pwndbg/pwndbg

Features

• Binary Analysis Frameworks - A comprehensive environment for disassembling, decompiling, and analyzing compiled software binaries.
• Debugger Extensions - Implements a Python-based command and scripting layer to extend the core functionality of GDB.
• Reverse Engineering Tools - Provides a comprehensive framework for analyzing the internal logic and structure of compiled binaries.
• Low-Level Debuggers - Provides a comprehensive low-level debugging framework for analyzing various binary formats across multiple architectures.
• Exploit Development Tools - Includes tools for identifying memory corruption and constructing ROP chains for exploit development.
• Heap Inspection Tools - Provides specialized visualization and inspection of glibc, jemalloc, and musl heap chunks to detect corruption.
• Arena Inspection - Displays the internal state and contents of specific memory arenas for heap analysis.
• Fastbin Inspection - Identifies available memory blocks by listing small chunks within the heap fastbins.
• Heap Visualization - Analyzes memory layout and metadata by rendering a visual representation of heap chunks.
• Call Stack Navigators - Enables navigation through active execution frames to trace program flow back to the caller.
• Contextual Disassembly - Displays assembly instructions surrounding a specific memory address to provide the necessary execution context.
• Debugger Plugins - Provides an advanced GDB plugin for memory inspection and automation in exploit development.
• Stack Frame Inspectors - Provides tools to analyze stack frames, including canaries and return addresses across threads.
• Execution State Monitoring - Tracks and displays register values, stack frames, and custom expressions automatically upon every execution stop.
• Execution State Monitoring - Ships a persistent view of execution state by tracking registers, expressions, and a history of changes.
• Memory Pattern Searching - Locates byte sequences, strings, or integer values within specified memory regions.
• Memory Search Tools - Performs hex dumps and recursive pointer dereferencing to search for specific sequences or strings in memory.
• Reverse Engineering Frameworks - Provides a framework for connecting assistants, decompilers, and other reverse engineering tools.
• Allocator Cache Inspectors - Enables inspection of thread-local caches to analyze memory chunk availability and allocation patterns.
• Binary Analysis Capabilities - Inspects GOT, PLT, and auxiliary vectors to understand the structure and security of ELF binaries.
• Binary Instruction Patching - Allows modifying instructions in memory by applying hex bytes or specific code changes to alter program behavior.
• Binary Memory Dumping - Provides formatted hexadecimal views of raw data at specific memory addresses or modules.
• CPU Register Inspection - Provides formatted displays of current CPU register values essential for low-level state analysis.
• Register Frame Analysis - Provides the ability to analyze registers saved to memory to understand function call architectural frames.
• CPU State Analysis - Identifies and prints arguments passed to a function based on the current CPU register state.
• Cross-Architecture Binary Analysis - Supports binary and kernel analysis across multiple CPU architectures on a single host.
• Debugger Process Management - Manages critical debugger operations including process attachment, entry-point execution, and thread termination.
• Execution Flow Control - Provides advanced execution control by allowing breaks on specific events like function calls, jumps, or system calls.
• Heap Analyzers - Visualizes and analyzes glibc, jemalloc, and musl heap allocations.
• Heap Corruption Detection - Detects double frees and use-after-free vulnerabilities by monitoring the GLibc heap.
• Heap Corruption Detectors - Provides specialized detection of fake chunks to identify heap corruption in glibc and other allocators.
• Kernel Build Configuration Inspection - Inspects the active kernel configuration to identify enabled security hardening options.
• Physical Address Mapping - Resolves virtual addresses to physical memory addresses using kernel page tables.
• Allocator Metadata Parsing - Decodes internal allocator structures for glibc, jemalloc, and musl to visualize memory bins and chunks.
• Heap Chunk Identification - Determines if a memory address belongs to a heap chunk by searching across all heaps.
• Kernel Debuggers - Provides utilities for identifying errors and inspecting tasks and allocators within the operating system kernel.
• Kernel Memory Access - Reads kernel symbols and page tables to translate virtual addresses and inspect slab allocators.
• Kernel Execution Analysis - Enables inspection of kernel-level execution via system emulation to identify security vulnerabilities.
• ELF Memory Map Analysis - Parses ELF headers and memory maps to resolve symbols, PLT entries, and section permissions.
• Memory Offset Calculators - Computes the byte offset between two memory addresses or the distance to a page base.
• Page Permission Inspectors - Determines the access permissions assigned to specific memory pages for security analysis.
• Virtual Address Translators - Locates specific memory pages by converting page structure pointers into virtual addresses.
• Virtual Memory Inspectors - Displays the virtual memory page layout and permissions to locate specific memory regions.
• Memory Type Overlays - Maps loaded C structure definitions onto raw memory addresses to provide formatted and typed data views.
• Return Oriented Programming Tools - Searches binaries for return-oriented programming gadgets to facilitate the construction of exploit chains.
• Instruction Gadget Discovery - Locates single-instruction sequences within a binary that provide immediate code control for exploit development.
• Automated Binary Analysis - Identifies active binary security mitigations to evaluate the difficulty of developing an exploit.
• Process Debuggers - Provides a detailed display of registers, stack, and process information upon every execution stop.
• AI Debugging Assistants - Sends debugger state to language models for automated explanation of software behavior.
• Debugger State Analysis - Integrates language models to provide automated explanations of software behavior based on the current debugger state.
• Assemblers - Includes utilities to convert assembly shellcode into raw machine bytes for specific architectures.
• Heap Metadata Extraction - Extracts detailed information about heap memory groups through metadata analysis.
• Request Bins - Provides utilities to list and analyze pending free allocations in the unsorted bin.
• Allocator Context Inspection - Displays the internal state of the mallocng context object.
• Allocator Group Metadata Analysis - Retrieves detailed information about musl allocator memory groups via metadata inspection.
• Allocator Meta-Area Analysis - Parses internal metadata of mallocng meta_area objects to assist heap analysis.
• Allocator Slot Analysis - Retrieves detailed internal information about specific mallocng memory slots.
• Heap Configuration Analysis - Verifies memory management state by displaying current heap settings and filters.
• Language Runtime Type Inspection - Identifies data structures by dumping reflection type information from a Go runtime address.
• Disassembly Annotations - Enables attaching custom text comments to specific memory addresses within the disassembly view to document logic.
• Debugger Tool Synchronization - Synchronizes program counters and memory state with external decompilers and disassemblers via a pipe interface.
• Decompiler State Inspection - Lists variables for the current stack frame as identified by the integrated decompiler.
• Decompiler Synchronizations - Synchronizes data and program counters with external decompilers for managed binary analysis.
• Disassembler Integrations - Starts compatible external disassembly tools for deep static analysis of the active process.
• Execution Context Search - Enables searching for specific strings within previously captured execution contexts.
• Execution State Monitors - Tracks specific variables and commands, updating their values automatically upon every execution stop.
• Memory String Extraction - Finds human-readable text sequences by scanning readable memory pages of a process.
• Debugger Context Navigation - Provides the ability to cycle back through a history of previously examined memory or register states.
• Global Offset Table Analysis - Monitors changes to the Global Offset Table to identify when function pointers are overwritten.
• PLT Symbol Analysis - Identifies symbols in the Procedure Linkage Table to resolve external function addresses.
• Kernel Module Identification - Identifies currently active kernel modules to analyze the running kernel state.
• Embedded Systems Debugging - Supports analyzing software running on ARM Cortex M and RISC-V architectures through emulators or hardware connections.
• Decompilers - Transforms binary machine instructions into human-readable source code via an integrated decompiler.
• Binary Memory Mapping - Defines the base memory address or file path of a binary to ensure correct mapping during analysis.
• Link Map Inspections - Deno capability to display loaded libraries and their memory locations by reading the current state of the link map.
• BPF Program Introspection - Implements tools for analyzing active eBPF programs and maps within the kernel.
• Type-Aware Memory Inspection - Loads custom C structure definitions for type-aware memory inspection.
• Instruction-Level Emulators - Simulates machine code execution to predict program state without advancing the actual process pointer.
• Conditional Breakpoints - Allows pausing execution specifically when a target branch is taken to filter out irrelevant execution paths.
• Cross-Format Binary Analysis - Provides a consistent interface for reverse engineering across different binary formats.
• Jemalloc Extent Analysis - Analyzes memory extents specifically used by the jemalloc allocator.
• Arena Enumeration - Analyzes heap allocation structures by enumerating all active memory arenas.
• Allocation Visualizers - Provides visual representations of heap memory slots to analyze allocation patterns.
• Allocator Analyzers - Provides detailed analysis and state explanations for the musl mallocng allocator.
• Memory Allocation Tracers - Monitors SLUB and buddy allocator activity to track kernel memory allocations and frees.
• Slab Allocators - Inspects SLUB caches to identify which kernel slab contains a specific memory address.
• Heap Metadata Analyzers - Provides tracking of heap growth and overflows by analyzing arena top chunk metadata.
• Kernel Symbol Resolution - Provides utilities to locate the kernel's virtual base address and resolve its symbols.
• Kernel Task Context Management - Configures the kernel task used by analysis tools to target specific processes.
• Kernel Task Identification - Displays the current kernel task or a specific task identified by its PID.
• Kernel Task Inspection - Provides detailed information about active kernel tasks to identify process states.
• Allocator Extent Analysis - Retrieves detailed metadata and extent information for addresses allocated by jemalloc.
• Memory Pattern Generators - Writes cyclic, unique sequences into memory to help identify the exact source and offset of crashes.
• PIE Address Calculators - Computes the virtual address of a relative offset based on the PIE base address.
• Pointer Chain Searchers - Locates pointers within a memory mapping that point to another target mapping.
• Pointer Chain Visualizers - Visualizes chains of memory references by recursively dereferencing pointers.
• Processor Register Configurations - Provides access to and modification of CPU Model Specific Registers for processor tuning.
• System Call Table Inspection - Displays the system call table including names and addresses for kernel entry points.
• System Capability Toggles - Toggles Address Space Layout Randomization (ASLR) for the target process during debugging.
• Allocator Extent Inspection - Retrieves metadata for jemalloc memory extents to analyze memory management.
• Thread Inspection - Displays all active threads associated with the process to identify concurrent execution flows.
• Thread Local Storage Inspection - Retrieves the base address of the current thread local storage for memory analysis.
• User-Mode Emulation - Analyzes binaries within a simulated user-space environment using system emulators.
• System Call Filter Analysis - Identifies restricted system calls by parsing seccomp filter program structures from memory.
• Language-Specific Value Dumping - Inspects internal language structures by formatting a memory address as a Go type.
• Kernel Ring Buffer Streams - Retrieves contents of the kernel ring buffer (dmesg) with human-readable timestamps.
• Pointer Chain Analyzers - Discovers chains of pointers leading to other memory regions to assist in memory leak analysis.
• Pointer Leak Scanners - Identifies potential offset leaks by searching memory ranges for valid pointers.
• Allocator Slot Inspection - Dumps internal state and metadata for specific musl allocator memory slots.
• GDB Enhancements - GDB plugin focused on exploit development and reverse engineering.
• Reverse Engineering Tools - Enhances GDB for low-level debugging and exploit development.
• Reverse Engineering - GDB plugin for easier exploit development.
• Security Tools - Exploit development and reverse engineering extension for GDB.

Star history