0Pricing
Cyber Security Academy · Lesson

Dynamic Analysis with GDB and pwndbg

Set breakpoints, inspect memory, trace syscalls, and automate GDB sessions with pwndbg.

Dynamic Analysis with GDB and pwndbg is a free Cyber Security Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What is Dynamic Analysis?

Dynamic analysis runs a binary and observes its behavior in real-time: memory contents, register values, system calls, network connections. Complements static analysis (Ghidra) by showing actual runtime values and control flow.

GDB Basics

GDB (GNU Debugger) is the standard Linux debugger:

gdb ./vuln              # load binary
gdb -p 1234             # attach to running process
run [args]              # start execution
break main              # set breakpoint at main
continue (c)            # continue execution
next (n)                # step over
step (s)                # step into

pwndbg Enhancement

pwndbg is a GDB plugin that adds exploit-development helpers:

  • Visual stack/register display on each break
  • cyclic pattern generation
  • heap command for heap visualization
  • rop gadget finder
  • checksec binary protections
git clone https://github.com/pwndbg/pwndbg && ./setup.sh

Breakpoints and Watchpoints

Control execution:

# Break at address:
break *0x401234
# Break at function:
break strncpy
# Watch memory address:
watch *0x7ffd1234     # break when value changes
# Conditional break:
break *0x401234 if $rax == 0
# List and delete:
info break
delete 1

Examining Memory and Registers

Inspecting state:

info registers         # show all registers
print $rax             # print register value
x/10xg $rsp            # examine 10 qwords at RSP
x/s 0x402000           # examine as string
x/20i $rip             # disassemble 20 instructions at RIP
pwndbg: telescope $rsp 20  # smart stack display

Stepping Through Code

Navigation commands:

ni (nexti)             # step over (instruction level)
si (stepi)             # step into (instruction level)
finish                 # run until function returns
until 0x401234         # run until address

Scripting GDB

Automate GDB with Python:

# GDB Python script:
gdb ./vuln << EOF
python
for i in range(10):
    gdb.execute("continue")
    gdb.execute("x/4xg $rsp")
end
EOF

Analyzing Heap with pwndbg

Heap inspection commands in pwndbg:

heap                   # show all heap chunks
heap -a                # show all allocations
bin                    # show free list bins
tcachebins             # show tcache entries
vis_heap_chunks        # visual heap map

Tracing System Calls

Use strace to trace system calls without full debugging:

strace ./vuln          # trace all syscalls
strace -e trace=open,read,write ./vuln  # filter syscalls
strace -f ./vuln       # follow forks
# ltrace for library calls:
ltrace ./vuln

Setting Up a Debug Environment

Important setup for exploit development:

# Disable ASLR for testing:
echo 0 | sudo tee /proc/sys/kernel/randomize_va_space
# Or per-process:
setarch $(uname -m) -R gdb ./vuln
# Verify with:
ldd ./vuln  # check libc base

Debugging Stripped Binaries

Many production binaries have debug symbols stripped. Techniques:

  • Use file and readelf to understand binary
  • Set breakpoints at addresses not symbols
  • Use function signatures to identify common library calls
  • Load libc symbols separately if available

Quick Check: GDB

Which command in GDB sets a breakpoint that only triggers when a specific condition is met?

Lesson Recap

GDB with pwndbg enables dynamic analysis: set breakpoints, examine registers and memory, trace execution. Key commands: break, run, ni/si, x/format, info registers. pwndbg adds heap visualization, stack telescoping, and pattern tools. strace/ltrace trace syscalls and library calls without full debugging setup.

Frequently asked questions

Is the “Dynamic Analysis with GDB and pwndbg” lesson free?

Yes — the full text of “Dynamic Analysis with GDB and pwndbg” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Dynamic Analysis with GDB and pwndbg”?

Set breakpoints, inspect memory, trace syscalls, and automate GDB sessions with pwndbg. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Dynamic Analysis with GDB and pwndbg” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Ghidra: Navigating and Annotating Binaries
  2. x86/x64 Assembly Essentials for Reversers
  3. Dynamic Analysis with GDB and pwndbg
  4. Deobfuscation and Anti-Analysis Tricks
← Back to Cyber Security Academy