# GEF (GDB Enhanced Features)

> Single-file Python extension, gef.py, that adds dynamic-analysis commands to GDB. Each stop shows a context view of registers, stack, code, threads and call trace, and commands cover memory maps, pointer dereferencing, searching process memory for patterns, ELF and security-property information, process status and glibc heap inspection. An architecture abstraction layer covers x86-32/64, ARMv5–v7, AArch64, SPARC, MIPS and PowerPC, and gef-remote enriches remote sessions through gdbserver or the GDB stubs of qemu-user and qemu-system.

- Type: Tool
- Targets: Binary
- Category: Debugging and dynamic analysis
- Relationship: Foundation tool
- Sources reviewed: 2026-10-19
- Added to the catalog: 2026-10-19
- Original resource: <https://github.com/hugsy/gef>
- Primary source: <https://github.com/hugsy/gef/blob/49c07dc60624f264d40b5c6ea39b2bf3a4e9958f/README.md>
- Catalog page: <https://awesomerea.org/resources/gef/>
- Record JSON: <https://awesomerea.org/resources/gef/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/gef/index.md)

## Requirements & limits

- Needs GDB 10.0+ built with Python 3.10+, the baseline since GEF 2025.01 in the compatibility table, plus file, readelf, nm, ps and python3 on the host; Python 2 users are pointed to the separate gef-legacy. The README installs it by downloading gef.py, through an install script or manually, and sourcing it from the user's .gdbinit file.
- Release at review: 2026.01, published 2026-02-02 without binary assets; the reviewed main commit is 12 commits ahead, adding glibc 2.42/2.43 heap support and removing unmaintained commands. More commands live in the separate GEF-Extras repository.
- GEF relies on the GDB API and Linux-specific sources such as /proc/<pid>, so some features may not work on custom or hardened systems, and heap commands support only the glibc allocator. qemu mode needs a local copy of the debugged binary because QEMU's GDB stub cannot transfer files. The README aims it at exploit developers and reverse engineers.
- MIT license. Tests run with pytest under the Python version GDB was built against.

## Primary sources

1. <https://github.com/hugsy/gef/blob/49c07dc60624f264d40b5c6ea39b2bf3a4e9958f/README.md>
2. <https://github.com/hugsy/gef/blob/49c07dc60624f264d40b5c6ea39b2bf3a4e9958f/gef.py#L8-L28>
3. <https://github.com/hugsy/gef/blob/49c07dc60624f264d40b5c6ea39b2bf3a4e9958f/gef.py#L130-L131>
4. <https://github.com/hugsy/gef/blob/49c07dc60624f264d40b5c6ea39b2bf3a4e9958f/docs/install.md>
5. <https://github.com/hugsy/gef/blob/49c07dc60624f264d40b5c6ea39b2bf3a4e9958f/docs/compat.md>
6. <https://github.com/hugsy/gef/blob/49c07dc60624f264d40b5c6ea39b2bf3a4e9958f/docs/commands/gef-remote.md>
7. <https://github.com/hugsy/gef/blob/49c07dc60624f264d40b5c6ea39b2bf3a4e9958f/docs/commands/heap.md>
8. <https://github.com/hugsy/gef/blob/49c07dc60624f264d40b5c6ea39b2bf3a4e9958f/docs/index.md#L83-L85>
9. <https://github.com/hugsy/gef/blob/49c07dc60624f264d40b5c6ea39b2bf3a4e9958f/docs/testing.md>
10. <https://github.com/hugsy/gef/blob/49c07dc60624f264d40b5c6ea39b2bf3a4e9958f/LICENSE>
11. <https://github.com/hugsy/gef/releases/tag/2026.01>

## More in Native binaries

- [Triton](https://awesomerea.org/resources/triton/index.md) · Tool
- [PyLingual](https://awesomerea.org/resources/pylingual/index.md) · Tool
- [Miasm](https://awesomerea.org/resources/miasm/index.md) · Tool
- [HyperDbg](https://awesomerea.org/resources/hyperdbg/index.md) · Tool
- [Kuna](https://awesomerea.org/resources/kuna/index.md) · Tool
- [Binary Ninja API](https://awesomerea.org/resources/binary-ninja-api/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.