Exploit › Module 6 › Lesson 2
GDB Observe
GDB observe literacy on $PWN_LAB crash — backtrace and info registers to see state, not to build exploit chains.
Visual · t24_gdb_observe
GDB observe = bt and registers at crash. $PWN_LAB. Original Cyberlium.
Opening
When your toy segfaults, GDB tells you where — not how to pop a shell.
After reproducing a crash on YOUR $PWN_LAB toy, attach GDB at failure: run until crash, then backtrace (bt), info registers, and optionally x/ examine memory near faulting address — literacy to correlate source line with fault, not to craft ROP or shellcode. Commands: run, bt, info registers, frame, list, disassemble /m near PC/RIP. Cyberlium teaches observation on toys YOU compiled — NOT GDB on production services, NOT using crash state to write weaponized pwntools scripts, NOT publishing exploit recipes from register dumps. Pair with Module 5 checksec: note NX/PIE/canary presence when reading crash — defender context. chmod 600 session log.
1. Observe-at-crash workflow
gdb./your_toy → run with bad input → on SIGSEGV: bt full, info registers, note RIP/EIP and SP.
Map frame #0 to source if symbols exist; for stripped toys use objdump address from Module 3 literacy.
Command guide
Try these commands — Observe-at-crash workflow
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
GDB backtrace — https://sourceware.org/gdb/current/onlinedocs/gdb.html/Backtrace.html GDB batch — https://sourceware.org/gdb/current/onlinedocs/gdb.html/Batch-Mode.html pwn.college — https://pwn.college/ (debugger literacy on authorized targets)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install gdb
macOS:
Command — copy this
brew install gdb
Windows: Use WSL gdb
═══ LINUX / macOS ═══
Optional command
sudo apt install gdb # gdb
Command — copy this
export LAB_PWN=${LAB_PWN:-$HOME/cyberlium-lab/t24-pwn}observe crash; do NOT develop exploit
Command — copy this
gdb -q -batch \ -ex 'run' \ -ex 'bt' \ -ex quit \ "$LAB_PWN/bin/build_vuln" <<< "$(printf '%80s' | tr ' ' 'A')" 2>&1 | tail -20 echo 'gdb observe: backtrace shows crash site — stop at triage, no ROP/gadget work'
Primary tools to practice this lesson: gdb. Reference sites: GDB backtrace (https://sourceware.org/gdb/current/onlinedocs/gdb.html/Backtrace.html); GDB batch (https://sourceware.org/gdb/current/onlinedocs/gdb.html/Batch-Mode.html); pwn.college (https://pwn.college/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Reading without weaponizing
Document: fault address, register snapshot, one-line 'corruption likely at read/write X' — stop before payload design.
If canary tripped, log abort message — defender lesson: canary caught overflow attempt on toy.
3. Scope refuse
Refused: ROP chain planning, shellcode assembly, pwntools exploit template, attach to stranger process.
GDB here answers 'what broke' on YOUR toy — not 'how to own remote host.'
4. What you ship: GDB observe card
Six observe commands + register snapshot template + refuse weaponize line.
5. What you record before the next lesson
GDB observe card path.
6. Wrong vs right: weaponized exploits vs memory-safety literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Use GDB register dump to write ROP chain against remote CTF prod host without rules.
Right
GDB observe card from YOUR $PWN_LAB crash. Next: Triage Not Weaponize.
Mission: GDB observe card
1) List six GDB observe commands. 2) Write crash-session workflow. 3) Paste redacted bt/registers from YOUR toy. 4) Write refuse ROP/shellcode line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “bt vs bt full on stripped toy?”
Knowledge Check
APPLY: GDB observe on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: This lesson ships pwntools exploit templates.
True or False
Knowledge Check
APPLY: After segfault you should capture:
Multiple choice