hugsy/gef

Features

• Binary Analysis Frameworks - Provides a comprehensive environment for disassembling and analyzing compiled binaries, including security mitigation inspection.
• Debugger Execution Interfaces - Interfaces with the GDB debugger to control process state and inspect memory.
• GDB Extensions - Acts as a powerful Python-based plugin that adds advanced memory analysis and exploitation tools to GDB.
• Contextual Debugging Displays - Automatically displays register values, stack entries, and disassembly when breakpoints are triggered.
• Dynamic Analysis - Enables monitoring and manipulation of running processes in real time to observe execution flow and state changes.
• Heap Inspection Tools - Inspects heap arenas, bins, and individual chunks to analyze memory allocation patterns.
• Dynamic Analysis Extensions - Provides a comprehensive runtime environment for tracing execution and monitoring registers within GDB.
• Instruction Stepping Tools - Provides the ability to execute machine instructions one by one with precise flow control.
• Global Offset Table Analysis - Inspects the Global Offset Table to analyze dynamic linking states and identify resolved functions.
• Custom Debugging Commands - Provides an interface for registering and executing user-defined debugging commands to extend the debugger's functionality.
• Architecture Abstraction Layers - Implements a class-based system to define CPU-specific register and instruction behaviors through inheritance.
• Binary Metadata Inspection - Retrieves structural information and properties from an ELF binary to assist in file analysis.
• CPU Architecture Definitions - Provides the ability to define processor architectures for correct instruction and register state interpretation.
• CPU Register Inspection - Provides direct visual inspection and formatting of current CPU register values during debugging sessions.
• ELF Binary Parsing - Parses executable and shared object files to extract structural metadata and security mitigation settings.
• Heap Corruption Detection - Tracks memory allocations and frees to detect double-frees and heap overlap corruption.
• Low-Level Debuggers - Facilitates troubleshooting of crashes and memory corruption via inspection of CPU registers and virtual memory mappings.
• Memory Pattern Generators - Generates De Bruijn sequences to identify memory offsets during buffer overflow exploitation.
• Hardware Architecture Support - Defines how the system interacts with new CPU architectures by inheriting from a base class.
• Register State Inspectors - Displays a comprehensive overview of current register values to track the program state during execution.
• Runtime Debugging Contexts - Automatically displays a summary of registers, the stack, and disassembly upon interrupts.
• Reverse Engineering Tools - Offers capabilities for analyzing compiled binaries and ELF files to understand program logic through disassembly.
• Automatic Pointer Dereferencing - Resolves memory addresses from registers automatically to retrieve and display pointed values.
• Binary Analysis Tools - Checks executables for security protections including PIE, NX, RelRO, and stack canaries.
• PIE Breakpoint Controllers - Supports position-independent executables by setting breakpoints at offsets from the binary base address.
• Relative Address Calculation - Computes absolute memory addresses by adding relative offsets to the stack base.
• CLI Tool Behavior Customization - Allows modification of operational behavior, visual styling, and output formatting via configuration files and runtime commands.
• Debugger Command APIs - Integrates external scripts and custom commands using a provided application programming interface.
• Contextual Data Panes - Implements customizable data panes that display specific process state information automatically upon hitting breakpoints.
• Configuration Persistence Managers - Implements configuration persistence to save and load plugin settings across different debugging sessions.
• Environment Configuration Tools - Provides utilities for managing tool settings and saving layout configurations to ensure consistent session setups.
• Memory Pattern Searching - Scans process memory for specific byte patterns and strings with configurable preview lengths.
• Memory Search Tools - Locates all occurrences of a specific address range within another designated memory region.
• Plugin Autoloading - Automatically loads additional commands and functionality from specified external directories via a plugin system.
• Remote Debugger Connectivity - Establishes network connections to remote processes to enable full environment analysis and debugging.
• Format String Exploiters - Sets breakpoints on printing functions to identify and analyze insecure format string vulnerabilities.
• Time-Travel Debuggers - Integrates with record-and-replay tools to allow navigation backward and forward through the execution history.
• Application Settings Management - Includes systems for defining and persisting debugger configuration settings to customize the analysis environment.
• Cross-Architecture Analysis Tools - Executes analysis tasks across various CPU architectures using a unified and extensible interface.
• Binary Instruction Patching - Replaces specific memory addresses with NOP instructions to neutralize code during dynamic analysis.
• Binary Memory Dumping - Exports specific memory ranges as formatted arrays of bytes in Python, C, or Hex strings.
• Structured Memory Dumping - Applies Python ctypes structures to memory addresses to dump and edit formatted binary data.
• Binary Section Resolvers - Resolves runtime base addresses for critical memory sections including the stack, heap, BSS, and GOT.
• Child Process Tracking - Configures the environment to automatically follow and debug child processes when a program forks.
• Instruction Counter Manipulation - Advances the program counter beyond specific instructions to bypass sections of code during analysis.
• CPU Register Manipulators - Provides a human-readable view for toggling CPU register flags to control program execution.
• Execution State Recording - Records the program's execution flow to a file for subsequent call stack and control flow analysis.
• Function Stubbing - Bypasses function execution by forcing specific return values to simulate different execution paths.
• Heap Bin Inspection - Retrieves the current state of memory allocator free-list bins, including fastbins and per-thread tcache bins.
• Hexadecimal Output Formatting - Displays memory contents in hexadecimal and ASCII formats to help identify raw data strings.
• Hexdump Views - Provides a formatted hexadecimal view of raw memory for detailed binary inspection.
• Memory Inspection Tools - Displays formatted hexadecimal views of memory starting from a specific target address.
• Arena Enumeration - Identifies and lists all active memory arenas currently allocated within a multi-threaded process.
• Analysis Tools - Analyzes heap chunks with capabilities to filter by size and resolve specific object types.
• Process Discovery Tools - Retrieves a list of active processes and metadata for dynamic analysis.
• ASLR Toggling - Provides functionality to check and toggle Address Space Layout Randomization (ASLR) to control memory randomization.
• Process Memory Layout Visualizers - Provides a comprehensive view of the process memory space with filtering by address, register, or section.
• Memory Offset Calculators - Determines the memory position of variables within the BSS segment for low-level analysis.
• PIE Address Calculators - Calculates absolute memory addresses for loaded files and Position Independent Executables to locate symbols.
• Pointer Chain Visualizers - Recursively follows pointers from a starting address to visualize and reveal the underlying data chain.
• Process Memory Scanners - Allows scanning all memory segments for specific byte patterns to identify locations and permissions.
• Recursive Memory Dereferencing - Displays memory contents as hexdumps with recursive dereferencing of memory addresses.
• System Memory Inspection - Lists memory segments and properties, utilizing pattern filtering to isolate specific code or data sections.
• Virtual Memory Inspectors - Provides a comprehensive layout of virtual memory mappings with path filtering.
• Data Structure Mappings - Maps C-style structures to memory addresses to visualize complex binary data at runtime.
• Memory Type Overlays - Overlays C-style data structures onto raw memory addresses to visualize and edit complex binary data.
• Automatic Entry Point Breakpoints - Monitors common start symbols to automatically pause execution at the main entry point of the binary.
• Entry Point Breakpoints - Locates the program starting point using the main symbol or ELF header to set automatic breakpoints.
• Malware Analysis - Provides tools for reverse engineering and behavioral analysis of suspicious binaries within a controlled debugger.
• Stack Canary Extractors - Retrieves the value of the stack protector canary to simplify the process of bypassing stack protections.
• Security Analysis Tools - Identifies enabled security mitigations in a binary to determine potential exploit vectors.
• UI Context Refresh Callbacks - Triggers automatic data refreshes in the user interface based on debugger break events and callbacks.
• Address Calculators - Calculates absolute memory addresses for heap regions using the current heap base and a specified offset.
• Plugin-Based Architectures - Extends debugger functionality through the dynamic loading of external Python scripts and custom command registration.
• Instruction Tracing - Logs precise processor instruction sequences and execution flow for low-level binary analysis.
• Execution Tracing - Records program counter values to capture and analyze low-level opcode execution flow.
• Process Attachment Tools - Filters host processes by pattern to identify and attach the debugger to specific targets.
• Process State Inspection - Lists active processes and redirects file descriptors to provide detailed descriptions of process status.
• Binary Exploitation - Enhances GDB with advanced features for debugging and exploitation.
• Reverse Engineering - Enhanced GDB plugin for exploit development.

Star history