Command hexdump
Imitation of the WinDBG command.
This command takes 4 optional arguments:
- The format for representing the data (by default, byte)
- A value/address/symbol used as the location to print the hexdump from (by default, $sp)
- The number of qword/dword/word/bytes to display (by default, 64 if the format is byte, 16 otherwise)
- The direction of output lines (by default, from low to high addresses)
The command provides WinDBG compatible aliases by default:
hexdump qword
->dq
hexdump dword
->dd
hexdump word
->dw
hexdump byte
->db
hexdump byte
will also try to display the ASCII character values if the byte
is printable (similarly to the hexdump -C
command on Linux).
The syntax is as following:
hexdump [qword|dword|word|byte] [LOCATION] [[L][SIZE]] [REVERSE]
Examples:
- Display 4 QWORD from
$pc
:
gef➤ dq $pc l4
0x7ffff7a5c1c0+0000 │ 0x4855544155415641
0x7ffff7a5c1c0+0008 │ 0x0090ec814853cd89
0x7ffff7a5c1c0+0010 │ 0x377d6f058b480000
0x7ffff7a5c1c0+0018 │ 0x748918247c894800
- Display 32 bytes from a location in the stack:
gef➤ db 0x00007fffffffe5e5 l32
0x00007fffffffe5e5 2f 68 6f 6d 65 2f 68 75 67 73 79 2f 63 6f 64 65 /home/hugsy/code
0x00007fffffffe5f5 2f 67 65 66 2f 74 65 73 74 73 2f 77 69 6e 00 41 /gef/tests/win.A
- Display 8 WORD from
$sp
in reverse order:
gef➤ dw 8 r
0x00007fffffffe0ee│+0x000e 0x0000
0x00007fffffffe0ec│+0x000c 0x7fff
0x00007fffffffe0ea│+0x000a 0xffff
0x00007fffffffe0e8│+0x0008 0xe3f5
0x00007fffffffe0e6│+0x0006 0x0000
0x00007fffffffe0e4│+0x0004 0x0000
0x00007fffffffe0e2│+0x0002 0x0000
0x00007fffffffe0e0│+0x0000 0x0001