Save a named bookmark pointing to an address for quick navigation. Equivalent to EDB's Bookmarks plugin. Useful for marking key locations during reverse engineering.

Args: params (BookmarkInput): Bookmark - name (str): Name (e.g., 'main_loop') - address (str): Address (e.g., '0x400000')

Returns: str: Confirmation

Add a text annotation to an address. Comments are stored in-memory and can be listed with edb_list_comments. Useful for documenting analysis findings during a reverse engineering session.

Args: params (CommentInput): Comment data - address (str): Address in hex (e.g., '0x400000') - comment (str): Annotation text

Returns: str: Confirmation

Analyze a code region and identify basic blocks. Equivalent to EDB's Analyzer plugin basic block detection. Shows each basic block with its instructions, where blocks end at branch/jump/call/ret instructions.

Args: params (AnalyzeBasicBlocksInput): Region - address (str): Start address - size (int): Region size (default: 256)

Returns: str: Basic block listing with instruction count per block

Disassemble at an address and identify call/jump targets. Shows each instruction and resolves targets for call, jmp, jz, jnz. Essential for control flow analysis and understanding branch targets.

Args: params (AnalyzeCallsInput): Address - address (str): Address to analyze

Returns: str: Instructions with resolved call/jump targets

Analyze the heap memory region of the debugged process. Equivalent to EDB's HeapAnalyzer plugin. Shows heap regions, sizes, permissions, and strings found in heap memory.

Returns: str: Heap analysis including regions, sizes, and strings

Analyze a code region for call instructions, branch instructions, and strings. Equivalent to EDB's Analyzer plugin. Shows control flow information for the given address range.

Args: params (AnalyzeRegionInput): Region parameters - address (str): Start address - size (int): Region size in bytes (default: 256)

Returns: str: Analysis with call/branch/instruction counts

Write runtime memory modifications back to the binary file on disk.

Assemble an assembly instruction and write it to memory. Equivalent to EDB's Assembler plugin. Uses keystone engine if available, otherwise falls back to common opcodes (nop, int3, ret).

Args: params (AssembleInput): Assembly parameters - address (str): Target address - instruction (str): Assembly text (e.g., 'nop', 'mov eax, 0', 'jmp rax')

Returns: str: Assembled bytes and confirmation

Attach the debugger to an already-running process by PID. The process is paused on attach.

Args: params (AttachPid): Process ID - pid (int): Process ID to attach to

Returns: str: Status message confirming attachment

Compare the current loaded binary with its original on disk.

Convert between hex, ASCII, and UTF-16 representations. Equivalent to EDB's BinaryString widget (DialogInputBinaryString). Useful for preparing data for memory patches or analyzing strings.

Provide at least one of: hex_str, ascii_str, or utf16_str.

Args: params (BinaryStringConvertInput): Input string - hex_str (str): Hex input (e.g., '48656c6c6f') - ascii_str (str): ASCII input (e.g., 'Hello') - utf16_str (str): UTF-16 hex (e.g., '48006500')

Returns: str: All representations

Set commands to execute when a breakpoint is hit. Equivalent to GDB's commands keyword. Can run any GDB command including print, continue, set, etc. Useful for logging data without stopping.

Args: params (BreakpointCommandsInput): Commands - number (int): Breakpoint number - commands (list[str]): Commands (e.g., ['print rax', 'continue'])

Returns: str: Confirmation

Export all breakpoints to a JSON file on disk. Equivalent to EDB's BreakpointManager export feature. Breakpoints can be reloaded later with edb_breakpoint_import.

Args: params (BreakpointFileInput): Output - file_path (str): Full path to JSON file

Returns: str: Export confirmation with count

Import breakpoints from a JSON file previously exported with edb_breakpoint_export. Equivalent to EDB's BreakpointManager import feature.

Args: params (BreakpointFileInput): Input - file_path (str): Full path to JSON file

Returns: str: Import confirmation with count

Call a function in the context of the debugged process. Equivalent to GDB's call command. Useful for testing functions with specific arguments or calling library functions.

Args: params (CallFunctionInput): Function call - function_expr (str): Expression (e.g., 'printf("hello")', 'malloc(100)')

Returns: str: Function result (return value in EAX/RAX)

Compare two memory regions byte-by-byte and show differences. Useful for detecting self-modifying code, comparing loaded vs original code, or analyzing binary patches.

Args: params (CompareMemoryInput): Comparison parameters - address1 (str): First address (e.g., '0x400000') - address2 (str): Second address (e.g., '0x400100') - count (int): Number of bytes to compare (max: 4096)

Returns: str: Differing regions with hex values

Compare loaded memory sections with the original binary on disk. Detects modifications to code sections (self-modifying code, patches). Equivalent to EDB's memory comparison features.

Returns: str: Section comparison results

Save a full debugger snapshot (registers + memory) for later comparison.

Configure GDB debugger settings. Equivalent to EDB's Configure Debugger dialog. Controls follow-fork-mode, ASLR, scheduler-locking, backtrace limits, and many other debugger behaviors.

Args: params (DebuggerConfigInput): Setting - setting (str): Setting name (e.g., 'follow-fork-mode', 'disable-randomization', 'scheduler-locking', 'backtrace limit', 'print elements') - value (str): Value to set (empty to query, use 'on'/'off' for booleans)

Returns: str: Configuration result

Continue execution after a breakpoint or pause. Resumes from the current instruction pointer.

Returns: str: Status with stop reason if another breakpoint is hit

Continue execution until a specific address is reached. Sets a temporary breakpoint at the given address and runs.

Args: params (ContinueToAddress): Target - address (str): Address in hex (e.g., '0x4000a0') or function name

Returns: str: Location details when stopped

Detach from the debugged process. The process continues running independently.

Returns: str: Confirmation of detachment

Disable or enable ASLR for debugee. Equivalent to EDB's DialogOptions → Disable ASLR checkbox. Affects future runs of the debugged program.

Args: params (DisableASLRInput): ASLR setting - disable (bool): True = disable ASLR, False = enable

Returns: str: Confirmation

Disable a breakpoint without removing it. It can be re-enabled later.

Args: params (BreakpointNumber): Breakpoint number - number (int): Breakpoint ID to disable

Returns: str: Confirmation

Disable or enable lazy binding for debugee. Equivalent to EDB's DialogOptions → Disable Lazy Binding checkbox. When disabled, all shared library symbols are resolved at startup, making breakpoints on library functions more reliable.

Args: params (DisableLazyBindingInput): Lazy binding setting - disable (bool): True = disable lazy binding, False = enable

Returns: str: Confirmation

Disassemble machine code at an address or function. Shows assembly instructions with addresses, offsets, and opcodes.

Args: params (DisassembleInput): Disassembly params - location (str): Address (e.g., '0x400000') or function (e.g., 'main') - count (int): Instructions to show, 1-200 (default: 10)

Returns: str: Formatted disassembly listing

Disassemble a range of memory from start to end address. Unlike edb_disassemble which uses a count of instructions, this tool disassembles an exact address range. Useful for full function analysis.

Args: params (DisassembleRangeInput): Range - start_address (str): Start address (e.g., '0x400000') - end_address (str): End address (e.g., '0x400100')

Returns: str: Disassembly listing

Dump a memory region to a binary file on disk. Equivalent to EDB's memory dump feature. Useful for extracting code regions, data sections, or heap contents for offline analysis.

Args: params (DumpMemoryToFileInput): Dump parameters - address (str): Start address - size (int): Number of bytes to dump (max: 1MB) - file_path (str): Full output file path

Returns: str: Confirmation with byte count

Get a human-readable register dump in markdown table format. Shows all general-purpose registers, instruction pointer, flags and their meanings.

Returns: str: Markdown-formatted register table

Dump complete debugger state: all registers, current instruction, stack, backtrace, memory map, and status. Equivalent to EDB's DumpState plugin. One-shot comprehensive process snapshot.

Returns: str: Full process state dump

Re-activate a disabled breakpoint.

Args: params (BreakpointNumber): Breakpoint number - number (int): Breakpoint ID to enable

Returns: str: Confirmation

List available CPU registers by category (GPR, SIMD, FPU, flag).

Evaluate a C expression in the debug context. Supports variables, pointer dereferences, casts, arithmetic, and function calls. Examples: 'x + 5', '(int)0x7fff0000', 'argv[0]'

Args: params (EvaluateExpr): Expression - expression (str): C expression to evaluate

Returns: str: Expression result

Execute any raw GDB command directly. Full access to GDB's CLI. Powerful for advanced debugging.

Generate a buffer-overflow exploit payload: offset + ROP chain + shellcode. Supports amd64 (ret2libc ROP), i386 (ret2libc), and aarch64 (shellcode).

Export the complete debugger state as structured JSON.

Convert a file offset from the binary on disk to the corresponding virtual address in the loaded process. Essential for patching binaries and understanding disk-to-memory mapping.

Args: params (FileOffsetInput): File offset - offset (int): Offset in bytes from start of file

Returns: str: Virtual address in hex

Fill a memory region with a repeating byte value. Useful for zeroing buffers, filling with NOPs (0x90), or any pattern. Uses edb_write_memory_bytes internally.

Args: params (FillMemoryInput): Fill parameters - address (str): Start address (e.g., '0x400000') - byte_value (str): Byte value (e.g., '0x90' or '90') - count (int): Number of bytes to fill

Returns: str: Confirmation of fill operation

Find all code references to a given address or symbol. Searches functions and variables referencing the address.

Args: params (FindReferencesInput): Target address - address (str): Address to find references to

Returns: str: Reference locations

Search for ROP gadgets (instructions ending with 'ret') in memory. Equivalent to EDB's ROPTool plugin. Finds usable instruction sequences for ROP chain construction.

Args: params (RopSearchInput): Search parameters - address (str): Start address (default: $pc) - depth (int): Max instructions before ret, 1-10 (default: 2) - count (int): Max results, 1-1000 (default: 100)

Returns: str: ROP gadget addresses and bytes

Find printable ASCII strings in the current code region. Searches from current PC for printable character sequences.

Returns: str: Found strings with addresses

Set whether the debugger follows the parent or child process after a fork.

Generate a Control Flow Graph in Graphviz DOT format. Equivalent to EDB's GraphWidget (which uses Graphviz). The output DOT can be rendered with dot -Tpng -o output.png or viewed in any Graphviz viewer. Shows edges between basic blocks.

Args: params (AnalyzeBasicBlocksInput): Region - address (str): Start address - size (int): Region size (default: 256)

Returns: str: DOT format CFG

Generate a core dump of the current process for post-mortem analysis. Equivalent to EDB's save state feature. Saves full process memory and register state to a core file.

Args: params (CoreDumpInput): Output - file_path (str): Output file path (default: core)

Returns: str: Core dump confirmation with file size

Generate a symbol map for a binary file using EDB's symbol generator. Equivalent to running edb --symbols <file>. Useful for creating symbol map files for stripped binaries.

Args: params (GenerateSymbolsInput): Input - path (str): Binary file path (default: loaded binary)

Returns: str: Symbol map

Get architecture information about the debugged process and binary. Equivalent to EDB's BinaryInfo plugin. Shows CPU architecture, binary type (PIE/non-PIE), instruction set features, and more.

Returns: str: Architecture details

Get the arguments passed to the current function. Shows argument names and values.

Returns: str: Function argument names and values

Get the full call stack backtrace. Frame #0 is the current function. Each frame shows number, address, function name, and source location.

Returns: str: Formatted backtrace

Get detailed information about the loaded binary file. Shows ELF header, architecture, entry point, section layout, and more. Equivalent to EDB's BinaryInfo plugin.

Returns: str: Binary file metadata

Get all register values (shows current state, EDB-style). Equivalent to EDB's register view with highlighted changed values. Shows all CPU registers with current values.

Returns: str: Register dump

Get the instruction at the current program counter (RIP/EIP). Shows what will execute next.

Returns: str: Current instruction text

Get info about the currently active thread.

Returns: str: Current thread information

Show the EFLAGS/RFLAGS CPU status register with individual flag states.

Get the program entry point address. The entry point is the first code executed when the program starts (typically _start).

Returns: str: Entry point address in hex

Show all environment variables configured for the debugged process. Equivalent to EDB's process properties environment view.

Returns: str: Environment variables

Get the FPU (Floating Point Unit) register state. Equivalent to EDB's RegisterViewModel FPU category. Shows ST0-ST7 stack registers, FPU control word, status word, and tag word.

Returns: str: FPU register values

Get detailed information about a stack frame: address, function, arguments, locals, frame type, and more. Equivalent to EDB's call stack panel showing frame details.

Args: params (FrameInfoInput): Frame - frame_level (int): Frame level (0 = innermost, default: 0)

Returns: str: Frame information with args and locals

Get the start address, end address, and size of a function. Useful for understanding function layout and selecting regions for patching.

Args: params (FunctionBoundsInput): Function name - name (str): Function name (e.g., 'main')

Returns: str: Start address, end address, and size

Get detailed info about a function: address, prototype, source location.

Args: params (FunctionInfo): Function name - name (str): E.g., 'main', 'malloc'

Returns: str: Function details

Show cross-references to a given address or function.

Get all local variables in the current function scope. Shows names and values.

Returns: str: Local variable names and values

Get the process memory map (like /proc/pid/maps). Shows address ranges, permissions, offset, and paths for all mapped regions.

Returns: str: Memory map listing

Get information about defined memory regions and their permissions. Equivalent to EDB's DialogMemoryRegions detail view. Shows regions defined with edb_set_memory_permissions and their access attributes.

Returns: str: Memory region permissions

Get comprehensive properties of the debugged process. Equivalent to EDB's ProcessProperties plugin. Shows PID, binary path, arguments, entry point, register state, and more.

Returns: str: Process properties

Get the value of a specific CPU register.

Args: params (RegisterName): Register name - name (str): E.g., 'rax', 'rbx', 'rip', 'rsp', 'eflags'

Returns: str: Hex value of the register

Get all CPU register values as JSON. Includes general-purpose registers, instruction pointer, stack pointer, base pointer, flags, and SIMD registers.

Returns: str: JSON object with register names and hex values

Get detailed section information for loaded modules. Shows section names, addresses, sizes, and file offsets.

Args: params (SectionInfoInput): Module filter - module (Optional[str]): Module name (empty = all)

Returns: str: Section information

Get the SIMD (SSE/AVX) register state. Equivalent to EDB's RegisterViewModel SIMD category. Shows XMM0-15, YMM0-15, ZMM0-31 registers and MXCSR control/status register.

Returns: str: SIMD register values

Dump the current stack (stack pointer to higher addresses). Each entry is an 8-byte (64-bit) value.

Returns: str: Stack hex dump

Get detailed information about a specific stack frame level. Shows address, function, file, line for the given frame.

Args: params (StackFrameInput): Frame level - frame_level (int): Frame number, 0 = current (default: 0)

Returns: str: JSON frame information

Get the current debugger and process status. Shows whether a process is loaded, running or paused, PID, RIP, current instruction, register count.

Returns: str: JSON status object

Determine why the process stopped (breakpoint, signal, step, etc.). Equivalent to EDB's status bar showing stop reason. Checks GDB's program state and thread status.

Returns: str: Stop reason description

Read a null-terminated string from a memory address. Interprets the memory as a C string (null-terminated).

Args: params (ReadStringInput): String parameters - address (str): Address (e.g., '0x400678') - max_length (int): Max string length, 1-4096 (default: 256)

Returns: str: String contents

Read the value of a local or global variable in the current scope.

Args: params (VariableInput): Variable name - name (str): Variable name (e.g., 'i', 'argc', 'buffer')

Returns: str: Variable value

Find the function start address containing a given address.

Get information about all inferiors (processes) being debugged. Equivalent to GDB's info inferiors command. Shows process list, their PIDs, and the program they're running.

Returns: str: Inferior list with details

Get detailed information about an instruction at a given address. Equivalent to EDB's InstructionInspector plugin. Shows instruction bytes, assembly, addressing modes, register operands, and more.

Args: params (InstructionDetailInput): Address - address (str): Address to inspect (default: $pc)

Returns: str: Detailed instruction info including bytes, opcode, operands

Jump to a specific address, setting the instruction pointer. Equivalent to EDB's jump_to_address (double-click address in BreakpointManager). Use this to skip code or continue from a specific location.

Args: params (JumpAddressInput): Target - address (str): Address to jump to (e.g., '0x400000', 'main+5')

Returns: str: Jump confirmation

Kill the debugged process immediately. Equivalent to force-terminating the debuggee.

Returns: str: Confirmation the process was killed

Set a label/annotation at an address in the disassembly view. Equivalent to EDB's CPU context menu → Label Address. Labels help identify important locations in the code.

Args: params (LabelAddressInput): Address + label - address (str): Address (e.g., '0x401000') - label (str): Label text (e.g., 'my_func')

Returns: str: Confirmation

List all saved bookmarks with names and addresses.

Returns: str: Bookmark listing

List all breakpoints, watchpoints, and their status (number, type, enable/disable, address).

Returns: str: Formatted breakpoint table

List supported breakpoint types (software, hardware, watchpoint, catchpoint).

List all address annotations added via edb_add_comment. Returns a sorted list of addresses with their associated comments.

Returns: str: Comment listing

List GDB debugger features and capabilities. Shows GDB version, build configuration, and available Python modules.

Returns: str: Feature list

List all functions in the binary, optionally filtered by name. Equivalent to EDB's FunctionFinder plugin. Shows function names, addresses, and prototypes.

Args: params (FunctionFilterInput): Filter - filter_str (str): Optional filter (e.g., 'main', 'printf')

Returns: str: Function listing

List all shared libraries / modules loaded by the process. Shows base address, text size, and path.

Returns: str: Module listing

List all available debugger plugins and capabilities. Equivalent to EDB's DialogPlugins. Shows EDB plugins, GDB auto-load scripts, and pretty-printers.

Returns: str: Plugin listing with descriptions

List all signals and how GDB handles them. Equivalent to EDB's signal configuration view. Shows which signals cause stop, print notification, and are passed to the program.

Args: params (ListSignalsInput): Filter - signal (str): Specific signal to query (default: all)

Returns: str: Signal list with handling info

Display source code with line numbers. Current line is marked with '->'. Reads directly from the source file if available.

Args: params (SourceInput): Source location - file (str): Source file path - line (int): Starting line (default: 1) - count (int): Lines to show, 1-200 (default: 20)

Returns: str: Source code listing

List all source files used by the debugged program. Equivalent to GDB's info sources command. Shows compiled source files and their paths.

Returns: str: Source file list

List arguments for stack frames. Equivalent to EDB's stack frame panel. Shows function arguments for the current frame.

Args: params (FrameRangeInput): Frame range - frame_low (int): Lowest frame (default: 0)

Returns: str: Arguments per frame

List all threads in the debugged process with IDs, names, and states.

Returns: str: Thread listing

Load an executable binary for debugging. Resolves symbols and prepares for execution. Optionally pass command-line arguments. This is the mandatory first step for debugging a new binary.

Args: params (BinaryPath): Path and arguments - path (str): Absolute path to the executable - args (Optional[str]): Command-line arguments (default: "")

Returns: str: Status message confirming the binary was loaded

Load a symbol file for the debugged program. Equivalent to EDB's FasLoader plugin and GDB's symbol-file command. Supports ELF debug info files, FAS format, and separated debug symbols.

Args: params (SymbolFileInput): Symbol file - file_path (str): Path to symbol file - address (str): Base address (for add-symbol-file with .o/.so)

Returns: str: Symbol loading result

Look up a symbol's address and type. Supports functions and variables.

Args: params (SymbolLookup): Symbol name - name (str): E.g., 'main', 'printf', 'errno'

Returns: str: Symbol address and type info

Replace a range of instructions with NOP (0x90) bytes. This is the primary method for patching out conditional jumps or calls. Use edb_get_function_bounds to find the range for a function.

Args: params (NopRangeInput): Range to NOP - start_address (str): Start address (e.g., '0x400000') - end_address (str): End address, exclusive (e.g., '0x400005')

Returns: str: Confirmation of bytes written

Show all memory patches made this session, or clear the history.

Pause (interrupt) the running program. Sends a SIGINT to break execution.

Returns: str: Confirmation of interruption

Load a binary, set breakpoint, run, and dump state in one call.

Scan process memory for readable ASCII strings.

Print the type of a variable, function, or expression. Equivalent to GDB's ptype command. Shows complete type definition including struct/class members, function signatures, and typedefs.

Args: params (PtypeInput): Expression - expression (str): Expression (e.g., 'main', 'argc', 'struct stat')

Returns: str: Type definition

Read and display memory contents at an address as a hex dump. Shows hex bytes with ASCII representation.

Args: params (AddressInput): Memory parameters - address (str): Address (e.g., '0x7fff0000' or symbol name) - count (int): Bytes to read, 1-4096 (default: 128)

Returns: str: Formatted hex dump with address, hex bytes, and ASCII

Read memory at an address interpreted as a specific data type. Supports integers (8-64 bit signed/unsigned), float, double, pointer, and string. Essential for struct inspection, pointer chasing, and data analysis.

Args: params (ReadMemoryAsInput): Read parameters - address (str): Address or symbol name - data_type (str): Type: int8/16/32/64, uint8/16/32/64, float, double, pointer, string - count (int): Number of elements (default: 1, max: 256)

Returns: str: Value(s) interpreted as the requested type

Detect the architecture of a connected remote GDB target.

Connect to a remote gdbserver for remote debugging. Equivalent to starting a new debugging session with remote target. Use extended mode for continuous connection.

Args: params (RemoteConnectInput): Connection - host (str): Remote hostname or IP - port (int): Remote port (1-65535) - extended (bool): Use extended-remote mode

Returns: str: Connection status

Show detailed information about the remote debugging target.

Remove a bookmark by name.

Args: params (BookmarkNameInput): Bookmark name - name (str): Bookmark name to remove

Returns: str: Confirmation

Permanently remove a breakpoint or watchpoint by number. Use edb_list_breakpoints to find breakpoint numbers.

Args: params (BreakpointNumber): Breakpoint number - number (int): Breakpoint ID to remove

Returns: str: Confirmation

Remove an annotation previously added with edb_add_comment.

Args: params (AddressOnlyInput): Address - address (str): Address to remove comment from

Returns: str: Confirmation

Kill and restart the debugged program. Reloads the binary, preserves breakpoints.

Returns: str: Status after restart

Continue execution backward to the previous breakpoint or event. Requires GDB recording to be active (target record-full). Useful for rewinding to find where state changed.

Returns: str: Reverse continue result

Step backward in the program execution (reverse debugging). Requires GDB recording to be active (target record-full). Steps the program backward one or more instructions.

Args: params (ReverseStepInput): Step count - count (int): Number of reverse steps (default: 1)

Returns: str: Reverse step result

Start execution of the loaded program from the beginning. Stops at the first breakpoint hit.

Returns: str: Status with reason if stopped at breakpoint

Scan the stack for potential return addresses (values in valid text ranges). Useful for ROP/exploit analysis.

Search memory for byte patterns (case-insensitive). Searches memory for the given hex byte pattern within the specified range. Useful for finding instruction opcode patterns in code sections.

Args: params (SearchInstructionsInput): Pattern search - pattern (str): Hex byte pattern (e.g., '0x90 0x90') - range_start (Optional[str]): Start address of search range - range_end (Optional[str]): End address of search range

Returns: str: Addresses where pattern was found

Search memory for a byte pattern. Finds all occurrences in the specified region.

Args: params (SearchMemoryInput): Search parameters - pattern (str): Hex bytes (e.g., '0x90 0x90') - address (Optional[str]): Start address (default: $pc) - length (Optional[str]): Region size in hex (default: 0x10000)

Returns: str: Addresses where the pattern was found

Send a signal to the debugged process. Equivalent to EDB's signal delivery mechanism. Can be used to send SIGINT (2) to interrupt, SIGTERM (15) for graceful shutdown, etc.

Args: params (SignalSendInput): Signal - signum (int): Signal number (1-64), e.g., 2=SIGINT, 9=SIGKILL, 15=SIGTERM

Returns: str: Signal delivery result

Load a debugging session from a JSON file. Equivalent to EDB's SessionManager. Restores breakpoints, bookmarks, comments, binary path, and arguments from a saved session.

Args: params (SessionFileInput): Input - file_path (str): Full path to session file

Returns: str: Load confirmation with details

Save the complete debugging session to a JSON file. Equivalent to EDB's SessionManager. Saves breakpoints, bookmarks, comments, binary path, and arguments for later restoration.

Args: params (SessionFileInput): Output - file_path (str): Full path to session file

Returns: str: Save confirmation

Set a breakpoint at a function, address, or source location. Supports conditional breakpoints.

Args: params (BreakpointInput): Breakpoint location - location (str): E.g., 'main', '*0x400528', 'foo.c:42' - condition (Optional[str]): E.g., 'x == 5' (default: none)

Returns: str: Breakpoint number and details

Set or remove a condition on an existing breakpoint. Equivalent to EDB's DialogBreakpoints condition button. The breakpoint will only trigger when the condition evaluates to true.

Args: params (BreakpointConditionInput): Condition - number (int): Breakpoint number - condition (str): Condition (empty to remove, e.g., 'eax == 0')

Returns: str: Condition update result

Set the number of times a breakpoint should be ignored before stopping. Equivalent to GDB's ignore command. Useful for skipping a breakpoint N times (e.g., in a loop) before breaking.

Args: params (BreakpointIgnoreInput): Ignore - number (int): Breakpoint number - count (int): Skip count (0 = don't skip)

Returns: str: Ignore count result

Set a catchpoint for exceptions, syscalls, signals, or process events. Equivalent to EDB's catchpoint feature. Stops execution when the specified event occurs.

Args: params (CatchpointInput): Catchpoint - event (str): Event: throw, catch, syscall, signal, assert, exec, fork, vfork, load, unload - condition (str): Optional condition or syscall name/number

Returns: str: Catchpoint confirmation

Switch the debugger context to a different thread. All subsequent commands apply to the selected thread.

Args: params (ThreadId): Thread ID - thread_id (int): Thread ID to switch to

Returns: str: Confirmation

Enable or disable GDB internal debug output. Equivalent to EDB's Debug Logger panel. Shows detailed GDB internals for troubleshooting: target events, breakpoint insertion, stepping, etc. Available categories: infrun, lin-lwp, remote, serial, target, event, expression, overlay, frame, thread.

Args: params (DebugOutputInput): Debug settings - category (str): Debug category (empty to list available) - enable (bool): True=on, False=off (default: True)

Returns: str: Debug output status

Set an environment variable for the debugged process. Equivalent to EDB's process environment configuration. Variables set here are passed to the program when it runs.

Args: params (EnvironmentInput): Variable - name (str): Variable name (e.g., 'LD_PRELOAD', 'PATH') - value (str): Variable value

Returns: str: Confirmation

Set a hardware-assisted breakpoint using CPU debug registers. Useful for ROM, flash, or self-modifying code regions.

Args: params (BreakpointInput): Location - location (str): Address or function name

Returns: str: Hardware breakpoint information

Set memory permissions for a region (read/write/execute). Equivalent to EDB's DialogMemoryRegions permission checkboxes. Uses GDB's mem command to define memory region attributes.

Args: params (MemoryPermissionsInput): Permissions - address (str): Start address - permissions (str): Permissions: none, r, w, x, rw, rx, wx, rwx - size (int): Region size (default: 4096)

Returns: str: Permission change confirmation

Modify a CPU register value. Useful for patching execution flow or testing conditions.

Args: params (RegisterSetInput): Register modification - name (str): Register name (e.g., 'rax', 'rip') - value (str): New value in hex (e.g., '0x7fff00001000')

Returns: str: Confirmation

Log all GDB input/output to a file for debugging or record-keeping. Useful for creating session transcripts and debugging GDB interactions.

Args: params (SessionLoggingInput): Logging - file_path (str): Log file path (default: gdb.log) - enable (bool): Enable (True) or disable (False) logging

Returns: str: Logging status

Set a trace point (logging breakpoint) that prints a message and continues without stopping execution. Useful for tracing function calls and variable changes without interrupting the program flow.

Args: params (ConditionalLogInput): Trace configuration - location (str): Breakpoint location (function, address, or file:line) - log_message (str): Message to print (use $reg for register values)

Returns: str: Trace point number and details

Set the terminal device for the debugged program's I/O. Equivalent to EDB's TTY configuration in DialogOptions. The program's stdin/stdout/stderr will be redirected to this TTY.

Args: params (TTYInput): Terminal - tty_path (str): TTY device path (e.g., '/dev/pts/0')

Returns: str: TTY configuration result

Modify a variable's value in the current scope. Useful for altering program behavior during debugging.

Args: params (VariableInput): Variable modification - name (str): Variable name (e.g., 'x', 'error_flag') - value (str): New value (e.g., '0', '42', '"hello"')

Returns: str: Confirmation

Set a watchpoint to monitor memory access. Three modes:

• 'write': stops when value changes (default)

• 'read': stops when value is read

• 'access': stops on both read and write

Args: params (WatchpointInput): Watchpoint configuration - expression (str): E.g., 'x', '*0x7fff0000', 'my_global' - watch_type (str): 'write', 'read', or 'access' (default: 'write')

Returns: str: Watchpoint details

Set the working directory for the debugger and debugged process. Equivalent to EDB's actionApplication_Working_Directory. Useful for programs that need to load files from a specific directory.

Args: params (WorkingDirectoryInput): Directory - directory (str): Working directory path

Returns: str: Confirmation

Display current debugger configuration settings. Uses GDB's show command to query various settings.

Args: params (ShowConfigInput): Query - setting (str): Setting name (e.g., 'architecture', 'follow-fork-mode')

Returns: str: Current configuration value

Configure how GDB handles signals (stop, print, pass to program). Equivalent to EDB's signal handling in DebuggerCore. When action is empty, queries current handling for the signal.

Args: params (SignalHandlingInput): Signal settings - signal (str): Signal name (e.g., SIGSEGV, SIGINT, SIGTRAP) - action (str): Action: stop, nostop, print, noprint, pass, nopass, ignore

Returns: str: Signal handling configuration

Modify the value at the top of the stack without changing RSP. Equivalent to EDB's Stack context menu → Modify. Writes a new value to the current stack pointer location.

Args: params (StackModifyInput): New value - value (str): New value (e.g., '0xdeadbeef')

Returns: str: Result

Pop a value from the program stack (reads value, increments RSP). Equivalent to EDB's Stack context menu → Pop. Returns the popped value and modifies the target process RSP register.

Returns: str: Popped value and result

Push a value onto the program stack (decrements RSP, writes value). Equivalent to EDB's Stack context menu → Push. Modifies the target process stack and register state.

Args: params (StackPushInput): Push value - value (str): Value to push (e.g., '0x1234', '&main')

Returns: str: Result

Step a single instruction (assembly-level), not a source line. Equivalent to EDB's action_Single_Step. Unlike edb_step_into which steps by source line, this steps by individual CPU instruction.

Args: params (StepInstructionInput): Count - count (int): Number of instructions to step (default: 1)

Returns: str: Step result with current instruction

Execute one machine instruction, stepping into function calls. If the current instruction is a call, execution enters the called function.

Returns: str: JSON with address, function, file, line after stepping

Execute until the current function returns to its caller.

Returns: str: Location where execution stopped

Execute one machine instruction, treating calls as atomic. If the instruction is a call, the entire called function runs then stops.

Returns: str: JSON with address, function, file, line after stepping

Step over a single instruction (assembly-level), skipping calls. Equivalent to GDB's nexti command. Unlike edb_step_over (source line) and edb_step_instruction (step INTO calls), this steps over calls at the instruction level.

Args: params (StepOverInstructionInput): Count - count (int): Number of instructions (default: 1)

Returns: str: Step result

Find all code and data references to a string or address in the binary. Searches function names, variable names, and source files for the given string. Useful for tracing how a particular value or string is used in the program.

Args: params (StringRefInput): Search target - string_or_address (str): String content (e.g., 'password') or hex address

Returns: str: Matching functions, variables, and sources

Show execution trace status, frames, and collected data.

Start an execution trace at an address/function. Records every instruction execution.

Stop the current execution trace session.

Remove an environment variable from the debugged process. Useful for clearing variables that may affect program behavior.

Args: params (EnvironmentUnsetInput): Variable name - name (str): Variable name to unset

Returns: str: Confirmation

Convert a virtual address in the loaded process to the corresponding file offset in the binary on disk. Essential for applying patches back to the binary file.

Args: params (VirtualAddressInput): Virtual address - address (str): Virtual address in hex (e.g., '0x400000')

Returns: str: File offset in hex

Navigate to and inspect an address across all views. Equivalent to EDB's viewInCpu() / viewInDump() / viewInStack() context menu actions. Shows disassembly, hex dump, register references, and code references for the given address.

Args: params (ViewAddressInput): Address - address (str): Address to view (e.g., '0x400000', 'main', '$rsp')

Returns: str: Combined view across all panels

Add an expression to the auto-display list. Evaluated and shown on every stop.

Print the type of an expression (short form). Equivalent to GDB's whatis command. Shows the type name without full definition (unlike edb_ptype).

Args: params (PtypeInput): Expression - expression (str): Expression (e.g., 'main', 'argc')

Returns: str: Type name

Write a value to a memory address. Use for patching code or data.

Args: params (MemoryWriteInput): Memory write - address (str): Target address (e.g., '0x400000') - data (str): Data to write (e.g., '0x90' for NOP)

Returns: str: Confirmation

Write raw hex bytes to memory starting at an address. Useful for patching multiple bytes at once (e.g., NOP sled or shellcode).

Args: params (MemoryWriteBytesInput): Raw byte write - address (str): Target address (e.g., '0x400000') - hex_bytes (str): Hex bytes (e.g., '90 90 90' or '0x90 0x90 0x90')

Returns: str: Confirmation of byte count written

Calculate aligned value (up/down) for a given alignment boundary.

Analyze an ELF binary using pwntools — entry point, PIE/NX/RELRO/Canary, sections, symbols, PLT/GOT, segments.

Assemble assembly instructions into hex bytes using pwntools + keystone.

Get or set a specific bit in an integer.

Build a ROP chain to call a target function with arguments using pwntools ROP.

Check security properties of an ELF binary: RELRO, Canary, NX, PIE, RPATH/RUNPATH, FORTIFY.

Search pwntools/ELF constants by name or value.

View or modify pwntools global context (arch, os, endian, log_level).

Generate a cyclic pattern for buffer overflow offset discovery.

Find the offset of a value within a cyclic pattern.

Disassemble raw hex bytes into assembly instructions using pwntools + capstone.

List shared library dependencies of an ELF binary (DT_NEEDED entries).

Compare two ELF binaries: sections, segments, symbols.

Parse Global Offset Table (GOT) entries from an ELF binary.

Show ELF notes: build ID, ABI tag, property notes.

Patch bytes in an ELF binary at a given file offset. Creates a backup.

Parse Procedure Linkage Table (PLT) entries from an ELF binary.

Read bytes from an ELF binary at a section or address, with hex dump output.

Show ELF relocation entries (GOT/PLT fixups and absolute relocations).

Search for a byte pattern in an ELF binary.

List all ELF sections with detailed info: type, flags, address, offset, size, alignment.

List ELF program headers (segments): type, flags, offset, vaddr, filesz, memsz.

Extract printable strings from an ELF binary, optionally filtered by section.

Search symbols in an ELF binary by regex pattern and type.

Encode shellcode using pwntools encoders (alphanumeric, null_free, xor).

Encode raw bytes to hexadecimal string. Supports \x escapes.

Calculate byte entropy (Shannon) of a file or memory region. Useful for detecting encryption, packing, or embedded data.

Search ROP gadgets grouped by type: syscall, stack_pivot, call, jump.

Search for ROP gadgets in an ELF binary using pwntools ROP engine.

Pack a list of values/addresses into flat bytes using pwntools flat().

Generate a format string exploit payload for arbitrary writes.

Display a formatted hex dump using pwntools hexdump styling.

Set pwntools log verbosity. Levels: debug, info, warning, error.

Compile assembly code into an ELF binary using pwntools make_elf.

Pack an integer into bytes (e.g., p64, p32, p16).

Start a local process for interaction (pwntools tube).

Connect to a remote TCP service (pwntools tube).

Rotate an integer value left by N bits.

Rotate an integer value right by N bits.

Generate shellcode using pwntools shellcraft module.

Generate a Sigreturn-Oriented Programming (SROP) frame using pwntools SigreturnFrame.

Close an active tube connection.

List all active tube connections.

Receive data from an active tube.

Receive a single line from an active tube.

Receive data from a tube until a pattern is found.

Send raw data to an active tube (process or remote).

Send a line (with newline) to an active tube.

Decode hexadecimal string back to raw bytes.

Unpack bytes into an integer (e.g., u64, u32, u16).