1. 查看寄存器
(gdb) i r
(gdb) i r a # 查看所有寄存器(包括浮点、多媒体)
(gdb) i r esp #x86
(gdb) i r pc #arm 的eip
2. 查看内存
(gdb) x /wx 0x80040000 # 以16进制显示指定地址处的数据
(gdb) x /8x $esp
(gdb) x /16x $esp+12
(gdb) x /16s 0x86468700 # 以字符串形式显示指定地址处的数据
(gdb) x /24i 0x8048a51 # 以指令形式显示指定地址处的数据(24条)
3. 修改寄存器的值
(gdb) set $r0 = 0x004000000
(gdb) set $pc = 0xbfc00000
4. 修改内存的值
(gdb) set {unsigned int}0x112233=0x0
(gdb) set *(unsigned int*)0x112233=0x55aa55aa
5. 内存搜索
Usage: find <start> <end> <count> <value>
(gdb) define find
set $ptr = $arg0
set $cnt = 0
while ( ($ptr<=$arg1) && ($cnt<$arg2) )
if ( *(unsigned int *)$ptr == $arg3 )
x /wx $ptr
set $cnt = $cnt + 1
end
set $ptr = $ptr + 4
end
end
6. 断点、监测点
(gdb) b *0x80400000
(gdb) watch *(unsigned int *)0xbffff400==0x90909090
7.反汇编分析
set disassembly-flavor 设置ATT或INTEL格式
(gdb) disas /r 0x401265,0x401270
(gdb) p /x *(int*)0x401265 查看机器码
(gdb) p *(int*)0x401365 =0x9090 修改并查看机器码