pwndbg部分命令用法搬运

搬运了官方文档上pwndbg的部分有用的命令，有些英文比较简单没写

pwndbg的命令

堆相关的命令

1. arena
   usage: arena [-h] [addr]
   Prints out the main arena or the arena at the specified by address.打印main arena特定地址的arena
2. arenas
   usage: arenas [-h]
   打印所有的arena
3. bins
   usage: bins [-h] [addr] [tcache_addr]
   Prints out the contents of the tcachebins, fastbins, unsortedbin, smallbins, and largebins from the main_arena or the specified address.打印所有main_arena或者指定地址中的bins信息
4. heap
   usage: heap [-h] [addr]
   Prints out chunks starting from the address specified by addr.打印从addr开始块的信息
5. fastbins
   usage: fastbins [-h] [addr] [verbose]
   Prints out the contents of the fastbins of the main arena or the arena at the specified address.打印main arena或者指定地址的fastbins
6. find_fake_fast
   usage: find_fake_fast [-h] addr size
   Finds candidate fake fast chunks that will overlap with the specified address. Used for fastbin dups and house of spirit.用于house of spirit
7. largebins
   usage: largebins [-h] [addr] [verbose]
   Prints out the contents of the large bin of the main arena or the arena at the specified address.
8. malloc_chunk
   usage: malloc_chunk [-h] [addr] [fake]
   Prints out the malloc_chunk at the specified address.fake选项用于如果这个chunk是一个fake chunk的时候. (default: False)
9. mp
   mp [-h]
   Prints out the mp_ structure from glibc.
10. smallbins
    usage: smallbins [-h] [addr] [verbose]
    Prints out the contents of the small bin of the main arena or the arena at the specified address.
11. tcache
    tcache [-h] [addr]
    Print malloc thread cache info.
12. tcachebins
    usage: tcachebins [-h] [addr] [verbose]
    Prints out the contents of the bins in current thread tcache or in tcache at the specified address.其中的verbose作用是Whether to show more details or not. (default: False)
13. top_chunk
    usage: top_chunk [-h] [addr]
    Prints out the address of the top chunk of the main arena, or of the arena at the specified address.
14. unsortedbin
    usage: unsortedbin [-h] [addr] [verbose]
    Prints out the contents of the unsorted bin of the main arena or the arena at the specified address.其中的verbose是Whether to show more details or not. (default: True)
15. vis_heap_chunks
    usage: vis_heap_chunks [-h] [--naive] [count] [address]
    Visualize heap chunks at the specified address.

• count: Number of chunks to visualize (default: 10)
• address: Start address

觉得有用的几个命令

1. da/ds
   usage: da [-h] address [max]
   Dump a string at the specified address.打印指定地址的字符串
   其中max是Maximum string length (default: 256)

2. dds
   usage: dds [-h] addr
   Dump pointers and symbols at the specified address.

3. bl
   list

4. u
   usage: u [-h] [where] [n]
   Starting at the specified address, disassemble N instructions.从地址where开始反汇编n条指令

5. k
   usage: k [-h]
   Print a backtrace (alias ‘bt’).

6. ln
   usage: ln [-h] [address]
   List the symbols nearest to the provided address.

7. nextjump
   usage: nextjmp [-h]
   Breaks at the next jump instruction.
   还有nextcall nextret nextsyscall nextproginstr用法类似

8. entry
   usage: entry [-h] [args [args ...]]
   Set a breakpoint at the first instruction executed in the target binary.
   其中args是要运行程序名

9. j
   usage: j [-h]
   Synchronize IDA’s cursor with GDB

10. main
    usage: main [-h]
    先start再main到main函数

11. sstart
    从__libc_start_main开始

12. libs
    显示各种模块映射和地址，相当于cat /proc/pid_of_program/maps

13. elfheader
    打印elf文件的段映射

14. got命令
    usage: got [-h] [name_filter]
    不加参数则打印所有函数的got信息，否则打印指定的函数的got信息

15. plt
    打印plt信息

16. gotplt
    打印.got.plt中的信息

17. auxv
    Print information from the Auxiliary ELF Vector.

18. xinfo
    usage: xinfo [-h] [address]
    Shows offsets of the specified address to useful other locations

19. xuntil
    usage: xuntil [-h] target
    Continue execution until an address or function.执行程序，在目标函数或者地址处暂停

20. regs
    usage: regs [-h] [regs [regs ...]]
    Print out all registers and enhance the information.

21. search
    usage: search [-h] [-t {byte,short,word,dword,qword,pointer,string,bytes}] [-1] [-2] [-4] [-8] [-p] [-x] [-s] [-e] [-w] [--save] [--no-save] [-n] value [mapping_name]
    Search memory for byte sequences, strings, pointers, and integer values.在内存中搜索字节串、字符串指针或者整数值

22. hexdump
    usage: hexdump [-h] [address] [count]
    以16进制形式展示指定地址处的内容

23. piebase
    展示pie地址

24. dumpargs
    usage: dumpargs [-h] [-f]
    Prints determined arguments for call instruction.展示函数调用参数

25. distance
    usage: distance [-h] a b
    Print the distance between the two arguments.