{
  "added_at": "2026-10-19",
  "additional_evidence_urls": [
    "https://github.com/hugsy/gef/blob/49c07dc60624f264d40b5c6ea39b2bf3a4e9958f/gef.py#L8-L28",
    "https://github.com/hugsy/gef/blob/49c07dc60624f264d40b5c6ea39b2bf3a4e9958f/gef.py#L130-L131",
    "https://github.com/hugsy/gef/blob/49c07dc60624f264d40b5c6ea39b2bf3a4e9958f/docs/install.md",
    "https://github.com/hugsy/gef/blob/49c07dc60624f264d40b5c6ea39b2bf3a4e9958f/docs/compat.md",
    "https://github.com/hugsy/gef/blob/49c07dc60624f264d40b5c6ea39b2bf3a4e9958f/docs/commands/gef-remote.md",
    "https://github.com/hugsy/gef/blob/49c07dc60624f264d40b5c6ea39b2bf3a4e9958f/docs/commands/heap.md",
    "https://github.com/hugsy/gef/blob/49c07dc60624f264d40b5c6ea39b2bf3a4e9958f/docs/index.md#L83-L85",
    "https://github.com/hugsy/gef/blob/49c07dc60624f264d40b5c6ea39b2bf3a4e9958f/docs/testing.md",
    "https://github.com/hugsy/gef/blob/49c07dc60624f264d40b5c6ea39b2bf3a4e9958f/LICENSE",
    "https://github.com/hugsy/gef/releases/tag/2026.01"
  ],
  "category": "dynamic-analysis",
  "description_en": "Single-file Python extension, gef.py, that adds dynamic-analysis commands to GDB. Each stop shows a context view of registers, stack, code, threads and call trace, and commands cover memory maps, pointer dereferencing, searching process memory for patterns, ELF and security-property information, process status and glibc heap inspection. An architecture abstraction layer covers x86-32/64, ARMv5–v7, AArch64, SPARC, MIPS and PowerPC, and gef-remote enriches remote sessions through gdbserver or the GDB stubs of qemu-user and qemu-system.",
  "description_zh": "单文件 Python 扩展 gef.py，为 GDB 增加动态分析命令。每次程序停下时都会显示寄存器、栈、代码、线程和调用轨迹等上下文视图，命令涵盖内存映射、指针解引用、在进程内存中搜索模式、ELF 与安全属性信息、进程状态以及 glibc 堆检查。其架构抽象层覆盖 x86-32/64、ARMv5–v7、AArch64、SPARC、MIPS 和 PowerPC；gef-remote 命令可通过 gdbserver 或 qemu-user、qemu-system 的 GDB stub 增强远程调试会话。",
  "entry_url": "https://awesomerea.org/resources/gef/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/gef/",
  "evidence_url": "https://github.com/hugsy/gef/blob/49c07dc60624f264d40b5c6ea39b2bf3a4e9958f/README.md",
  "group": "tools",
  "id": "gef",
  "json_url": "https://awesomerea.org/resources/gef/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/gef/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/gef/index.md",
  "name": "GEF (GDB Enhanced Features)",
  "name_zh": "GEF GDB 增强扩展",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Needs GDB 10.0+ built with Python 3.10+, the baseline since GEF 2025.01 in the compatibility table, plus file, readelf, nm, ps and python3 on the host; Python 2 users are pointed to the separate gef-legacy. The README installs it by downloading gef.py, through an install script or manually, and sourcing it from the user's .gdbinit file.",
    "Release at review: 2026.01, published 2026-02-02 without binary assets; the reviewed main commit is 12 commits ahead, adding glibc 2.42/2.43 heap support and removing unmaintained commands. More commands live in the separate GEF-Extras repository.",
    "GEF relies on the GDB API and Linux-specific sources such as /proc/<pid>, so some features may not work on custom or hardened systems, and heap commands support only the glibc allocator. qemu mode needs a local copy of the debugged binary because QEMU's GDB stub cannot transfer files. The README aims it at exploit developers and reverse engineers.",
    "MIT license. Tests run with pytest under the Python version GDB was built against."
  ],
  "requirements_zh": [
    "需要以 Python 3.10+ 构建的 GDB 10.0+（兼容性表显示自 GEF 2025.01 起即为此基线），宿主机上还需有 file、readelf、nm、ps 和 python3；仍需 Python 2 的用户请改用独立的 gef-legacy。README 介绍的安装方式是通过安装脚本或手动下载 gef.py，并在用户的 .gdbinit 文件中加载它。",
    "审阅时的版本为 2026.01，发布于 2026-02-02，不含二进制资源；所审阅的 main 分支提交比该版本多 12 个提交，增加了对 glibc 2.42/2.43 堆的支持并移除了无人维护的命令。更多命令位于独立的 GEF-Extras 仓库。",
    "GEF 依赖 GDB API 以及 /proc/<pid> 等 Linux 特有的信息来源，因此部分功能在定制或加固的系统上可能无法使用，堆命令也只支持 glibc 分配器。qemu 模式需要本地保存一份被调试的二进制，因为 QEMU 的 GDB stub 无法传输文件。README 将其定位为面向漏洞利用开发者和逆向工程人员的工具。",
    "采用 MIT 许可。测试使用 pytest，并须在 GDB 编译时所用的 Python 版本下运行。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/hugsy/gef",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}