Class 02 · KP 18 / 23

GDB with pwndbg / GEF

Plain GDB plus an exploitation plugin (pwndbg or GEF) is the primary

workbench.

gdb ./vuln                 # launch
(gdb) break main           # set a breakpoint
(gdb) run                  # start; pwndbg auto-shows regs+stack
(gdb) disassemble main     # view instructions
(gdb) info functions       # list known symbols
(gdb) x/8xg $rsp           # examine 8 giant (8-byte) words in hex
(gdb) x/s  0x555555556004  # examine a C string
(gdb) cyclic 100           # pwndbg: De Bruijn pattern for offsets

Key Takeaway

pwndbg/GEF show registers, stack, and disassembly on every stop — making it obvious when you have overwritten the saved return address.