Note that gdb may refuse towatch registers before the program running
gdb <file>
gdb -h (lists command line options)
General commands
r (start your program)
b main (set a breakpoint at the entry to function main)
b *0x08048b26 (set a breakpoint at the specified address)
delete 2 (deletes breakpoint 2)
delete (deletes all breakpoints)
ni (like si, but skip over subroutine calls)
ni 2 (like si, but skip over subroutine calls)
c 2 (continue, ignoring this breakpoint 2 times)
finish (run until the current function returns)
p/a $sp (print the stack pointer)
p/a $esp (print the stack pointer)
disas 0x080489b3 0x080489c3 (display the code between the addresses)
layout asm (display the assembly code)
p $eax (print the contents of %eax)
p/x $eax (print the contents of %eax as hex)
p/c $eax (print the contents of %eax as a character)
x/NFU ADDR (print the contents at ADDR in memory:
N = number of units to display
x/a $ebp+8 // print first argument to function as address
x/f $ebp+12 // print second argument to function as float
x/d $eax (contents of *(%eax) as int)
x/f $eax (contents of *(%eax) as float)
x/d *(int*)($ebp)+12 (second arg of prior function as int)
x/d *(*(int*)($ebp))+8 (first arg of second prior function as int)
display $eax (print contents of %eax every time the program stops)
display (print the auto-displayed items)
info program (current status of the program)
info functions (functions in program)
info registers (registers and their contents)
info breakpoints (status of user-settable breakpoints)
------------------------------------------------------------------------
http://dirac.org/linux/gdb/04-Breakpoints_And_Watchpoints.php
loop, first to watch every change to the loop variable, and then to
check a particular value.
0x08048385 <main+17>: movl $0x0,-0x8(%ebp)
0x0804838c <main+24>: jmp 0x8048392 <main+30>
(gdb) b *0x08048385
(gdb) r
(gdb) c
Continuing.
(gdb) c
Continuing.
(gdb) c
Continuing.
(gdb) disable 2
(gdb) watch *((int*)($ebp-0x8)) == 42
Old value = 0
New value = 1
When gdb is watching registers, it will watch those registers in all
code, which may not be what you want.
call (in this code, if you simply try to watch $ebx, then the code for
printf will also trigger the breakpoint):
0x080483c7 <main+71>: movl $0x80484b0,(%esp)
0x080483ce <main+78>: call 0x80482d8 <printf@plt>
Breakpoint 3 at 0x80483d3
(gdb) condition 3 $ebx==42
$1 = 42
Occasionally, your gdb session will look kind of crazy (random text will be everywhere, your will have the same registers displayed multiple times, etc.) -- Fix this by CTRL + L