic example would be as follow:
+class MyCommand(GenericCommand):
+ [...]
+
+ @parse_arguments({"foo": [1,]}, {"--bleh": "", ("--blah", "-l): True})
+ def do_invoke(self, argv, *args, **kwargs):
+ args = kwargs["arguments"]
+ if args.foo == 1: ...
+ if args.blah == True: ...
+When the user enters the following command:
+gef➤ mycommand --blah 3 14 159 2653
+The function MyCommand!do_invoke() can use the command line argument value
args.foo --> [3, 14, 159, 2653] # a List(int) from user input
+args.bleh --> "" # the default value
+args.blah --> True # set to True because user input declared the option (would have been False otherwise)
+Support for new architectures can be added by inheriting from the Architecture class. Examples can
+be found in gef-extras.
Sometimes architectures can more precisely determine whether they apply to the current target by
+looking at the architecture determined by gdb. For these cases the custom architecture may implement
+the supports_gdb_arch() static function to signal that they should be used instead of the default.
+The function receives only one argument:
gdb_str (of type str) which is the architecture name as reported by GDB.The function must return:
+True if the current Architecture class supports the target binary; False otherwise.None to simply ignore this check and let GEF try to determine the architecture.One example is the ARM Cortex-M architecture which in some cases should be used over the generic ARM +one:
+@staticmethod
+def supports_gdb_arch(gdb_arch: str) -> Optional[bool]:
+ return bool(re.search("^armv.*-m$", gdb_arch))
+