Roadmap and changelog 5/4/2016:
+ gef.py : heap: added sub-command arenas (issue #22)
— heap – added new sub-command fastbins
+ docs: added gef save/restore
what’s new in 2016, Latest Change 20/2/2016:
+ New Features:
— Patch Command: The
patch command allows to easily bypass a call or syscall.
— heap command:
heap command provides information on the heap chunk specified as argument.
— xinfo/vmmap/xfiles commands:
xfiles display a comprehensive and human-friendly memory mapping of either the process or a specific location.
— Remote debugging: It is possible to use
gef in a remote debugging environment.
— set-permission command: This command was added to facilitate the exploitation process, by changing the permission rights on a specific page directly from the debugger.
— unicorn command: If you have installed [
unicorn](http://unicorn-engine.org) emulation engine and its Python bindings,
gef integrates a new command to emulate instructions
— trace-run command: The
trace-run is meant to be provide a visual appreciation directly in IDA disassembler of the path taken by a specific execution. It should be used with
+ added documentation for trace-run
+ Update gef.sh
GEF is aimed to be used mostly by exploiters and reverse-engineers. It provides additional features to GDB using the Python API to assist during the process of dynamic analysis or exploit development.
GEF fully relies on GDB API and other Linux specific source of information (such as /proc/pid). As a consequence, some of the features might not work on custom or harden systems such as GrSec. It has fully support for Python2 and Python3 indifferently (as more and more distro start pushing gdb compiled with Python3 support).
GEF supports all the architecture supported by GDB :
* x86-32/x86-64 (even though you should totally use
gdb-peda (https://github.com/longld/peda) instead)
* armv6/armv7/armv8 (untested)
# Tested on gdb 7.x / python 2.6 & 2.7 & 3.x
# To start: in gdb, type `source /path/to/gef.py
Setup from repository
The best way to use GEF is through cloning the git repository from GitHub, and source the file from your ~/.gdbinit.
$ git clone https://github.com/hugsy/gef.git # or git pull to update
$ echo ‘source /path/to/gef.py’ >> ~/.gdbinit
One-time setup script
If you only need GEF for a one-time environment (VMs, etc.) that do not have/need git installed, just go with:
$ curl -s -L https://github.com/hugsy/gef/raw/master/gef.sh | sh
A few commands were added to GEF to extend its possibilities. It is recommended to install the following modules:
+ capstone highly recommended https://github.com/aquynh/capstone
+ ROPgadget highly recommended https://github.com/JonathanSalwan/ROPgadget
+ python-radare2 https://github.com/radare/radare2-bindings