Reverse › Module 6 › Lesson 1
GDB Literacy
GDB literacy on $RE_LAB toy binaries — attach, run, step, examine memory and registers; never attach to stranger processes or crack commercial software.
Visual · t23_gdb_literacy
GDB = dynamic RE debugger literacy. $RE_LAB toys only. Original Cyberlium.
Opening
GDB lets you ask a running binary what it decided — learn the commands on crackmes you own, not on licensed apps you do not.
GNU Debugger (GDB) is the foundational dynamic RE tool on Linux-class $RE_LAB systems: load YOUR crackme or CTF binary, set breakpoints, single-step instructions, inspect registers and stack frames, and read memory at addresses you traced from static analysis. Analyst literacy covers run/start, break, continue, next/stepi, info registers, x/ examine memory, backtrace, and disassemble — enough to correlate Ghidra pseudocode with live execution. Cyberlium teaches GDB on $RE_LAB crackmes, CTF challenges, and binaries YOU authored — NOT attaching to Spotify, Adobe, or game clients for piracy, NOT debugging production services without authorization, NOT bypassing license checks on software you did not write. Validation = reproduce one branch decision in YOUR toy binary with register evidence — stop if target is not in-scope.
1. Core GDB workflow
gdb./your_crackme → break main or break *0xaddress → run → stepi/next through compare branch.
info registers after strcmp-style call; x/s for string at pointer — tie to static disassembly from Module 5.
Command guide
Try these commands — Core GDB workflow
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
GDB manual — https://sourceware.org/gdb/current/onlinedocs/gdb.html/ (batch and interactive) GDB disassemble — https://sourceware.org/gdb/current/onlinedocs/gdb.html/Machine-Code.html LiveOverflow — https://www.youtube.com/c/LiveOverflow (dynamic RE literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install gdb sudo apt install binutils
macOS:
Command — copy this
brew install gdb
Built-in (Xcode CLI) or brew install binutils
Windows: Use WSL gdb Use WSL binutils
═══ LINUX / macOS ═══
Optional command
sudo apt install gdb binutils # gdb objdump
Command — copy this
export LAB_RE=${LAB_RE:-$HOME/cyberlium-lab/t23-re}
gdb -q -batch -ex 'disassemble main' -ex quit "$LAB_RE/bin/hello"
objdump -d "$LAB_RE/bin/hello" | grep -A8 '<main>:' | head -10Primary tools to practice this lesson: gdb, objdump. Reference sites: GDB manual (https://sourceware.org/gdb/current/onlinedocs/gdb.html/); GDB disassemble (https://sourceware.org/gdb/current/onlinedocs/gdb.html/Machine-Code.html); LiveOverflow (https://www.youtube.com/c/LiveOverflow). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Reading execution
disassemble /m shows mixed source/asm when symbols exist; backtrace after crash maps stack on YOUR toy.
Note RIP/EIP, RSP/RBP, and argument registers per calling convention from Module 3 — literacy not exploit chains yet.
3. $RE_LAB boundary
Targets: instructor crackmes, CTF pwn/reversing bins, YOUR compiled lab toys with documented hash.
Refused: commercial DRM binaries, employer prod without scope, random downloads without provenance.
4. What you ship: GDB literacy card
Eight essential commands + one register-read example + $RE_LAB-only target line.
5. What you record before the next lesson
GDB literacy card path.
6. Wrong vs right: commercial piracy vs crackmes/CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Attach GDB to licensed game binary to patch license check for personal use.
Right
GDB literacy card on $RE_LAB crackme. Next: Breakpoints.
Mission: GDB literacy card
1) List eight GDB commands with one-line purpose. 2) Write attach-to-./your_crackme workflow. 3) Document one register check after compare. 4) Write NEVER commercial piracy line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “break vs break * — when for stripped crackme?”
Knowledge Check
APPLY: GDB literacy on Cyberlium uses:
Multiple choice
Knowledge Check
APPLY: True or False: Attach GDB to crack Spotify license is in-scope lab.
True or False
Knowledge Check
APPLY: After a compare branch you should inspect:
Multiple choice