Roadmap and changelog 5/4/2016:
+ gef.py : heap: added sub-command arenas (issue #22)
— heap – added new sub-command fastbins
+ docs: added gef save/restore
gef – Multi-Architecture GDB Enhanced Features for Exploiters & Reverse-Engineers
what’s new in 2016, Latest Change 20/2/2016:
+ New Features:
— Patch Command: The patch command allows to easily bypass a call or syscall.
— heap command: heap command provides information on the heap chunk specified as argument.
— xinfo/vmmap/xfiles commands: xinfo, vmmap and xfiles display a comprehensive and human-friendly memory mapping of either the process or a specific location.
— Remote debugging: It is possible to use gef in a remote debugging environment.
— set-permission command: This command was added to facilitate the exploitation process, by changing the permission rights on a specific page directly from the debugger.
— unicorn command: If you have installed [unicorn](http://unicorn-engine.org) emulation engine and its Python bindings, gef integrates a new command to emulate instructions
— trace-run command: The trace-run is meant to be provide a visual appreciation directly in IDA disassembler of the path taken by a specific execution. It should be used with
+ added documentation for trace-run
+ Update gef.sh
GEF is aimed to be used mostly by exploiters and reverse-engineers. It provides additional features to GDB using the Python API to assist during the process of dynamic analysis or exploit development.
GEF – GDB Enhanced Features.
GEF fully relies on GDB API and other Linux specific source of information (such as /proc/pid). As a consequence, some of the features might not work on custom or harden systems such as GrSec. It has fully support for Python2 and Python3 indifferently (as more and more distro start pushing gdb compiled with Python3 support).
GEF supports all the architecture supported by GDB :
– x86
– ARM
– MIPS
– PowerPC
Tested on
* x86-32/x86-64 (even though you should totally use gdb-peda (https://github.com/longld/peda) instead)
* armv6/armv7/armv8 (untested)
* mips32
* powerpc32/powerpc64
* sparc
# Tested on gdb 7.x / python 2.6 & 2.7 & 3.x
# To start: in gdb, type `source /path/to/gef.py
Install GEF:
Setup from repository
The best way to use GEF is through cloning the git repository from GitHub, and source the file from your ~/.gdbinit.
$ git clone https://github.com/hugsy/gef.git # or git pull to update
$ echo ‘source /path/to/gef.py’ >> ~/.gdbinit
One-time setup script
If you only need GEF for a one-time environment (VMs, etc.) that do not have/need git installed, just go with:
$ curl -s -L https://github.com/hugsy/gef/raw/master/gef.sh | sh
Optional dependancies
A few commands were added to GEF to extend its possibilities. It is recommended to install the following modules:
+ capstone highly recommended https://github.com/aquynh/capstone
+ ROPgadget highly recommended https://github.com/JonathanSalwan/ROPgadget
+ python-radare2 https://github.com/radare/radare2-bindings
Download : Master.zip | Clone URL
Source : https://github.com/hugsy | Our Post Before