<!DOCTYPE HTML>
<html lang="en" class="light sidebar-visible" dir="ltr">
<head>
<!-- Book generated using mdBook -->
<meta charset="UTF-8">
<title>gdb - Notes</title>
<!-- Custom HTML head -->
<meta name="description" content="">
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta name="theme-color" content="#ffffff">
<link rel="icon" href="../favicon.svg">
<link rel="shortcut icon" href="../favicon.png">
<link rel="stylesheet" href="../css/variables.css">
<link rel="stylesheet" href="../css/general.css">
<link rel="stylesheet" href="../css/chrome.css">
<link rel="stylesheet" href="../css/print.css" media="print">
<!-- Fonts -->
<link rel="stylesheet" href="../FontAwesome/css/font-awesome.css">
<link rel="stylesheet" href="../fonts/fonts.css">
<!-- Highlight.js Stylesheets -->
<link rel="stylesheet" href="../highlight.css">
<link rel="stylesheet" href="../tomorrow-night.css">
<link rel="stylesheet" href="../ayu-highlight.css">
<!-- Custom theme stylesheets -->
<!-- Provide site root to javascript -->
<script>
var path_to_root = "../";
var default_theme = window.matchMedia("(prefers-color-scheme: dark)").matches ? "navy" : "light";
</script>
<!-- Start loading toc.js asap -->
<script src="../toc.js"></script>
</head>
<body>
<div id="body-container">
<!-- Work around some values being stored in localStorage wrapped in quotes -->
<script>
try {
var theme = localStorage.getItem('mdbook-theme');
var sidebar = localStorage.getItem('mdbook-sidebar');
if (theme.startsWith('"') && theme.endsWith('"')) {
localStorage.setItem('mdbook-theme', theme.slice(1, theme.length - 1));
}
if (sidebar.startsWith('"') && sidebar.endsWith('"')) {
localStorage.setItem('mdbook-sidebar', sidebar.slice(1, sidebar.length - 1));
}
} catch (e) { }
</script>
<!-- Set the theme before any content is loaded, prevents flash -->
<script>
var theme;
try { theme = localStorage.getItem('mdbook-theme'); } catch(e) { }
if (theme === null || theme === undefined) { theme = default_theme; }
const html = document.documentElement;
html.classList.remove('light')
html.classList.add(theme);
html.classList.add("js");
</script>
<input type="checkbox" id="sidebar-toggle-anchor" class="hidden">
<!-- Hide / unhide sidebar before it is displayed -->
<script>
var sidebar = null;
var sidebar_toggle = document.getElementById("sidebar-toggle-anchor");
if (document.body.clientWidth >= 1080) {
try { sidebar = localStorage.getItem('mdbook-sidebar'); } catch(e) { }
sidebar = sidebar || 'visible';
} else {
sidebar = 'hidden';
}
sidebar_toggle.checked = sidebar === 'visible';
html.classList.remove('sidebar-visible');
html.classList.add("sidebar-" + sidebar);
</script>
<nav id="sidebar" class="sidebar" aria-label="Table of contents">
<!-- populated by js -->
<mdbook-sidebar-scrollbox class="sidebar-scrollbox"></mdbook-sidebar-scrollbox>
<noscript>
<iframe class="sidebar-iframe-outer" src="../toc.html"></iframe>
</noscript>
<div id="sidebar-resize-handle" class="sidebar-resize-handle">
<div class="sidebar-resize-indicator"></div>
</div>
</nav>
<div id="page-wrapper" class="page-wrapper">
<div class="page">
<div id="menu-bar-hover-placeholder"></div>
<div id="menu-bar" class="menu-bar sticky">
<div class="left-buttons">
<label id="sidebar-toggle" class="icon-button" for="sidebar-toggle-anchor" title="Toggle Table of Contents" aria-label="Toggle Table of Contents" aria-controls="sidebar">
<i class="fa fa-bars"></i>
</label>
<button id="theme-toggle" class="icon-button" type="button" title="Change theme" aria-label="Change theme" aria-haspopup="true" aria-expanded="false" aria-controls="theme-list">
<i class="fa fa-paint-brush"></i>
</button>
<ul id="theme-list" class="theme-popup" aria-label="Themes" role="menu">
<li role="none"><button role="menuitem" class="theme" id="light">Light</button></li>
<li role="none"><button role="menuitem" class="theme" id="rust">Rust</button></li>
<li role="none"><button role="menuitem" class="theme" id="coal">Coal</button></li>
<li role="none"><button role="menuitem" class="theme" id="navy">Navy</button></li>
<li role="none"><button role="menuitem" class="theme" id="ayu">Ayu</button></li>
</ul>
<button id="search-toggle" class="icon-button" type="button" title="Search. (Shortkey: s)" aria-label="Toggle Searchbar" aria-expanded="false" aria-keyshortcuts="S" aria-controls="searchbar">
<i class="fa fa-search"></i>
</button>
</div>
<h1 class="menu-title">Notes</h1>
<div class="right-buttons">
<a href="../print.html" title="Print this book" aria-label="Print this book">
<i id="print-button" class="fa fa-print"></i>
</a>
<a href="https://github.com/johannst/notes" title="Git repository" aria-label="Git repository">
<i id="git-repository-button" class="fa fa-github"></i>
</a>
</div>
</div>
<div id="search-wrapper" class="hidden">
<form id="searchbar-outer" class="searchbar-outer">
<input type="search" id="searchbar" name="searchbar" placeholder="Search this book ..." aria-controls="searchresults-outer" aria-describedby="searchresults-header">
</form>
<div id="searchresults-outer" class="searchresults-outer hidden">
<div id="searchresults-header" class="searchresults-header"></div>
<ul id="searchresults">
</ul>
</div>
</div>
<!-- Apply ARIA attributes after the sidebar and the sidebar toggle button are added to the DOM -->
<script>
document.getElementById('sidebar-toggle').setAttribute('aria-expanded', sidebar === 'visible');
document.getElementById('sidebar').setAttribute('aria-hidden', sidebar !== 'visible');
Array.from(document.querySelectorAll('#sidebar a')).forEach(function(link) {
link.setAttribute('tabIndex', sidebar === 'visible' ? 0 : -1);
});
</script>
<div id="content" class="content">
<main>
<h1 id="gdb1"><a class="header" href="#gdb1">gdb(1)</a></h1>
<h1 id="cli"><a class="header" href="#cli">CLI</a></h1>
<pre><code class="language-markdown"> gdb [opts] [prg [-c coredump | -p pid]]
gdb [opts] --args prg <prg-args>
opts:
-p <pid> attach to pid
-c <coredump> use <coredump>
-x <file> execute script <file> before prompt
-ex <cmd> execute command <cmd> before prompt
--tty <tty> set I/O tty for debugee
--batch run in batch mode, exit after processing options (eg used
for scripting)
--batch-silent link --batch, but surpress gdb stdout
</code></pre>
<h1 id="interactive-usage"><a class="header" href="#interactive-usage">Interactive usage</a></h1>
<h2 id="misc"><a class="header" href="#misc">Misc</a></h2>
<pre><code class="language-markdown"> apropos <regex>
Search commands matching regex.
tty <tty>
Set <tty> as tty for debugee.
Make sure nobody reads from target tty, easiest is to spawn a shell
and run following in target tty:
> while true; do sleep 1024; done
sharedlibrary [<regex>]
Load symbols of shared libs loaded by debugee. Optionally use <regex>
to filter libs for symbol loading.
display [/FMT] <expr>
Print <expr> every time debugee stops. Eg print next instr, see
examples below.
undisplay [<num>]
Delete display expressions either all or one referenced by <num>.
info display
List display expressions.
info sharedlibrary [<regex>]
List shared libraries loaded. Optionally use <regex> to filter.
</code></pre>
<h2 id="breakpoints"><a class="header" href="#breakpoints">Breakpoints</a></h2>
<pre><code class="language-markdown"> break [-qualified] <sym> thread <tnum>
Set a breakpoint only for a specific thread.
-qualified: Treat <sym> as fully qualified symbol (quiet handy to set
breakpoints on C symbols in C++ contexts)
break <sym> if <cond>
Set conditional breakpoint (see examples below).
delete [<num>]
Delete breakpoint either all or one referenced by <num>.
info break
List breakpoints.
cond <bp> <cond>
Make existing breakpoint <bp> conditional with <cond>.
cond <bp>
Remove condition from breakpoint <bp>.
tbreak
Set temporary breakpoint, will be deleted when hit.
Same syntax as `break`.
rbreak <regex>
Set breakpoints matching <regex>, where matching internally is done
on: .*<regex>.*
command [<bp_list>]
Define commands to run after breakpoint hit. If <bp_list> is not
specified attach command to last created breakpoint. Command block
terminated with 'end' token.
<bp_list>: Space separates list, eg 'command 2 5-8' to run command
for breakpoints: 2,5,6,7,8.
save break <file>
Save breakpoints to <file>. Can be loaded with the `source` command.
</code></pre>
<h2 id="watchpoints"><a class="header" href="#watchpoints">Watchpoints</a></h2>
<pre><code class="language-markdown"> watch [-location|-l] <expr> [thread <tnum>]
Create a watchpoint for <expr>, will break if <expr> is written to.
Watchpoints respect scope of variables, -l can be used to watch the
memory location instead.
rwatch ...
Sets a read watchpoint, will break if <expr> is read from.
awatch ...
Sets an access watchpoint, will break if <expr> is written to or read
from.
</code></pre>
<h2 id="catchpoints"><a class="header" href="#catchpoints">Catchpoints</a></h2>
<pre><code class="language-markdown"> catch load [<regex>]
Stop when shared libraries are loaded, optionally specify a <regex>
to stop only on matches.
catch unload [<regex>]
Stop when shared libraries are unloaded, optionally specify a <regex>
to stop only on matches.
catch throw
Stop when an exception is thrown.
catch rethrow
Stop when an exception is rethrown.
catch catch
Stop when an exception is caught.
catch fork
Stop at calls to fork (also stops at clones, as some systems
implement fork via clone).
catch syscall [<syscall> <syscall> ..]
Stop at syscall. If no argument is given, stop at all syscalls.
Optionally give a list of syscalls to stop at.
</code></pre>
<h2 id="inspection"><a class="header" href="#inspection">Inspection</a></h2>
<pre><code class="language-markdown"> info functions [<regex>]
List functions matching <regex>. List all functions if no <regex>
provided.
info variables [<regex>]
List variables matching <regex>. List all variables if no <regex>
provided.
info register [<reg> <reg> ..]
Dump content of all registers or only the specified <reg>ister.
</code></pre>
<h2 id="signal-handling"><a class="header" href="#signal-handling">Signal handling</a></h2>
<pre><code class="language-markdown"> info handle [<signal>]
Print how to handle <signal>. If no <signal> specified print for all
signals.
handle <signal> <action>
Configure how gdb handles <signal> sent to debugee.
<action>:
stop/nostop Catch signal in gdb and break.
print/noprint Print message when gdb catches signal.
pass/nopass Pass signal down to debugee.
catch signal <signal>
Create a catchpoint for <signal>.
</code></pre>
<h2 id="multi-threading"><a class="header" href="#multi-threading">Multi-threading</a></h2>
<pre><code class="language-markdown">info thread
List all threads.
thread apply <id> [<id>] <command>
Run command on all threads listed by <id> (space separated list).
When 'all' is specified as <id> the <command> is run on all threads.
thread name <name>
The <name> for the current thread.
</code></pre>
<h2 id="multi-process"><a class="header" href="#multi-process">Multi-process</a></h2>
<pre><code class="language-markdown"> set follow-fork-mode <child | parent>
Specify which process to follow when debuggee makes a fork(2)
syscall.
set detach-on-fork <on | off>
Turn on/off detaching from new child processes (on by default).
Turning this off allows to debug multiple processes (inferiors) with
one gdb session.
info inferiors
List all processes gdb debugs.
inferior <id>
Switch to inferior with <id>.
</code></pre>
<h2 id="scheduling"><a class="header" href="#scheduling">Scheduling</a></h2>
<pre><code class="language-markdown"> set schedule-multiple <on | off>
on: Resume all threads of all processes (inferiors) when continuing
or stepping.
off: (default) Resume only threads of current process (inferior).
</code></pre>
<h2 id="shell-commands"><a class="header" href="#shell-commands">Shell commands</a></h2>
<pre><code class="language-markdown"> shell <shell_cmd>
Run the shell_cmd and print the output, can also contain a pipeline.
pipe <gdb_cmd> | <shell_cmd>
Evaluate the gdb_cmd and run the shell_cmd which receives the output
of the gdb_cmd via stdin.
</code></pre>
<h2 id="source-file-locations"><a class="header" href="#source-file-locations">Source file locations</a></h2>
<pre><code class="language-markdown"> dir <path>
Add <path> to the beginning of the searh path for source files.
show dir
Show current search path.
set substitute-path <from> <to>
Add substitution rule checked during source file lookup.
show substitute-path
Show current substitution rules.
</code></pre>
<h2 id="configuration"><a class="header" href="#configuration">Configuration</a></h2>
<pre><code class="language-markdown"> set disassembly-flavor <intel | att>
Set the disassembly style "flavor".
set pagination <on | off>
Turn on/off gdb's pagination.
set breakpoint pending <on | off | auto>
on: always set pending breakpoints.
off: error when trying to set pending breakpoints.
auto: interatively query user to set breakpoint.
set print pretty <on | off>
Turn on/off pertty printing of structures.
set style enabled <on | off>
Turn on/off styling (eg colored output).
set logging <on | off>
Enable output logging to file (default gdb.txt).
set logging file <fname>
Change output log file to <fname>
set logging redirect <on | off>
on: only log to file.
off: log to file and tty.
set logging overwrite <on | off>
on: Truncate log file on each run.
off: Append to logfile (default).
set history filename <fname>
Change file where to save and restore command history to and from.
set history <on | off>
Enable or disable saving of command history.
</code></pre>
<blockquote>
<p>Logging options should be configured before logging is turned on.</p>
</blockquote>
<h1 id="text-user-interface-tui"><a class="header" href="#text-user-interface-tui">Text user interface (TUI)</a></h1>
<pre><code class="language-markdown"> C-x a Toggle UI.
C-l Redraw UI (curses UI can be messed up after the debugee prints to
stdout/stderr).
C-x o Change focus.
</code></pre>
<h1 id="user-commands-macros"><a class="header" href="#user-commands-macros">User commands (macros)</a></h1>
<p>Gdb allows to create & document user commands as follows:</p>
<pre><code class="language-markdown"> define <cmd>
# cmds
end
document <cmd>
# docu
end
</code></pre>
<p>To get all user commands or documentations one can use:</p>
<pre><code class="language-markdown"> help user-defined
help <cmd>
</code></pre>
<h1 id="hooks"><a class="header" href="#hooks">Hooks</a></h1>
<p>Gdb allows to create two types of command <code>hooks</code></p>
<ul>
<li><code>hook-</code> will be run before <code><cmd></code></li>
<li><code>hookpost-</code> will be run after <code><cmd></code></li>
</ul>
<pre><code class="language-markdown"> define hook-<cmd>
# cmds
end
define hookpost-<cmd>
# cmds
end
</code></pre>
<h1 id="examples"><a class="header" href="#examples">Examples</a></h1>
<h2 id="automatically-print-next-instr"><a class="header" href="#automatically-print-next-instr">Automatically print next instr</a></h2>
<p>When ever the debugee stops automatically print the memory at the current
instruction pointer (<code>$rip</code> x86) and format as instruction <code>/i</code>.</p>
<pre><code class="language-markdown"> # rip - x86
display /i $rip
# step instruction, after the step the next instruction is automatically printed
si
</code></pre>
<h2 id="conditional-breakpoints"><a class="header" href="#conditional-breakpoints">Conditional breakpoints</a></h2>
<p>Create conditional breakpoints for a function <code>void foo(int i)</code> in the debugee.</p>
<pre><code class="language-markdown"> # Create conditional breakpoint
b foo if i == 42
b foo # would create bp 2
# Make existing breakpoint conditional
cond 2 i == 7
</code></pre>
<h2 id="set-breakpoint-on-all-threads-except-one"><a class="header" href="#set-breakpoint-on-all-threads-except-one">Set breakpoint on all threads except one</a></h2>
<p>Create conditional breakpoint using the <code>$_thread</code> <a href="https://sourceware.org/gdb/onlinedocs/gdb/Convenience-Vars.html#Convenience-Vars">convenience
variable</a>.</p>
<pre><code class="language-markdown"> # Create conditional breakpoint on all threads except thread 12.
b foo if $_thread != 12
</code></pre>
<h2 id="catch-sigsegv-and-execute-commands"><a class="header" href="#catch-sigsegv-and-execute-commands">Catch SIGSEGV and execute commands</a></h2>
<p>This creates a <code>catchpoint</code> for the <code>SIGSEGV</code> signal and attached the <code>command</code>
to it.</p>
<pre><code class="language-markdown"> catch signal SIGSEGV
command
bt
c
end
</code></pre>
<h2 id="run-backtrace-on-thread-1-batch-mode"><a class="header" href="#run-backtrace-on-thread-1-batch-mode">Run <code>backtrace</code> on thread 1 (batch mode)</a></h2>
<pre><code class="language-markdown"> gdb --batch -ex 'thread 1' -ex 'bt' -p <pid>
</code></pre>
<h2 id="script-gdb-for-automating-debugging-sessions"><a class="header" href="#script-gdb-for-automating-debugging-sessions">Script gdb for automating debugging sessions</a></h2>
<p>To script gdb add commands into a file and pass it to gdb via <code>-x</code>.
For example create <code>run.gdb</code>:</p>
<pre><code class="language-markdown"> set pagination off
break mmap
command
info reg rdi rsi rdx
bt
c
end
#initial drop
c
</code></pre>
<p>This script can be used as:</p>
<pre><code class="language-markdown"> gdb --batch -x ./run.gdb -p <pid>
</code></pre>
<h2 id="hook-to-automatically-save-breakpoints-on-quit"><a class="header" href="#hook-to-automatically-save-breakpoints-on-quit">Hook to automatically save breakpoints on <code>quit</code></a></h2>
<pre><code class="language-markdown">define break-save
save breakpoint $arg0.gdb.bp
end
define break-load
source $arg0.gdb.bp
end
define hook-quit
break-save quit
end
</code></pre>
<h2 id="watchpoint-on-struct--class-member"><a class="header" href="#watchpoint-on-struct--class-member">Watchpoint on struct / class member</a></h2>
<p>A symbolic watchpoint defined on a member variable for debugging is only valid
as long as the expression is in scope. Once out of scope the watchpoint gets
deleted.</p>
<p>When debugging some memory corruption we want to keep the watchpoint even the
expression goes out of scope to find the location that overrides the variable
and introduces the corruption.</p>
<pre><code class="language-markdown">(gdb) l
1 struct S { int v; };
2
3 void set(struct S* s, int v) {
4 s->v = v;
5 }
6
7 int main() {
8 struct S s;
9 set(&s, 1);
10 set(&s, 2);
11 set(&s, 3);
...
(gdb) s
set (s=0x7fffffffe594, v=1) at test.c:4
4 s->v = v;
# Define a new watchpoint on the member of the struct. The expression however
# is only valid in the current functions scope.
(gdb) watch s->v
Hardware watchpoint 2: s->v
(gdb) c
Hardware watchpoint 2: s->v
Old value = 0
New value = 1
set (s=0x7fffffffe594, v=1) at test.c:5
5 }
# The watchpoint gets deleted as soon as we leave the function scope.
(gdb) c
Watchpoint 2 deleted because the program has left the block in
which its expression is valid.
main () at test.c:10
10 set(&s, 2);
# Define the watchpoint on the location of the object to watch.
(gdb) watch -l s->v
# This is equivalent to the following.
(gdb) p &s->v
$1 = (int *) 0x7fffffffe594
# Define a watchpoint to the address of the member variable of the s instance.
# This of course only makes sense as long as the s instance is not moved in memory.
(gdb) watch *0x7fffffffe594
Hardware watchpoint 3: *0x7fffffffe594
(gdb) c
Hardware watchpoint 3: *0x7fffffffe594
Old value = 1
New value = 2
set (s=0x7fffffffe594, v=2) at test.c:5
5 }
(gdb) c
Hardware watchpoint 3: *0x7fffffffe594
Old value = 2
New value = 3
set (s=0x7fffffffe594, v=3) at test.c:5
5 }
</code></pre>
<h2 id="shell-commands-1"><a class="header" href="#shell-commands-1">Shell commands</a></h2>
<pre><code class="language-markdown"># Run shell commands.
(gdb) shell zcat /proc/config.gz | grep CONFIG_KVM=
CONFIG_KVM=m
# Pipe gdb command to shell command.
(gdb) pipe info proc mapping | grep libc
0x7ffff7a1a000 0x7ffff7a42000 0x28000 0x0 r--p /usr/lib/libc.so.6
0x7ffff7a42000 0x7ffff7b9d000 0x15b000 0x28000 r-xp /usr/lib/libc.so.6
0x7ffff7b9d000 0x7ffff7bf2000 0x55000 0x183000 r--p /usr/lib/libc.so.6
0x7ffff7bf2000 0x7ffff7bf6000 0x4000 0x1d7000 r--p /usr/lib/libc.so.6
0x7ffff7bf6000 0x7ffff7bf8000 0x2000 0x1db000 rw-p /usr/lib/libc.so.6
</code></pre>
<h1 id="know-bugs"><a class="header" href="#know-bugs">Know Bugs</a></h1>
<h2 id="workaround-command--finish-bug"><a class="header" href="#workaround-command--finish-bug">Workaround <code>command + finish</code> bug</a></h2>
<p>When using <code>finish</code> inside a <code>command</code> block, commands after <code>finish</code> are not
executed. To workaround that bug one can create a wrapper function which calls
<code>finish</code>.</p>
<pre><code class="language-markdown"> define handler
bt
finish
info reg rax
end
command
handler
end
</code></pre>
</main>
<nav class="nav-wrapper" aria-label="Page navigation">
<!-- Mobile navigation buttons -->
<a rel="prev" href="../debug/index.html" class="mobile-nav-chapters previous" title="Previous chapter" aria-label="Previous chapter" aria-keyshortcuts="Left">
<i class="fa fa-angle-left"></i>
</a>
<a rel="next prefetch" href="../debug/gdbserver.html" class="mobile-nav-chapters next" title="Next chapter" aria-label="Next chapter" aria-keyshortcuts="Right">
<i class="fa fa-angle-right"></i>
</a>
<div style="clear: both"></div>
</nav>
</div>
</div>
<nav class="nav-wide-wrapper" aria-label="Page navigation">
<a rel="prev" href="../debug/index.html" class="nav-chapters previous" title="Previous chapter" aria-label="Previous chapter" aria-keyshortcuts="Left">
<i class="fa fa-angle-left"></i>
</a>
<a rel="next prefetch" href="../debug/gdbserver.html" class="nav-chapters next" title="Next chapter" aria-label="Next chapter" aria-keyshortcuts="Right">
<i class="fa fa-angle-right"></i>
</a>
</nav>
</div>
<script>
window.playground_copyable = true;
</script>
<script src="../elasticlunr.min.js"></script>
<script src="../mark.min.js"></script>
<script src="../searcher.js"></script>
<script src="../clipboard.min.js"></script>
<script src="../highlight.js"></script>
<script src="../book.js"></script>
<!-- Custom JS scripts -->
</div>
</body>
</html>
