GDB Python/ PEDA
Setup
git clone https://github.com/longld/peda.git ~/Repositories/peda # clone PEDA repository
echo "source ~/Repositories/peda/peda.py" >> ~/.gdbinit # make GDB load PEDA
Run scripts like this: gdb -x script.py
Execute GDB command
gdb.execute(gdb_command, to_string= False) # Execute GDB command and return its output (if to_string= True)
peda.execute(gdb_command) # Execute GDB command (with exception wrapper)
peda.execute_redirect(gdb_command) # Execute GDB command and return its output
Get register values
peda.getreg(register) # Get value (Int) of a specific register name (String)
peda.getregs(reglist) # Get values of specified registers as dict: {regname(String) : value(Int)}
peda.get_eflags() # Get flags value from EFLAGS register: dictionary of named flags
peda.set_eflags(flagname, value) # Set/clear/toggle value of a flag register: Boolean (success)
Breakpoints
peda.set_breakpoint(location) # Set breakpoint at target function or address (String ot Int)
peda.get_breakpoint(num) # Get info of a specific breakpoint
peda.get_breakpoints() # Get list of current breakpoints: (Num(Int), Type(String), Disp(Bool), Nnb(Bool), Address(Int), commands(String))
Debugger Control
peda.stepuntil(inst, mapname, depth) # Step execution until next "inst" instruction within a specific memory range (mapname) with specific depth
peda.testjump(inst= None) # Test if jump instruction is taken or not: (status, address of target jumped instruction)
Get instructions
peda.prev_inst(address, count= 1) # Get previous 'count' instructions at an address as list of tuples: (address(Int), code(String))
peda.current_inst(address) # Parse instruction at an address as tuple of (address(Int), code(String))
peda.next_inst(address, count= 1) # Get next 'count' instructions at an address as list of tuple (address(Int), code(String))
Memory Operations
peda.dumpmem(start, end) # Dump process memory from start to end: raw bytes
peda.readmem(address, size) # Read content of memory at an address: raw bytes
peda.read_int(address, intsize= None) # Read an interger value from memory with forced intsize
peda.read_long(address) # Read a long long value from memory
peda.writemem(address, buf) # Write buf to memory start at an address, return number of written bytes (Int)
peda.write_int(address, value, intsize) # Write an interger value to memory (with size intsize)
peda.write_long(address, value) # Write a long long value to memory
peda.cmpmem(start, end, buf) # Compare contents of a memory region with a buffer: dictionary of array of diffed bytes in hex
peda.xormem(start, end, key) # XOR a memory region with a key (String)
peda.searchmem(start, end, search) # Search for all instances of a pattern (String or Python Regex) in memory from start to end: (address(Int), hexval(String))
peda.searchmem_by_range(mapname, search) # Search for all instances of a pattern in virtual memory ranges (string): (address(Int), hexval(String))
peda.search_reference(search, mapname) # Search for all references to a value in memory ranges (String): (address(Int), hexval(String))
peda.search_address(searchfor, belongto) # Search for all valid addresses in memory ranges: (address(Int), value(Int))
peda.search_pointer(searchfor, belongto) # Search for all valid pointers in memory ranges: (address(Int), value(Int))
Execution flow
peda.xref(search= "", filename= None) # Search for all call references or data access to a function/variable (String): list of (address(Int), asm instruction(String))
peda.get_function_args(argc= None) # Get the guessed arguments passed to a function when stopped at a call instruction (argc= force num arguments): list of arguments
Assemble/ Disassemble
peda.assemble(asmcode, bits= None) # Assemble ASM instructions, multiple instructions are separated by ";" (String): return bin code (raw bytes)
peda.disassemble(*arg) # Wrapper for disassemble command (arg: args for disassemble command)
peda.disassemble_around(address, count= 8) # Disassemble instructions nearby current PC or an address: (String)
Misc
peda.is_executable(address) # Check if an address (Int) is executable: Boolean
peda.is_writable(address) # Check if an address (Int) is writable: Boolean
peda.is_address(value) # Check if a value (Int) is a valid address (belongs to a memory region): Boolean
peda.getfile() # Get full path to executable file
peda.get_status() # Get execution status of debugged program
peda.getpid() # Get PID of the debugged process