Image

Table of Contents

• What is this?
• Setup
  • Install (Ubuntu 23.04 or after)
  • Install (Ubuntu 22.04 or before)
  • Upgrade
  • Uninstall
  • Dependency
• Supported environment
• Supported mode
• Added / improved features
  • Qemu-system cooperation
  • Qemu-user cooperation
  • Heap dump features
  • Improved features
  • Added features
  • Other
• FAQ

What is this?

This is a fork of GEF. However, there are 3 major improvements.

1. Added many heuristic commands for kernel debugging WITHOUT symboled vmlinux (for qemu-system; linux kernel 3.x ~ 6.9.x).
2. Added support for many architectures (for qemu-user).
3. Added some heap dump commands for various allocators.

Many other commands have been added and improved. Enjoy!

Setup

Install

# Ubuntu 23.04 or later restrict global installation of python packages with pip3.
# So you need --break-system-packages option.
wget -q https://raw.githubusercontent.com/bata24/gef/dev/install.sh -O- | sed -e 's/pip3 install/pip3 install --break-system-packages/g' | sh

• Note
  • To simplify the installation script, GEF (gef.py) is installed to a fixed path (/root/.gdbinit-gef.py).
  • Also, it registers the GEF path to /root/.gdbinit.
  • If you want to change the location, please modify both of them yourself.

Upgrade

python3 /root/.gdbinit-gef.py --upgrade

Uninstall

rm -f /root/.gdbinit-gef.py /root/.gef.rc
sed -i -e '/source \/root\/.gdbinit-gef.py/d' /root/.gdbinit

Dependency

See install.sh or install-minimal.sh.

Supported environment

• Tested on ubuntu 24.04.
• It may work under ubuntu 20.04 - 23.10, debian 10.x or after.

Supported mode

• Normal debugging
• Attach to the process
• Attach to the process in another pid namespace (e.g. attaching from outside of docker)
• Connect to gdbserver
• Connect to the gdb stub of qemu-system
• Connect to the gdb stub of qemu-user
• Connect to the gdb stub of Intel Pin
• Connect to the gdb stub of Intel SDE
• Connect to the gdb stub of qiling framework
• Connect to the gdb stub of KGDB (need gdb 12~)
• Connect to the gdb stub of VMWare
• Connect to the gdb stub of wine
• Record and replay debugging (rr replay)

See docs/SUPPORTED-MODE.md for detail.

Added / improved features

Qemu-system cooperation

• pagewalk: scans physical memory, parses page tables, and displays memory maps.
  • x64 (Supported: 4-Level/5-Level Paging)
    • 
  • x86 (Supported: PAE/Non-PAE)
    • 
  • ARM64 (Supported: only Cortex-A, EL0-EL3, stage1-2)
    • ARM v8.7 base. 32bit mode is NOT supported.
    • 
    • Here is a sample of each level pagewalk from HITCON CTF 2018 super_hexagon.
    • 
    • Secure memory scanning is also supported, but you have to break in the secure world.
    • 
    • Pseudo memory map without detailed flags and permission can be output even in the normal world (when OP-TEE).
    • 
  • ARM (Supported: only Cortex-A, LPAE/Non-LPAE, PL0/PL1)
    • ARM v7 base. PL2 is NOT supported.
    • 
    • Secure memory scanning is also supported, and you don't have to break in the secure world (unlike ARM64).
    • 
• v2p/p2v: displays transformation virtual address <-> physical address.
  • 
• xp: is a shortcut for physical memory dump.
  • 
• qreg: displays the register values from qemu-monitor (allows to get like $cs even under qemu 2.x).
  • It is shortcut for monitor info registers.
  • It also prints the details of the each bit of the system register when x64/x86.
  • 
• sysreg: pretty prints system registers.
  • It is the result of info registers with filtering general registers.
  • 
• qemu-device-info: dumps device information for qemu-escape (WIP).
• msr: reads/writes MSR (Model Specific Registers) value by embedding/executing dynamic assembly.
  • Supported on only x64 and x86.
  • 
• uefi-ovmf-info: dumps addresses of some important structures in each boot phase of UEFI when OVMF is used.
  • Supported on only x64.
  • 
• xsm: dumps secure memory when gdb is in normal world.
  • Supported on only ARM64 and ARM.
  • 
• wsm: writes the value to secure memory when gdb is in normal world.
  • Supported on only ARM64 and ARM.
  • 
• bsm: sets the breakpoint to secure memory when gdb is in normal world.
  • Supported on only ARM64 and ARM.
  • 
• optee-break-ta: sets the breakpoint to the offset of OPTEE-Trusted-App when gdb is in normal world.
  • Supported on only ARM64 and ARM.
  • 
• pac-keys: pretty prints ARM64 PAC keys.
  • Supported on only ARM64.
  • 
• kbase: displays the kernel base address.
• kversion: displays the kernel version.
• kcmdline: displays the kernel cmdline used at boot time.
• kcurrent: displays current task address.
  • 
• ksymaddr-remote: displays kallsyms information from scanning kernel memory.
  • Supported kernel versions: 3.x to 6.9.x.
  • 
• ksymaddr-remote-apply/vmlinux-to-elf-apply: applies kallsyms information obtained by ksymaddr-remote or vmlinux-to-elf to gdb.
  • 
  • 
  • Once you get symboled pseudo ELF file, you can reuse and apply it automatically even after rebooting qemu-system.
  • vmlinux-to-elf-apply and ksymaddr-remote-apply provide almost the same functionality.
    • vmlinux-to-elf-apply: Requires installation of external tools. Create vmlinux with symbols.
    • ksymaddr-remote-apply: Requires no external tools. Create an blank ELF with only embedded symbols.
• slub-dump: dumps slub free-list.
  • Supported on x64/x86/ARM64/ARM + SLUB + no-symbol + kASLR.
  • Supported on both CONFIG_SLAB_FREELIST_HARDENED is y or n.
  • It supports to dump partial pages (-v) and NUMA node pages (-vv).
  • Since page_to_virt is difficult to implement, it will heuristically determine the virtual address from the free-list.
  • 
• slab-dump: dumps slab free-list.
  • Supported on x64/x86/ARM64/ARM + SLAB + no-symbol + kASLR.
  • 
• slob-dump: dumps slob free-list.
  • Supported on x64/x86/ARM64/ARM + SLOB + no-symbol + kASLR.
  • 
• slub-tiny-dump: dumps slub-tiny free-list.
  • Supported on x64/x86/ARM64/ARM + SLUB-TINY + no-symbol + kASLR.
  • 
• slab-contains: resolves which kmem_cache certain address (object) belongs to (for SLUB/SLUB-TINY/SLAB).
  • 
  • For SLUB/SLUB-TINY, if all chunks belonging to a certain page are in use, they will not be displayed by slub-dump/slub-tiny-dump command.
  • Even with such an address (object), this command may be able to resolve kmem_cache.
• buddy-dump: dumps zone of page allocator (buddy allocator) free-list.
  • 
• vmalloc-dump: dumps vmalloc used-list and freed-list.
  • 
• page: displays transformation struct page <-> virtual/physical address.
  • 
  • There are shortcuts: virt2page, page2virt, phys2page and page2phys.
• kmalloc-tracer: collects and displays information when kmalloc/kfree.
  • 
• kmalloc-allocated-by: calls a predefined set of system calls and prints structures allocated by kmalloc or freed by kfree.
  • 
• kmagic: displays useful addresses in kernel.
  • 
• kchecksec: checks kernel security.
  • 
• kconfig: dumps kernel config if available.
  • 
• syscall-table-view: displays system call table.
  • 
  • It also dumps ia32/x32 syscall table under x64.
  • It also dumps compat syscall table under ARM64.
• ksysctl: dumps sysctl parameters.
  • 
• ktask: displays each task address.
  • 
  • It also displays the memory map of the userland process.
  • 
  • It also displays the register values saved on kstack of the userland process.
  • 
  • It also displays the file descriptors of the userland process.
  • 
  • It also displays the signal handlers of the userland process.
  • 
  • It also displays the namespaces of the userland process.
  • 
• kmod: displays each module address.
  • 
  • It also displays each module symbols.
  • 
• kops: displays each operations member.
  • 
• kcdev: displays each character device information.
  • 
• kbdev: displays each block device information.
  • If there are too many block devices, detection will not be successful.
  • This is because block devices are not managed in one place, so I use the list of bdev_cache obtained from the slub-dump results.
  • 
• kfilesystems: dumps supported file systems.
  • 
• kclock-source: dumps clocksource list.
  • 
• kdmesg: dumps the ring buffer of dmesg area.
  • 
• kpipe: displays each pipe information.
  • 
• kbpf: dumps bpf information.
  • 
• ktimer: dumps timer.
  • 
• kpcidev: dumps PCI devices.
  • 
• kipcs: dumps IPCs information (System V semaphore, message queue and shared memory).
  • 
• kdevio: dumps I/O-port and I/O-memory information.
  • 
• kdmabuf: dumps DMA-BUF information.
  • 
• kirq: dumps irq information.
  • 
• knetdev: displays net devices.
  • 
• ksearch-code-ptr: searches the code pointer in kernel data area.
  • 
• pagewalk-with-hints: prints pagetables with description.
  • 
• thunk-tracer: collects and displays the thunk function addresses that are called automatically (only x64/x86).
  • If this address comes from RW area, this is useful for getting RIP.
  • 
• usermodehelper-tracer: collects and displays the information that is executed by call_usermodehelper_setup.
  • 

Qemu-user cooperation

• si/ni: are the wrapper for native si/ni if OpenRISC or cris.
  • On OpenRISC architecture, branch operations don't work well, so use breakpoints to simulate.
  • On cris architecture, stepi/nexti commands don't work well, so use breakpoints to simulate.
  • If you want to use native si/ni, use the full form stepi/nexti.
• c: is the wrapper for native c if gdb is connected to qemu-user or intel pin.
  • When connecting to gdb stub of qemu-user or Intel Pin, gdb does not trap SIGINT during continue.
  • If you want to trap, you need to issue SIGTRAP on the qemu-user or pin side, but switching screens is troublesome.
  • This command realizes a pseudo SIGTRAP trap by trapping SIGINT on the python side and throwing SIGTRAP back to qemu-user or Intel Pin.
  • It works only local qemu-user or Intel Pin.
  • If you want to use native c, use the full form continue.

Heap dump features

• Glibc heap commands are improved.
  • It changes the color.
    • 
  • They print bins information if the chunk is in free-list.
    • 
  • Thread arena is supported for all heap commands.
    • Use -a option.
  • It supports new modes heap arenas and heap top.
  • find-fake-fast: searches for a memory with a size-like value that can be linked to the fastbin free-list.
    • 
  • visual-heap: is colorized heap viewer.
    • 
  • extract-heap-addr: analyzes tcache-protected-fd introduced from glibc-2.32.
    • 
• uClibc heap commands are added.
  • uclibc-ng-heap-dump: dumps uClibc-ng heap chunks.
    • Supported on x64/x86, based on uClibc-ng v1.0.42 malloc-standard.
    • 
    • How to test (x64):
      • Download and extract x86-64--uclibc--stable-2022.08-1.tar.bz2 from https://toolchains.bootlin.com/
      • Add /PATH/TO/x86_64-buildroot-linux-uclibc/bin to $PATH, then build as x86_64-linux-gcc test.c.
      • Fix interpreter by patchelf --set-interpreter /PATH/TO/x86_64-buildroot-linux-uclibc/sysroot/lib/ld64-uClibc.so.0 a.out.
  • uclibc-ng-visual-heap: is colorized heap viewer for uClibc-ng.
    • 
• partition-alloc-dump: dumps partition-alloc free-list for chromium.
  • 
  • This command is reserved for the implementation of latest version of chromium.
    • Currently tested: v128.x / 1319627 / f2ab309f349c1b4b833b363194c6089323cdcfc0
    • https://commondatastorage.googleapis.com/chromium-browser-snapshots/index.html?prefix=Linux_x64/1319627/
  • Supported on only x64/ARM64 (maybe it works on x86/ARM too, but not tested).
  • It will try heuristic search if binary has no symbol.
  • How to test:
    • See dev/partition-alloc-dump/downloader.py.
• tcmalloc-dump: dumps tcmalloc free-list.
  • Supported on only x64, based on gperftools-2.9.1 (named libgoogle-perftools{4,-dev})
  • 
  • How to test:
    • Execute as LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libtcmalloc.so ./a.out.
• musl-heap-dump: dumps musl-libc heap chunks.
  • Supported on x64/x86, based on musl-libc v1.2.5.
  • 
  • How to test:
    • Get and extract latest source from https://musl.libc.org/
    • Build with ./configure && make install.
    • Build as /usr/local/musl/bin/musl-gcc test.c.
• go-heap-dump: dumps go language v1.22.2 mheap (only x64).
  • 
• tlsf-heap-dump: dumps TLSF (Two-Level Segregated Fit) v2.4.6 free-list (only x64).
  • 
  • How to test (x64):
    • Get and extract latest source from http://www.gii.upv.es/tlsf/
    • Build with cd TLSF-2.4.6/src && make && cd ../examples && make then use test1 etc.
• hoard-heap-dump: dumps Hoard v3.13 free-list (only x64).
  • 
  • How to test (x64):
    • Get and extract latest source from https://github.com/emeryberger/Hoard
    • Build with cd Hoard/src && make.
    • Execute as LD_PRELOAD=/path/to/libhoard.so ./a.out.
• mimalloc-heap-dump: dumps mimalloc free-list (only x64).
  • 
  • How to test (x64):
    • Get and extract latest source from https://github.com/microsoft/mimalloc
    • Build with mkdir build && cd build && cmake .. && make.
    • Execute as LD_PRELOAD=/path/to/libmimalloc.so ./a.out.
• optee-bget-dump: dumps bget allocator of OPTEE-Trusted-App.
  • 

Improved features

• vmmap: is improved.
  • It displays the memory map information even when connecting to gdb stub like qemu-user.
    • 
  • Intel Pin is supported.
    • 
  • Intel SDE is supported.
    • 
  • It is redirected to pagewalk when connecting to gdb stub of qemu-system.
  • It supports detection and coloring of Writable, ReadOnly, None and RWX regions.
  • It shows the area each register points to.
• registers: is improved.
  • It also shows raw values of flag register, current ring, exception level, secure state, etc.
    • 
    • 
    • 
• context: is improved.
  • It supports automatic display of system call arguments when calling a system call.
    • 
  • It supports automatic display of address and value when accessing memory.
    • 
  • It supports smart symbol printing for cpp function.
    • ex: std::map<int, std::map<int, int>> will be replaced by std::map<...>.
    • 
    • command: gef config context.smart_cpp_function_name true or smart-cpp-function-name (later is used to toggle).
• telescope: is improved.
  • It displays ordinal numbers as well as offsets.
  • It displays if there are canary and ret-addr on the target area.
    • 
  • It supports blacklist address features (to avoid dying when touching the address mapped to the serial device).
  • It also shows the symbol if available.
  • It supports some new options: --is-addr, --is-not-addr, --uniq, --depth, --slab-contains, --slab-contains-unaligned, --phys and --tag.
• proc-info: is improved.
  • It displays some additional information.
    • 
• elf-info: is improved.
  • It displays Program Header and Section Header.
  • It supports parsing from memory.
  • It supports parsing remote binary (if download feature is available).
    • 
• xinfo: is improved.
  • It shows more information.
  • It also supports kernel debugging.
    • 
• checksec: is improved.
  • It shows additional information.
    • Static or Dynamic or Static-PIE
    • Stripped or not
    • Debuginfo or not
    • Intel CET IBT/SHSTK
    • ARMv8 PAC, ARMv8 MTE
    • RPATH, RUNPATH
    • Clang CFI/SafeStack
    • System-ASLR, GDB ASLR setting
  • It supports parsing remote binary (if download feature is available).
  • 
• got: is improved.
  • It displays not only GOT address but also PLT address.
    • 
  • It scans .plt.sec section if Intel CET is enabled.
  • It can also display the GOT of the library.
    • 
  • It can also display type, offset, reloc_arg, section and permission.
    • 
• canary: is improved.
  • It displays all canary positions in memory.
    • 
• edit-flags: is improved.
  • It displays the meaning of each bit if -v option is provided.
    • 
    • 
    • 
• unicorn-emulate: is improved.
  • It reads and writes correctly to the address pointed to by $fs/$gs.
  • It supports a new mode to stop after executing N instructions (-g).
  • It shows changed memories.
    • 
• ropper: is improved.
  • It does not reset autocomplete settings after calling imported ropper.
• hexdump: is improved.
  • It supports physical memory if under qemu-system.
  • It will retry with adjusting read size when failed reading memory.
  • By default, the same line is omitted.
  • 
• patch: is improved.
  • It supports physical memory if under qemu-system.
  • Added some new modes: pattern, hex, history, revert, nop, inf, trap, ret, and syscall.
  • nop command has been integrated into patch command.
  • 
• search-pattern: is improved.
  • It supports when under qemu-system (in short, it works without /proc/self/maps)
  • It supports hex string specification, aligned search, search interval and search limit.
  • It also searches UTF-16 string if target string is ASCII.
  • 
• mprotect: is improved.
  • It supports more architectures.
  • 
• hijack-fd: is improved.
  • It supports more architectures.
  • 
• format-string-helper is improved.
  • It supports more printf-like functions.
• theme is improved.
  • Supports many colors.
  • 
  • 
• reset-cache is improved.
  • The cache structure within GEF has changed significantly. This command corresponds to them.

Added features

• pid/tid: prints pid and tid.
• filename: prints filename.
• fds: shows opensed file descriptors.
• auxv: pretty prints ELF auxiliary vector.
  • Supported also under qemu-user.
  • 
• argv/envp: pretty prints argv and envp.
  • 
• dumpargs: dumps arguments of current function.
  • 
• vdso: disassembles the text area of vdso smartly.
  • 
• vvar: dumps the area of vvar.
  • This area is mapped to userland, but cannot be accessed from gdb.
  • Therefore, it executes the assembly code and retrieve the contents.
  • 
• gdtinfo: pretty prints GDT entries. If userland, show sample entries.
  • 
• idtinfo: pretty prints IDT entries. If userland, show sample entries.
  • 
• tls: pretty prints TLS area. Requires glibc.
  • 
• fsbase/gsbase: pretty prints $fs_base, $gs_base.
  • 
• libc/ld/heapbase/codebase: displays each of the base address.
  • 
• got-all: shows got entries for all libraries.
• break-rva: sets a breakpoint at relative offset from codebase.
  • 
• command-break: sets a breakpoint which executes user defined command if hit.
  • 
• main-break: sets a breakpoint at main with or without symbols, then continue.
  • This is useful when you just want to run to main under using qemu-user or pin, or debugging no-symbol ELF.
• break-if-taken/break-if-not-taken: sets a breakpoint which breaks if branch is taken (or not taken).
• distance: calculates the offset from its base address.
  • 
• fpu/mmx/sse/avx: pretty prints FPU/MMX/SSE/AVX registers.
  • 
• xmmset: sets the value to xmm/ymm register simply.
  • 
• mmxset: sets the value to mm register simply.
  • 
• exec-until: executes until specified operation.
  • Supported following patterns of detection.
    • call
    • jmp
    • syscall
    • ret
    • indirect-branch (only x64/x86)
    • all-branch (call || jmp || ret)
    • memory-access (detect just [...])
    • specified-keyword-regex
    • specified-condition (expressions using register or memory values)
    • user-code
    • libc-code
    • secure-world
  • 
• xuntil: executes until specified address.
  • It is slightly easier to use than the original until command.
• add-symbol-temporary: adds symbol information from command-line.
  • 
• errno: displays errno list or specified errno.
  • 
• u2d: shows cast/convert u64 <-> double/float.
  • 
• unsigned: shows unsigned value.
  • 
• convert: shows various conversion.
  • 
• walk-link-list: walks the link list.
  • 
• hexdump-flexible: displays the hexdump with user defined format.
  • 
• hash-memory: calculates various hashes/CRCs.
  • 
• saveo/diffo: saves and diffs the command outputs.
  • 
• memcmp: compares the contents of the address A and B, whether virtual or physical.
  • 
• memset: sets the value to the memory range, whether virtual or physical.
• memcpy: copies the contents from the address A to B, whether virtual or physical.
• memswap: swaps the contents of the address A and B, whether virtual or physical.
• meminsert: inserts the contents of the address A to B, whether virtual or physical.
  • 
• is-mem-zero: checks the contents of address range is all 0x00 or 0xff or not.
  • 
• seq-length: detects consecutive length of the same sequence.
  • 
• strings: searches ASCII string from specific location.
  • 
• xs: dumps string like x/s command, but with hex-string style.
  • 
• xc: dumps address like x/x command, but with coloring at some intervals.
  • 
• ii: is a shortcut for x/50i $pc with opcode bytes.
  • It prints the value if it is memory access operation.
  • 
• version: shows software versions that gef used.
  • 
• arch-info: shows architecture information used in gef.
  • 
• context-extra: manages user specified command to execute when each step.
• comment: manages user specified temporary comment.
• seccomp: invokes seccomp-tools.
• onegadget: invokes one_gadget.
  • 
• rp: invokes rp++ with commonly used options.
• call-syscall: calls system call with specified values.
  • 
• mmap: allocates a new memory by call-syscall.
• killthreads: kill specific or all pthread.
• constgrep: invokes grep under /usr/include.
  • 
• proc-dump: dumps each file under /proc/PID/.
  • 
• up/down: are the wrapper for native up/down.
  • It shows also backtrace.
• time: measures the time of the GDB command.
  • 
• multi-line: executes multiple GDB commands in sequence.
  • 
• cpuid: shows the result of cpuid(eax=0,1,2...).
  • 
• read-system-register: reads system register for old qemu-system-arm.
  • 
• capability: shows the capabilities of the debugging process.
  • 
• dasm: disassembles the code by capstone.
  • 
• asm-list: lists up instructions. (only x64/x86)
  • 
  • This command uses x86data.js from https://github.com/asmjit/asmdb
• syscall-search: searches system call by regex.
  • 
• syscall-sample: shows the syscall calling sample for specified architecture.
• dwarf-exception-handler: dumps the DWARF exception handler information.
  • 
• magic: displays useful addresses in glibc etc.
  • 
• dynamic: dumps the _DYNAMIC area.
  • 
• link-map: dumps useful members of link_map with iterating.
  • 
• dtor-dump: dumps some destructor functions list.
  • 
• ptr-mangle: shows the mangled value will be mangled by PTR_MANGLE.
• ptr-demangle: shows the demangled value of the value mangled by PTR_MANGLE.
  • 
• search-mangled-ptr: searches the mangled value from RW memory.
  • 
• follow: changes follow-fork-mode setting.
  • 
• smart-cpp-function-name: toggles context.smart_cpp_function_name setting.
• ret2dl-hint: shows the structure used by return-to-dl-resolve as hint.
  • 
• srop-hint: shows the code for sigreturn-oriented-programming as hint.
  • 
• sigreturn: displays stack values for sigreturn syscall.
  • 
• smart-memory-dump: dumps all regions of the memory to each file.
  • 
• search-cfi-gadgets: searches CFI-valid (for CET IBT) and controllable generally gadgets from executable area.
  • 
• symbols: lists up all symbols with coloring.
  • 
• types: lists up all types with compaction.
  • 
• dt: makes it easier to use ptype /ox TYPE and p ((TYPE*) ADDRESS)[0].
  • 
  • This command is designed for several purposes.
    1. When displaying very large struct, you may want to go through a pager because the results will not fit on one screen. However, using a pager, the color information disappears. This command calls the pager with preserving colors.
    2. When ptype /ox TYPE, interpreting member type recursively often result is too long and difficult to read. This command keeps result compact by displaying only top-level members.
    3. When p ((TYPE*) ADDRESS)[0] for large struct, the setting of max-value-size is too small to display. This command adjusts it automatically.
    4. When debugging a binary written in the golang, the offset information of the type is not displayed. This command also displays the offset.
    5. When debugging a binary written in the golang, the p ((TYPE*) ADDRESS)[0] command will be broken. Because the golang helper script is automatically loaded and overwrites the behavior of p command. This command creates the display results on the python side, so we can display it without any problems.
• v8: displays v8 tagged object.
  • 
  • It also loads more commands from latest gdbinit for v8.
  • 
• mte-tags: displays the MTE tags for the specified address.
  • Supported on only ARM64.
  • 
• iouring-dump: dumps the area of iouring (only x64).
  • This area is mapped to userland, but cannot be accessed from gdb.
  • Therefore, it executes the assembly code and retrieve the contents.
  • 
• reset-bp: shows and resets all breakpoints.
• gef arch-list: displays defined architecture information.
  • 
• gef pyobj-list: displays defined global python object.
  • 
• gef avail-comm-list: displays a list of commands which are available or not for the current architecture and gdb execution mode.
  • 
• binwalk-memory: scans memory by binwalk.
  • 
• filetype-memory: scans memory by file and magika.
  • 

Other

• The category is introduced in gef help.
  • 
• Combined into one file (from gef-extra). The following are moved from gef-extras.
  • peek-pointers, current-stack-frame, xref-telescope, bytearray, and bincompare.
  • This is because a single file is more attractive than ease of maintenance.
• The system-call table used by syscall-args is moved from gef-extras.
  • It was updated up to linux kernel 6.10.0-rc3 for each architecture.
• Removed some features I don't use.
  • $, ida-interact, gef-remote, pie, pcustom, ksymaddr, trace-run, bufferize, output redirect and shellcode.
• Many bugs fix / formatting / made it easy for me to use.

FAQ

• See docs/FAQ.md.