pwndbg — GDB Plugin for Exploit Development and Reverse Engineering

Introduction

pwndbg is a GDB plugin that replaces the default debugging experience with a feature-rich interface designed for exploit developers and reverse engineers. It provides automatic context displays showing registers, disassembly, stack, and backtrace simultaneously, along with specialized commands for heap analysis, ROP gadget searching, and binary security assessment.

What pwndbg Does

• Displays a rich context view on every breakpoint showing registers, disassembly, stack contents, and backtrace
• Provides heap introspection commands for glibc malloc including chunk inspection, bin listing, and arena analysis
• Shows virtual memory mappings with permissions, making it easy to identify writable and executable regions
• Includes architecture-aware disassembly supporting x86, x86-64, ARM, AArch64, MIPS, PowerPC, and RISC-V
• Integrates security checks via checksec to show ASLR, NX, canary, PIE, and RELRO status

Architecture Overview

pwndbg is a pure Python plugin that hooks into GDB's Python API. It registers custom commands and event handlers that trigger on breakpoints, steps, and crashes to render the context display. The plugin layers on top of GDB without modifying it, using GDB's inferior access for memory reads, register inspection, and breakpoint management. Architecture-specific modules handle disassembly differences and calling convention display across supported platforms.

Self-Hosting & Configuration

• Run ./setup.sh in the cloned repository to install dependencies and configure GDB automatically
• The setup script modifies ~/.gdbinit to load pwndbg on every GDB session
• Customize display with set context-sections to show or hide registers, code, stack, or backtrace panels
• Compatible with GDB 8.0+ and Python 3.6+; works on most Linux distributions
• Can coexist with pwntools for end-to-end exploit development workflows

Key Features

• Automatic context display eliminates repetitive info registers and x/ commands during debugging
• Heap commands understand glibc internals including tcache, fastbins, unsorted bins, and large bins
• Telescope command recursively dereferences pointers to reveal data structures and function pointers
• Search commands find byte patterns, strings, and pointer values across mapped memory regions
• Color-coded output distinguishes code, data, stack, and heap addresses at a glance

Comparison with Similar Tools

• GEF — similar GDB enhancement with a single-file installation; pwndbg offers deeper heap analysis and a larger command set
• PEDA — the original GDB exploit development plugin; pwndbg provides more modern features and active maintenance
• Voltron — a modular debugger UI that works across GDB and LLDB; pwndbg is GDB-specific with tighter integration
• radare2/r2 — a standalone reverse engineering framework; pwndbg enhances GDB for dynamic analysis while r2 excels at static analysis

FAQ

Q: Can pwndbg work alongside pwntools? A: Yes, pwndbg and pwntools complement each other. Use pwntools to write exploit scripts and pwndbg to debug them interactively via gdb.attach().

Q: Does pwndbg support remote debugging? A: Yes, pwndbg works with GDB's remote debugging protocol, including connections to gdbserver, QEMU, and embedded targets.

Q: How does pwndbg handle stripped binaries? A: pwndbg works with stripped binaries by using address-based navigation. It provides commands to identify functions heuristically even without symbol information.

Q: Can I use pwndbg for kernel debugging? A: Yes, pwndbg includes kernel-specific commands for QEMU-based kernel debugging, including slab cache inspection and kernel structure parsing.

Sources

• https://github.com/pwndbg/pwndbg
• https://pwndbg.re/