AwesomeREA.org

Tool

GEF (GDB Enhanced Features)

Single-file Python extension, gef.py, that adds dynamic-analysis commands to GDB. Each stop shows a context view of registers, stack, code, threads and call trace, and commands cover memory maps, pointer dereferencing, searching process memory for patterns, ELF and security-property information, process status and glibc heap inspection. An architecture abstraction layer covers x86-32/64, ARMv5–v7, AArch64, SPARC, MIPS and PowerPC, and gef-remote enriches remote sessions through gdbserver or the GDB stubs of qemu-user and qemu-system.

Requirements and limitations

  • Needs GDB 10.0+ built with Python 3.10+, the baseline since GEF 2025.01 in the compatibility table, plus file, readelf, nm, ps and python3 on the host; Python 2 users are pointed to the separate gef-legacy. The README installs it by downloading gef.py, through an install script or manually, and sourcing it from the user's .gdbinit file.
  • Release at review: 2026.01, published 2026-02-02 without binary assets; the reviewed main commit is 12 commits ahead, adding glibc 2.42/2.43 heap support and removing unmaintained commands. More commands live in the separate GEF-Extras repository, which was not reviewed.
  • GEF relies on the GDB API and Linux-specific sources such as /proc/<pid>, so some features may not work on custom or hardened systems, and heap commands support only the glibc allocator. qemu mode needs a local copy of the debugged binary because QEMU's GDB stub cannot transfer files. The README aims it at exploit developers and reverse engineers; this entry covers its debugging and inspection use.
  • MIT license. Tests run with pytest under the Python version GDB was built against. No debugging sessions were run.

About this entry

Type
Tool
Category
Debugging and dynamic analysis
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · hugsy/gef · Revision 49c07dc
  2. gef.py#L8-L28 GitHub · hugsy/gef · Revision 49c07dc
  3. gef.py#L130-L131 GitHub · hugsy/gef · Revision 49c07dc
  4. docs/install.md GitHub · hugsy/gef · Revision 49c07dc
  5. docs/compat.md GitHub · hugsy/gef · Revision 49c07dc
  6. docs/commands/gef-remote.md GitHub · hugsy/gef · Revision 49c07dc
  7. docs/commands/heap.md GitHub · hugsy/gef · Revision 49c07dc
  8. docs/index.md#L83-L85 GitHub · hugsy/gef · Revision 49c07dc
  9. docs/testing.md GitHub · hugsy/gef · Revision 49c07dc
  10. LICENSE GitHub · hugsy/gef · Revision 49c07dc
  11. https://github.com/hugsy/gef/releases/tag/2026.01