pwndbg

No entries match these filters. Clear filters

1. 2026.10.22 Oct 22, 2026 · issue 117

   pwndbg 2026.10.22 adds m68k support, Objective-C inspection, Android BionicBionicAn open-source C standard library developed by Google for Android, replacing glibc; cyber tools targeting Android or embedded Linux use it because it is smaller, faster to link, and carries a permissive license. detection, Linux 7.0 SLUBSLUBThe default slab memory allocator in the Linux kernel, managing allocation of fixed-size kernel objects. Cyber tools targeting kernel exploits often interact with or manipulate it to control heap layout. sheaf/barn, setrlimitsetrlimitA POSIX system call that sets hard and soft resource limits—CPU time, open file descriptors, memory—on a process, giving cyber tools fine-grained control over their own or a child process's resource consumption., and SIMD register display.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2026.10.22 https://github.com/pwndbg/pwndbg.git
   # already have the repo? check out this version:
   $ git checkout 2026.10.22

   ⤢ ⤢ ⤢ ⤢
   └──▷ TRY IT
   Inspect an Objective-C class during macOS/iOS binary analysis to see method selectors and implementation addresses without needing a separate class-dump tool.
   copy

   $ objc show-class -n NSURLSession

   Remove the core-dump size limit so a crashing debugee actually writes a full core file for post-mortem analysis.
   copy

   $ setrlimit core infinite

   • Adds nearpc --opcode / nearpc -o to show opcode bytes sized to the longest instruction in the listing, or nearpc -o 4 for a fixed-width column — without changing nearpc-num-opcode-bytes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds objc show-class -n <ClassName> to display Objective-C class metadata in pseudo-ObjC syntax, including method implementations and selector addresses, with -a <address> and -m <module> lookups, and objc list-classes to list Objective-C classes in the main module, where -a includes all modules except the DYLD shared cache and -A includes it.
   • Adds setrlimit command to set debugee resource limits — e.g. setrlimit nofile 1 2 sets soft and hard open-file limits, setrlimit core infinite sets both core-file limits to unlimited.
   • Extends regs to display SIMD registers (e.g. regs xmm0) and decode individual flags-register bits (e.g. regs eflags).
   • Updates slab info to display per-CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. sheaves and per-node barns for Linux 7.0+.

   +5 more show less

   • Adds LLDB target create -r flag for specifying a remote executable path and process launch -w for setting the working directory.
   • Adds LLDB target.run-args support so launch now respects pre-configured run arguments.
   • Adds m68k architecture support including Capstone disassembly, Unicorn emulation, branch target resolution, and instruction annotations.
   • Pwndbg no longer refuses to start on unknown architectures — falls back to the underlying debugger's disassembler with reduced context and no emulation.
   • Adds Android Bionic libc detection, surfaced via the libc / libcinfo command showing libc and loader mappings.
   • Adds nearpc --opcode / nearpc -o to show opcode bytes sized to the longest instruction in the listing, or nearpc -o 4 for a fixed-width column — without changing nearpc-num-opcode-bytes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds objc show-class -n <ClassName> to display Objective-C class metadata in pseudo-ObjC syntax, including method implementations and selector addresses, with -a <address> and -m <module> lookups, and objc list-classes to list Objective-C classes in the main module, where -a includes all modules except the DYLD shared cache and -A includes it.
   • Adds setrlimit command to set debugee resource limits — e.g. setrlimit nofile 1 2 sets soft and hard open-file limits, setrlimit core infinite sets both core-file limits to unlimited.
   • Adds LLDB target create -r flag for specifying a remote executable path and process launch -w for setting the working directory.
   • Adds m68k architecture support including Capstone disassembly, Unicorn emulation, branch target resolution, and instruction annotations.

   +1 more show less

   • Adds Android Bionic libc detection, surfaced via the libc / libcinfo command showing libc and loader mappings.

   4 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The resolve-heap-via-heuristic configuration key is deprecated and has no effect — pwndbg now always tries symbols first and then heuristics regardless of this setting.
2. 2026.09.15 Sep 20, 2026 · issue 081

   pwndbg gains backwards disassembly, new stack-vis command, nearpc -f without symbols, and full page info on v2p/p2v/pageinfo⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2026.09.15 https://github.com/pwndbg/pwndbg.git
   # already have the repo? check out this version:
   $ git checkout 2026.09.15

   ⤢ ⤢ ⤢ ⤢
   └──▷ TRY IT
   Visualize the current thread's stack frames at a breakpoint to understand frame layout during exploit development.
   copy

   $ stack-vis

   View command output 2026.09.15 Real pwndbg output from a synthetic AArch64 core fixture.

   ● actually ran exit 0 · 1,165ms · 0ee5b8fbd708

   GDB 15.1; inner_function, 0x401080–0x4010e0. Fixture function deliberately placed at 0x401080. No DWARF debug information; ordinary ELF symbols retained.

   Fixture and debugger provenance

   {
     "source_sha": "55596aa676a2756efb8d67034f31675170eabe48",
     "source_commit": null,
     "image_digest": "sha256:0ee5b8fbd708acf4a61c7ae73d418e74857cd28721e710444e466150c08cbd01",
     "captured_at": "2026-09-23T00:46:17.325163+00:00",
     "execution_context": {
       "adapter": {
         "id": "pwndbg-core-aarch64-v1",
         "sha256": "ea642ca005adc4451df1a10b5ca103b86792619798b4e17d8f2e4659b2b46389"
       },
       "binding_sha256": "ce3c84998475d87a23d05e9b38b490497a60c7c48f7a4a9a3e5ca9d066e7526d",
       "debugger": {
         "argv": [
           "gdb",
           "-q",
           "-nx",
           "-nh",
           "-batch",
           "-ex",
           "set pagination off",
           "-ex",
           "set confirm off",
           "-ex",
           "set debuginfod enabled off",
           "-ex",
           "source /pwndbg/gdbinit.py",
           "-ex",
           "set debug-file-directory /nonexistent",
           "-ex",
           "file /opt/ctk/pwndbg/fixture.elf",
           "-ex",
           "core-file /opt/ctk/pwndbg/fixture.core",
           "-x",
           "/opt/ctk/pwndbg/capture.py"
         ],
         "command": "stack-vis",
         "core_loaded": true,
         "environment": {
           "CTK_SELECTED_DEBUGGER_COMMAND": "stack-vis",
           "DEBUGINFOD_URLS": "",
           "HOME": "/tmp",
           "LC_ALL": "C.UTF-8",
           "PWNDBG_NO_AUTOUPDATE": "1",
           "PWNDBG_VENV_PATH": "/venv",
           "PYTHONDONTWRITEBYTECODE": "1",
           "TERM": "dumb"
         },
         "frame": "inner_function",
         "name": "gdb",
         "parent_frame": "outer_function",
         "readable_stack_bytes": 64,
         "version": "15.1",
         "working_directory": "/tmp"
       },
       "fixture": {
         "architecture": "aarch64",
         "c_sha256": "1fa72d6195fe63c465c60822c7ca00bb3243afe80ae58086e0f786b2938f83d6",
         "compiler": {
           "argv": [
             "gcc",
             "-g",
             "-O0",
             "-nostdlib",
             "-no-pie",
             "-fno-pie",
             "-fno-stack-protector",
             "-fno-omit-frame-pointer",
             "-fno-optimize-sibling-calls",
             "-Wl,--section-start=.canary_target=0x401080,-e,_start",
             "-o",
             "/opt/ctk/pwndbg/fixture.elf",
             "/opt/ctk/pwndbg/fixture.c"
           ],
           "name": "gcc",
           "version": "13.3.0"
         },
         "core_sha256": "085612a3b0edf5771376e9e1a7b19b4037463158b86a55685246f15c9d1c44d6",
         "debug_info": "absent",
         "elf_sha256": "234f99f28388e33d559114a758a0ffe3addc10c245b86999c426989322b028d8",
         "external_debug_links": false,
         "function": {
           "end": 4198624,
           "name": "inner_function",
           "start": 4198528
         },
         "kind": "synthetic_source_derived",
         "label": "Synthetic AArch64 core fixture",
         "source_files": {
           "tests/binaries/host/crash_simple.native.c": "b0387aff0ad0ff2258b03ced1808dff665a68565d73e790a75b16be9ed1dbe5d",
           "tests/binaries/host/stack_vars.native.c": "e911a591fae1d76c5ec5049f9ae6d50b01c0e3b25422844997de0e61526cb67d"
         },
         "source_repo": "pwndbg/pwndbg",
         "source_sha": "55596aa676a2756efb8d67034f31675170eabe48",
         "strip_argv": [
           "strip",
           "--strip-debug",
           "/opt/ctk/pwndbg/fixture.elf"
         ],
         "symbols": "elf_symtab"
       },
       "kind": "gdb_core",
       "output": {
         "scope": "selected_debugger_command",
         "sha256": "6c0d12dd3fd134959ab272cfd8af4d17c894b8ae9a4e4904d83f913e95409825"
       }
     }
   }

   pwndbg · GDB copy

         (gdb) stack-vis
   0xfffff3edba10	0x0000000000000000	0x0000002a00000000	............*...	 <-- inner_function+80
   0xfffff3edba20	0x7266206f6c6c6548	0x72656e6e69206d6f	Hello from inner
   0xfffff3edba30	0x6f6974636e756620	0x000000000000216e	 function!......
   0xfffff3edba40	0x0000000000000000	0x0000000000000000	................
   0xfffff3edba50	0x0000000000000000	0x0000000000000000	................
   0xfffff3edba60	0x0000fffff3edba80	0x00000000004001b8	..........@.....	 <-- outer_function+32
   0xfffff3edba70	0x0000000000000000	0x4142434445464748	........HGFEDCBA
   0xfffff3edba80	0x0000000000000000	0x0000000000000000	................	 <-- _start+12
   

   Disassemble an entire function by address without debug symbols, getting branch visualization and operand annotations that raw disass lacks.
   copy

   $ nearpc --function 0x401080

   View command output 2026.09.15 Real pwndbg output from a synthetic AArch64 core fixture.

   ● actually ran exit 0 · 1,118ms · b50806fc385a

   GDB 15.1; inner_function, 0x401080–0x4010e0. Fixture function deliberately placed at 0x401080. No DWARF debug information; ordinary ELF symbols retained.

   Fixture and debugger provenance

   {
     "source_sha": "55596aa676a2756efb8d67034f31675170eabe48",
     "source_commit": null,
     "image_digest": "sha256:b50806fc385a239dbc36fb053d6db9bea21c15881e0d9adda37d94200c353d81",
     "captured_at": "2026-09-23T00:49:08.684392+00:00",
     "execution_context": {
       "adapter": {
         "id": "pwndbg-core-aarch64-v1",
         "sha256": "ea642ca005adc4451df1a10b5ca103b86792619798b4e17d8f2e4659b2b46389"
       },
       "binding_sha256": "c5d0c09ebd28e3dfc9ca2756f158d7f847a8f12d4eb7c6d89ddc954cadb203ce",
       "debugger": {
         "argv": [
           "gdb",
           "-q",
           "-nx",
           "-nh",
           "-batch",
           "-ex",
           "set pagination off",
           "-ex",
           "set confirm off",
           "-ex",
           "set debuginfod enabled off",
           "-ex",
           "source /pwndbg/gdbinit.py",
           "-ex",
           "set debug-file-directory /nonexistent",
           "-ex",
           "file /opt/ctk/pwndbg/fixture.elf",
           "-ex",
           "core-file /opt/ctk/pwndbg/fixture.core",
           "-x",
           "/opt/ctk/pwndbg/capture.py"
         ],
         "command": "nearpc --function 0x401080",
         "core_loaded": true,
         "environment": {
           "CTK_SELECTED_DEBUGGER_COMMAND": "nearpc --function 0x401080",
           "DEBUGINFOD_URLS": "",
           "HOME": "/tmp",
           "LC_ALL": "C.UTF-8",
           "PWNDBG_NO_AUTOUPDATE": "1",
           "PWNDBG_VENV_PATH": "/venv",
           "PYTHONDONTWRITEBYTECODE": "1",
           "TERM": "dumb"
         },
         "frame": "inner_function",
         "name": "gdb",
         "parent_frame": "outer_function",
         "readable_stack_bytes": 64,
         "version": "15.1",
         "working_directory": "/tmp"
       },
       "fixture": {
         "architecture": "aarch64",
         "c_sha256": "1fa72d6195fe63c465c60822c7ca00bb3243afe80ae58086e0f786b2938f83d6",
         "compiler": {
           "argv": [
             "gcc",
             "-g",
             "-O0",
             "-nostdlib",
             "-no-pie",
             "-fno-pie",
             "-fno-stack-protector",
             "-fno-omit-frame-pointer",
             "-fno-optimize-sibling-calls",
             "-Wl,--section-start=.canary_target=0x401080,-e,_start",
             "-o",
             "/opt/ctk/pwndbg/fixture.elf",
             "/opt/ctk/pwndbg/fixture.c"
           ],
           "name": "gcc",
           "version": "13.3.0"
         },
         "core_sha256": "37cf63a26a5f5958a4800a6a3706e85cfb8efe7ab7c3b083583d547673beb89d",
         "debug_info": "absent",
         "elf_sha256": "234f99f28388e33d559114a758a0ffe3addc10c245b86999c426989322b028d8",
         "external_debug_links": false,
         "function": {
           "end": 4198624,
           "name": "inner_function",
           "start": 4198528
         },
         "kind": "synthetic_source_derived",
         "label": "Synthetic AArch64 core fixture",
         "source_files": {
           "tests/binaries/host/crash_simple.native.c": "b0387aff0ad0ff2258b03ced1808dff665a68565d73e790a75b16be9ed1dbe5d",
           "tests/binaries/host/stack_vars.native.c": "e911a591fae1d76c5ec5049f9ae6d50b01c0e3b25422844997de0e61526cb67d"
         },
         "source_repo": "pwndbg/pwndbg",
         "source_sha": "55596aa676a2756efb8d67034f31675170eabe48",
         "strip_argv": [
           "strip",
           "--strip-debug",
           "/opt/ctk/pwndbg/fixture.elf"
         ],
         "symbols": "elf_symtab"
       },
       "kind": "gdb_core",
       "output": {
         "scope": "selected_debugger_command",
         "sha256": "d2217eb166721f3949e98f3a1c546070382f1734b36c37fbb7036d13d738a9a0"
       }
     }
   }

   pwndbg · GDB copy

         (gdb) nearpc --function 0x401080
      0x401080 <inner_function>                            sub    sp, sp, #0x50
      0x401084 <inner_function+4>                          adrp   x0, 0x400000        X0 => 0x400000 ◂— 0x10102464c457f
      0x401088 <inner_function+8>                          add    x1, x0, #0x1c0
      0x40108c <inner_function+12>                         add    x0, sp, #0x10
      0x401090 <inner_function+16>                         ldr    q0, [x1]
      0x401094 <inner_function+20>                         str    q0, [x0]
      0x401098 <inner_function+24>                         ldur   q0, [x1, #0xb]
      0x40109c <inner_function+28>                         stur   q0, [x0, #0xb]
      0x4010a0 <inner_function+32>                         add    x0, sp, #0x2b
      0x4010a4 <inner_function+36>                         movi   v0.4s, #0
      0x4010a8 <inner_function+40>                         stp    q0, q0, [x0]
      0x4010ac <inner_function+44>                         fmov   x1, d0
      0x4010b0 <inner_function+48>                         stur   x1, [x0, #0x1d]
      0x4010b4 <inner_function+52>                         mov    w0, #0x2a           W0 => 0x2a
      0x4010b8 <inner_function+56>                         str    w0, [sp, #0xc]
      0x4010bc <inner_function+60>                         ldr    w1, [sp, #0xc]
      0x4010c0 <inner_function+64>                         add    x0, sp, #0x10
      0x4010c4 <inner_function+68>                         cmp    w1, #0x2a
      0x4010c8 <inner_function+72>                    ┌<   b.eq   inner_function+80           <inner_function+80>
                                                      │ 
      0x4010cc <inner_function+76>                    │    nop   
    ► 0x4010d0 <inner_function+80>                    └>   udf    #0
      0x4010d4 <inner_function+84>                         nop   
      0x4010d8 <inner_function+88>                         add    sp, sp, #0x50
      0x4010dc <inner_function+92>                         ret   
   

   • Adds stack-vis command to visualize stack frames of the current thread, similar to how vis-heap-chunks visualizes heap chunks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Expands nearpc -f/--function to work without debugging symbols, making it a full replacement for GDB's/LLDB's disass command with branch visualization, branch targets, and operand annotations.
   • Expands v2p, p2v, and pageinfo commands to display full page info including vaddr, paddr, and page.
   • Adds backwards disassembly in context disasm and nearpc, showing instructions before $PC when stopping at a breakpoint or after a syscall.
   • Enables emulation when debugging x64 kernels, unlocking emulated instruction flow and concrete operand display in the disassembly system.

   +1 more show less

   • Improves indirect jump handling for x86 PLT, ret instructions, and memory-indirect jumps that can segfault, enabling visualization of segfaulting ROP chains.
   • Adds stack-vis command to visualize stack frames of the current thread, similar to how vis-heap-chunks visualizes heap chunks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds backwards disassembly in context disasm and nearpc, showing instructions before $PC when stopping at a breakpoint or after a syscall.

   4 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !pwndbg.dbg_mod.Error is renamed to pwndbg.dbg_mod.DebuggerError; any plugin or script that catches or references pwndbg.dbg_mod.Error will break on upgrade.
3. 2026.07.29 Jul 30, 2026 · issue 031

   pwndbg 2026.07.29 adds exithandlers inspection, four kernel task commands, glibc 2.43 heap support, and heap allocation call-site tracking.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2026.07.29 https://github.com/pwndbg/pwndbg.git
   # already have the repo? check out this version:
   $ git checkout 2026.07.29

   ⤢ ⤢ ⤢ ⤢
   └──▷ TRY IT
   Inspect registered glibc exit handlers during exploitation to identify hijack opportunities and see the pointer_guard cookie.
   copy

   $ exithandlers

   Track heap allocations in a running process and annotate every malloc/free event with the nearest symbol that triggered it.
   copy

   $ track-heap enable --where

   Step execution forward until a specific syscall is reached, useful for quickly reaching an interesting I/O or exec call.
   copy

   $ stepsyscall write

   Inspect the seccomp filter of a kernel task by PID when debugging a kernel with qemu-system.
   copy

   $ kseccomp 1234

   • Adds exithandlers command (alias exitfuncs) to list registered glibc exit handlers by walking __exit_funcs and tls_dtor_list, demangling PTR_MANGLEd function pointers, and printing the pointer_guard cookie.
   • Adds four new Linux kernel task introspection commands without requiring typeinfo: kstack [pid], kseccomp [pid], ksighand [pid], and knamespace [pid].
   • Adds percpu GDB function to resolve per-CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. variables inside print/break expressions during kernel debugging.
   • Adds v2p and p2v GDB function helpers to convert between virtual and physical addresses inside expressions.
   • Adds support for breaking at the start of a JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility.-compiled eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. program.

   +22 more show less

   • Adds glibc 2.43 heap inspection support, including tcache large chunks since glibc 2.42.
   • Adds heap --count <N> and address range limits (heap <start> <end>) to walk only a requested portion of the heap.
   • Adds track-heap enable --where to annotate each heap allocation event with its nearest program symbol call site.
   • Adds track-heap enable -r to report heap event offsets relative to the mapping instead of absolute addresses.
   • Detects musl libc in statically linked binaries.
   • Enriches procinfo file descriptor output with netlink socket protocol/portid/groups, unix-domain socket peer process, and pipe peers with read/write end information.
   • Adds --quiet and --force flags to the mmap/mprotect commands.
   • Replaces the system readelf with pyelftools for ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. parsing across all architectures without requiring an external tool.
   • Adds set vmmap-cache to persist vmmap across stops on macOS.
   • Marks unresolved conditional branches with a question mark in the disassembly view.
   • Indicates when the current PC is at a breakpoint with a b► marker in the disassembly view.
   • Adds set telescope-pad-leading-zeroes on to zero-pad pointer-aligned integers to pointer width in telescope output.
   • GDB's print command now displays values in hex by default.
   • Extends dt command to properly handle bitfields (with sub-byte offsets like +0x0000.1), nested struct offsets, and flexible array members.
   • Extends stepsyscall to step until a given syscall name or a condition expression, e.g. stepsyscall write or stepsyscall -c '$rdi==0'.
   • Adds an optional count/length parameter to the windbg-style dds/dps/dqs/kd commands.
   • Command history and Enter-to-repeat now work on LLDB.
   • Enables RISC-V B extension disassembling.
   • Moves the pwndbg themes collection into the main repository under the themes/ directory.
   • Page table scanning now reads /proc/pid/mem by default for significantly faster vmmap operations.
   • Kernel image downloads are now parallelized for faster retrieval.
   • slab_contains now shows inuse/total object count on its own line.

   27 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The mallocng-dump, mallocng-vis, jemalloc-heap, jemalloc-extent-info, knft-list-tables (and similar dash-separated) commands are replaced by subcommands: use mallocng dump, mallocng vis, jemalloc heap, jemalloc extent-info, knft list-tables etc. instead.
   • !The cyclic command now generates a de Bruijn sequence consistent with pwn cyclic from pwntools; previously generated sequences will differ.
   • !Developer API: pwndbg.aglib.disasm.arch is renamed to pwndbg.aglib.disasm.assistant.
4. 2026.02.18 Feb 18, 2026 · release notes

   pwndbg 2026.02.18: branch viz in nearpc, decompiler integration, new kernel commands, LLDB core file support, and compact register modes

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2026.02.18 https://github.com/pwndbg/pwndbg.git
   # already have the repo? check out this version:
   $ git checkout 2026.02.18

   └──▷ TRY IT
   Disassemble an entire function at once to review its full control flow with branch visualization.
   copy

   $ nearpc -f main

   Trace kernel heap allocations and frees in real time to investigate SLUBSLUBThe default slab memory allocator in the Linux kernel, managing allocation of fixed-size kernel objects. Cyber tools targeting kernel exploits often interact with or manipulate it to control heap layout. or buddy allocator activity.
   copy

   $ kmem-trace

   Dump a memory region as a C array for use in an exploit or test harness.
   copy

   $ hexdump -C c 0x7fffffffd000 256

   • Adds radare2-inspired branch visualization in nearpc disassembly output using Unicode characters; disable with -n/-no-branch
   • Adds nearpc -f <funcname> to disassemble an entire function at once
   • Adds nearpc -r and nearpc -t parameters to control the number of previous and total instructions displayed
   • Adds decompiler integration via decomp2dbg, supporting IDA, Binary Ninja, Ghidra, and angr-management as backends; works with both GDB and LLDB
   • Adds kmem-trace command to trace SLUB and buddy Linux kernel allocator allocations and frees

   +24 more show less

   • Adds kcurrent [pid] [-set] command to display info about the current or a given kernel task
   • Adds kfile [pid] [-fd [fd]] command to display file descriptors accessible by the current or a given kernel task
   • Extends pagewalk to walk page tables of different kernel tasks when debug info is present
   • Adds LLDB support for core file loading and debugging
   • Adds starti command for LLDB
   • Adds set show-compact-regs very and set show-compact-regs hardcut modes for condensed register display
   • Adds stack variable names and offsets in the context display when debug info is present
   • Adds ctx -a to display all context sections at once
   • Adds a last-signal context panel showing the last signal received by the debugee
   • Adds set context-backtrace-hex on to display backtrace offsets in hexadecimal
   • Adds context-tui-adjust-height on|off for GDB TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. mode to control whether sections fill the full terminal height
   • Adds set vis-skip-repeating-val on|off to make the vis command collapse repeated lines
   • Adds hexdump -C py and hexdump -C c flags to dump memory as Python or C code arrays
   • Adds Intel PKU (Memory Protection Keys for Userspace) violation detection with detailed info messages
   • Extends the patch command to support more architectures via Zig
   • Adds syntax highlighting for decompiled code with IDA Pro
   • Adds CONFIG_SLAB_VIRTUAL and SLUB support for Linux kernel >= 6.18
   • Adds PowerPC branch resolution and emulation
   • Adds Sparc branch following support
   • Adds detection of more MIPSMIPSA RISC processor architecture originally developed at Stanford and commercialized by MIPS Technologies, widely used in embedded and network devices; cyber tools target it to analyze or exploit routers, cameras, and similar hardware. architecture variants
   • Adds XDG_CONFIG_HOME environment variable lookup for the gdbinit file
   • Enables debuginfod client by default in portable releases, automatically fetching debug symbols from a hosted server covering Ubuntu, Debian, Fedora, Arch, NixOS, and more
   • Expands vmmap to show more pages when working with core files
   • Improves ropgadget integration with color support

   29 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Deprecated underscore command aliases are removed (e.g. heap_config no longer works; use heap-config instead).
   • !The pwndbg.aglib.regs["x"] bracket access is replaced with pwndbg.aglib.regs.read_reg("x"); existing scripts using bracket access will break.
   • !The ppc64 big-endian portable release is dropped.
5. 2025.10.20 Oct 20, 2025 · release notes

   pwndbg 2025.10.20 adds a new kbpf command for kernel BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. introspection and improves page marker detection.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2025.10.20 https://github.com/pwndbg/pwndbg.git
   # already have the repo? check out this version:
   $ git checkout 2025.10.20

   • Adds kbpf command for inspecting kernel BPF internals during live kernel debugging sessions.
   • Enables page marker detection without requiring debug symbols, broadening kernel debugging coverage.

   2 details in Everything

6. 2025.10.10 Oct 9, 2025 · release notes

   pwndbg 2025.10.10 adds musl mallocng commands, new kernel debug commands, LLDB Objective-C/Mach-O support, and cyclic --detect.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2025.10.10 https://github.com/pwndbg/pwndbg.git
   # already have the repo? check out this version:
   $ git checkout 2025.10.10

   └──▷ TRY IT
   Detect cyclic pattern offsets automatically across all registers and memory after a crash, instead of manually inspecting each register.
   copy

   $ cyclic --detect

   Inspect musl mallocng heap state for a target binary to find corruption or understand allocator internals during exploit development.
   copy

   $ ng-dump

   During Linux kernel debugging, list loaded kernel modules to identify attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. or verify module state without debuginfo.
   copy

   $ kmod

   • New kdmesg command for dumping kernel dmesg during kernel debugging.
   • New ktask command for dumping kernel task info during kernel debugging.
   • New kmod command for dumping kernel module info during kernel debugging.
   • New ksyscall command for dumping kernel syscall info during kernel debugging.
   • New kdmabuf command for dumping DMA buf info during kernel debugging.

   +20 more show less

   • Improved vmmap output for kernel debugging sessions.
   • New ng-explain command to explain musl mallocng slot layout.
   • New ng-find command to locate a slot, group, or meta by address in musl mallocng.
   • New ng-slots command to inspect musl mallocng slots.
   • New ng-metaarea and ng-ctx commands to inspect musl mallocng internals.
   • New ng-vis command to visualize the musl mallocng heap.
   • New ng-dump command to dump musl mallocng heap state.
   • Adds --detect flag to cyclic command to detect cyclic sequences in registers and memory.
   • New max-decimal-number config option to set the threshold above which values display in hex instead of decimal.
   • New disasm-branch-on and disasm-branch-off theme options for branch jump markers in disassembly.
   • New disasm-reg-alias config option to force disassembly to use register aliases (e.g. aarch64 x29 → fp).
   • Adds Objective-C and Mach-O support on Darwin under LLDB.
   • Improved vmmap output on Darwin under LLDB, incorporating DYLD Shared Cache.
   • New commpage command in LLDB to dump Apple commpage memory mapping.
   • Adds arm64e architecture support in LLDB.
   • Adds fzf (fuzzy finder) tab completion in LLDB.
   • Adds help set command in LLDB.
   • Adds Go binaries support for mips, loongarch64, and s390x architectures.
   • Updated Capstone disassembly engine to version 6 alpha5.
   • Portable releases now include zig, enabling commands such as cyclic in portable builds.

   25 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The PWNDBG_PLEASE_SKIP_VENV environment option is removed; setups that relied on it will break.
   • !The PWNDBG_DISABLE_COLORS environment option is removed; use NO_COLOR instead.
7. 2025.05.30 May 31, 2025 · release notes

   pwndbg 2025.05.30 adds kernel debugging commands, ✘ branch markers, dump-register-frame, s390x support, and IDA stack variable lookup.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2025.05.30 https://github.com/pwndbg/pwndbg.git
   # already have the repo? check out this version:
   $ git checkout 2025.05.30

   └──▷ TRY IT
   Inspect the Linux kernel buddy allocator's free-page state while debugging a kernel with QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware..
   copy

   $ buddydump

   Read or write a Model-Specific Register during kernel (ring0) debugging to inspect CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. state.
   copy

   $ msr

   Look up an IDA-named stack variable by name inside a pwndbg expression while reversing a function.
   copy

   $ p $ida("var_10")

   • New buddydump command inspects Linux kernel buddy allocator state on x86-64.
   • New msr command reads/writes Model-Specific Registers during ring0 kernel debugging.
   • New dump-register-frame command dumps saved register frames, useful for ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. Cortex-M exception/interrupt debugging.
   • Disassembly now marks branches that will NOT be taken with a ✘ marker via emulation.
   • Adds initial support for the IBM s390x architecture.

   +7 more show less

   • Adds Capstone disassembler support and heap (TLS) support for LoongArch64.
   • Adds Cortex-M exception return address resolution and context handling.
   • Exposes additional x64 registers for QEMU-system kernel debugging.
   • Improved slab command output and handling for kernel slab allocator inspection.
   • Supports stack variable lookup in IDA integration via $ida("var_name").
   • Upgraded Capstone to version 6, enabling new architecture and disassembly improvements.
   • One-liner portable install now available for Linux and macOS (both GDB and LLDB variants).

   12 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Passthrough for shell commands has been removed due to stability and security concerns.
8. 2025.04.18 Apr 19, 2025 · release notes

   pwndbg adds libcinfo command, breakpoint markers in disasm, improved tls/attachp commands, and LoongArch64/Apple Silicon portable builds.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2025.04.18 https://github.com/pwndbg/pwndbg.git
   # already have the repo? check out this version:
   $ git checkout 2025.04.18

   └──▷ TRY IT
   Quickly identify the glibc version of a running target to pick the right heap-exploit primitives.
   copy

   $ libcinfo

   Inspect thread-local storage in full detail when debugging TLS-aware exploits.
   copy

   $ tls -a

   Attach precisely to the process whose name matches the loaded binary, avoiding ambiguous multi-process matches.
   copy

   $ attachp --exact

   • New libcinfo command displays the glibc version used by the debugged program and links to its source.
   • Context disasm panel now marks user-set breakpoints inline (shown as b+ by default).
   • The tls command now renders thread-local storage as a structured tcbhead_t view; new -a flag shows full output.
   • The attachp command defaults to attaching to a process matching the currently loaded binary's name; new --exact flag enables precise process matching.
   • Adds portable GDB and LLDB builds for LoongArch64 Linux (*_loongarch64-portable.tar.xz).

   +4 more show less

   • Adds native GDB portable build for Apple Silicon macOS (remote ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. debugging only).
   • LLDB now supports Ctrl+C cancellation of long-running operations.
   • LLDB gains programmatic debugger controls, usable as an API for scripting and tests.
   • Backward-compatibility aliases added so old underscore-style command names (e.g., heap_config) inform users of the new dash-style equivalents.

   9 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !All pwndbg command names now use dashes instead of underscores (e.g., heap-config instead of heap_config); scripts or keybindings using the old underscore names will need updating.
   • !The config parameter telescope-skip-repeating-val-minimum has been renamed to telescope-skip-repeating-val-min; any saved config using the old name will no longer apply.
9. 2025.04.13 Apr 16, 2025 · release notes

   pwndbg 2025.04.13 adds breakpoint markers in disasm view, new libcinfo command, enhanced tls/attachp, and LoongArch64+Apple Silicon builds.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2025.04.13 https://github.com/pwndbg/pwndbg.git
   # already have the repo? check out this version:
   $ git checkout 2025.04.13

   └──▷ TRY IT
   Quickly identify the glibc version of a running target to look up gadgets or known heap behaviors.
   copy

   $ libcinfo

   Inspect all thread-local storage fields in full detail when diagnosing TLS-related vulnerabilities.
   copy

   $ tls -a

   Attach to the process whose name matches the loaded binary, using exact matching to avoid ambiguous hits.
   copy

   $ attachp --exact

   • Adds breakpoint markers in the context disasm panel, displayed as b+ next to breakpointed instructions.
   • New libcinfo command displays the glibc version used by the debugged program and links to its source.
   • Enhances tls command with a structured tcbhead_t view and a -a flag to show the full thread-local storage dump.
   • Improves attachp command: defaults to the process matching the currently loaded binary name and adds --exact for precise process matching.
   • Adds hexdump-limit-mb config to cap memory reads at 10 MB, preventing OOMOOMAn out-of-memory condition: a program requests more memory than the system or device can provide. The allocation fails or the operating system may stop the process. conditions during large dumps.

   +3 more show less

   • Ships first portable builds for LoongArch64 Linux (GDB and LLDB) and native Apple Silicon GDB (remote ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. debugging).
   • LLDB now supports CTRL+C cancellation of long-running operations and programmatic debugger controls via API.
   • Portable release bundles GDB upgraded from 15.2 to 16.2.

   8 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !All pwndbg command names now use dashes instead of underscores (e.g., heap-config instead of heap_config); scripts or aliases using underscore forms will break.
   • !The config parameter telescope-skip-repeating-val-minimum has been renamed to telescope-skip-repeating-val-min; existing config files referencing the old name will no longer apply the setting.
10. 2025.02.19 Feb 21, 2025 · release notes

    pwndbg 2025.02.19 adds Linux kernel nftables inspection commands, LoongArch64 support, and new cymbol/dumpargs capabilities.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2025.02.19 https://github.com/pwndbg/pwndbg.git
    # already have the repo? check out this version:
    $ git checkout 2025.02.19

    └──▷ TRY IT
    Dump all nftables internals on a live kernel to quickly map firewall rules during incident response.
    copy

    $ knft_dump

    Load struct definitions from a project header so cymbol can resolve custom types without a debug build.
    copy

    $ cymbol -f /path/to/structs.h

    • Adds eight new kernel nftables inspection commands: knft_dump, knft_list_tables, knft_list_chains, knft_list_rules, knft_list_exprs, knft_list_sets, knft_list_objects, and knft_list_flowtables.
    • Adds initial LoongArch64 architecture support, using native GDB/LLDB disassemblers in the disasm context section.
    • The cymbol command now accepts a -f header-filepath.h flag to load symbols directly from C header files.
    • The dumpargs command now displays formatted bit flags, currently supporting mmap flags.
    • IDA and Binary Ninja integration servers can now be configured via PWNDBG_IDA_SERVER_HOST, PWNDBG_IDA_SERVER_PORT, PWNDBG_BINJA_SERVER_HOST, and PWNDBG_BINJA_SERVER_PORT environment variables.

    +2 more show less

    • Adds GDB 16+ compatibility support.
    • LLDB gains fallback disassembly for architectures not supported by Capstone (e.g. LoongArch64), plus ported version and bugreport commands.

    7 details in Everything

11. 2025.01.20 Jan 20, 2025 · release notes

    Pwndbg 2025.01.20 adds LLDB support, macOS/Mach-O debugging, TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. layout, jemalloc inspection, and 8 new commands.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2025.01.20 https://github.com/pwndbg/pwndbg.git
    # already have the repo? check out this version:
    $ git checkout 2025.01.20

    └──▷ TRY IT
    Inspect jemalloc heap structures when exploiting a target that uses the jemalloc allocator.
    copy

    $ jemalloc_heap

    Redirect a process's file descriptor to a controlled file mid-session to intercept or inject I/O.
    copy

    $ hijack-fd 1 /tmp/capture.txt

    Profile a slow Pwndbg session to find which commands are causing the most overhead.
    copy

    $ profiler start
    continue
    profiler stop

    • Adds LLDB backend via a new debugger-agnostic library (aglib), bringing most Pwndbg functionality to LLDB alongside GDB.
    • Supports macOS (Intel & Apple Silicon) and Mach-O binary debugging via LLDB.
    • Adds GDB Text User Interface (TUI) layout with tui layout pwndbg and tui layout pwndbg_code.
    • Adds context history navigation with new contextprev and contextnext commands.
    • New gdt <addr> command dumps Global Descriptor Table entries from a given address.

    +11 more show less

    • New strings command searches memory for readable strings, similar to the strings CLI utility.
    • New jemalloc_heap, jemalloc_extent_info, and jemalloc_find_extent commands inspect jemalloc heap allocator structures.
    • New hijack-fd <fd> <newfile> command modifies a process file descriptor.
    • New kallsyms and klookup commands provide Linux kernel symbol table lookup helpers.
    • New profiler {start,stop} command benchmarks Pwndbg performance and identifies bottlenecks.
    • Improves embedded systems debugging with better vmmap detection and enhanced vmmap_add and vmmap_load commands.
    • The ropgadget command now scans all executable memory regions for gadgets.
    • context <section> gains --on|--off toggle to temporarily disable individual sub-sections.
    • plist gains --offset and --count options to limit the number of linked list elements printed.
    • Adds vmmap -C <N> <filter> to display N pages before and after a filtered vmmap entry.
    • Speeds up syntax highlighting via pygments and reduces Pwndbg startup time.

    16 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Python 3.8, Ubuntu 20.04, and Debian 11 are no longer supported.
12. 2024.08.29 Sep 9, 2024 · release notes

    Pwndbg 2024.08.29 adds Binary Ninja integration, Go debugging commands, glibc UAF tracking, assembly search, and richer disasm annotations.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2024.08.29 https://github.com/pwndbg/pwndbg.git
    # already have the repo? check out this version:
    $ git checkout 2024.08.29

    └──▷ TRY IT
    Find all ROP gadgets matching an assembly pattern and immediately set breakpoints on each — useful during exploit development to stop at specific instruction sequences.
    copy

    $ search --asmbp 'pop rdi; ret'

    Inspect the concrete type hidden inside a Go interface object at a known address, without needing debug symbols.
    copy

    $ go-dump any 0x00c0000b4000

    Identify unmapped memory gaps in a process — helpful for spotting guard pages or finding injection targets.
    copy

    $ vmmap --gaps

    • Adds Binary Ninja integration to synchronize Binary Ninja view and symbols with Pwndbg.
    • Adds go-dump <type> <address> command to dump Go types (including interface objects via the any type).
    • Adds go-type <address> command to inspect Go type information.
    • Adds glibc heap UAF (use-after-free) tracking and detection.
    • Extends search with --asm <code> to find assembly instructions and --asmbp <code> to set breakpoints on matching instructions.

    +8 more show less

    • Adds vmmap --gaps to display unmapped memory gaps alongside mapped regions.
    • Disassembly view displays upcoming syscall details for syscall instructions.
    • Disasm banner now shows ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. mode (ARM vs Thumb).
    • Honors MIPSMIPSA RISC processor architecture originally developed at Stanford and commercialized by MIPS Technologies, widely used in embedded and network devices; cyber tools target it to analyze or exploit routers, cameras, and similar hardware. delay slots in the disassembly view.
    • Prompt is now colored green when the process is alive and red when it is dead.
    • WX memory is now underlined in memory maps (previously RWX was highlighted).
    • Adds commands to display Android Binder driver info (experimental).
    • Adds pcp command to print Linux kernel per-cpu page cache.

    13 details in Everything

13. 2024.02.14 Feb 18, 2024 · release notes

    Pwndbg adds track-got, stepuntilasm, break-if-taken, plist, mmap/mprotect commands and thread context display.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2024.02.14 https://github.com/pwndbg/pwndbg.git
    # already have the repo? check out this version:
    $ git checkout 2024.02.14

    • Adds track-got {enable,disable,info,query} command for GOT tracking
    • Adds $base(objfile_name) function to compute base address of memory pages
    • Context now displays threads information for multi-threaded programs (controlled by context-max-threads)
    • Adds stepuntilasm <asm> command to step until a matching instruction string is found
    • Adds break-if-taken <loc> and break-if-not-taken <loc> commands to set branch condition breakpoints

    +9 more show less

    • Adds plist ... command to print linked lists
    • Adds mmap ... and mprotect ... commands to invoke syscalls in the debugged program
    • Adds thread command to display threads information
    • Adds hi <address> command to check if an address belongs to a glibc heap chunk
    • Adds tips command to display usage tips
    • Adds sigreturn <address> command to print sigreturn x86-64 frame
    • Adds telescope --frame option to display stack frame information
    • Adds -A <N> and -B <N> flags to vmmap to show adjacent memory entries
    • Adds -i | --inverse flag to stack command to show reverse order

    14 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Drops support for Ubuntu 18.04 and Debian 10, requiring Python >= 3.8
    • !Drops support for GDB versions less than 9.2
14. 2023.07.17 Jul 17, 2023 · release notes

    New killthreads, slab contains, and spray commands; setup.sh uses venv by default

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2023.07.17 https://github.com/pwndbg/pwndbg.git
    # already have the repo? check out this version:
    $ git checkout 2023.07.17

    └──▷ TRY IT
    Kill specific threads by ID during debugging.
    copy

    $ (gdb) killthreads 1234 5678

    Inspect kernel heap slabs for a specific address.
    copy

    $ (gdb) slab contains 0xffffffff82040000

    Spray memory at a target address with specific data.
    copy

    $ (gdb) spray 0xdeadbeef b'AAAA'

    • Added killthreads [<ids...>] command to kill threads with given IDs
    • Added slab contains <addr> [<addrs...>] command to inspect Linux kernel heap (when debugging kernel)
    • Added spray <addr> ... command to spray memory with given values
    • The setup.sh script now installs Python dependencies in a virtual environment created at pwndbg/.venv/
    • gdbinit.py automatically uses the virtual environment created by setup.sh

    5 details in Everything

15. 2023.03.19 Mar 19, 2023 · release notes

    pwndbg 2023.03.19 adds kernel debugging commands (kbase, kchecksec, slab), an AI query command (ai), and Rizin support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2023.03.19 https://github.com/pwndbg/pwndbg.git
    # already have the repo? check out this version:
    $ git checkout 2023.03.19

    • Adds kbase, kchecksec, and slab kernel debugging commands to get the kernel base address, check kernel security settings, and list kernel slabs
    • Adds valist command to dump arguments of a va_list structure at a given address
    • Adds ai command to ask an AI about the current debugging session (requires OpenAI API key)
    • Adds support for Rizin as a backend
    • Adds riscv:rv64 architecture support

    +2 more show less

    • Adds --all-chunks flag to vis_heap_chunks to display all chunks
    • Enables instruction opcodes in the disasm context via GDB's set nearpc-num-opcode-bytes 9

    7 details in Everything

16. 2022.12.19 Dec 19, 2022 · release notes

    pwndbg 2022.12.19 adds kconfig, cymbol, patch, and ipi commands with configurable heap heuristics

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2022.12.19 https://github.com/pwndbg/pwndbg.git
    # already have the repo? check out this version:
    $ git checkout 2022.12.19

    └──▷ TRY IT
    Inject machine code into a running process for exploitation testing.
    copy

    $ (gdb) patch <address> '<shellcode_bytes>'

    Interact with the debugger programmatically using full Python syntax.
    python copy

    (gdb) ipi

    • Adds kconfig command to obtain the debugged Linux kernel config
    • Adds cymbol command to add, show, load, edit, or delete custom C structures
    • Adds patch command to patch memory
    • Adds ipi command to start an IPython interactive prompt
    • Adds support for setting heap resolution mode via set resolve-heap-via-heuristic when libc debug symbols are missing

    +1 more show less

    • Adds help set kernel-vmmap modes to control how vmmap info is fetched for QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. kernels

    6 details in Everything

17. 2022.08.30 Aug 30, 2022 · release notes

    Pwndbg 2022.08.30 adds attachp, setflag, telescope --reverse and heap debugging without symbols.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2022.08.30 https://github.com/pwndbg/pwndbg.git
    # already have the repo? check out this version:
    $ git checkout 2022.08.30

    └──▷ TRY IT
    Attach Pwndbg to a running process named vulnerable_app for live debugging
    copy

    $ attachp vulnerable_app

    Inspect memory locations preceding the current instruction pointer in telescope view
    copy

    $ telescope --reverse $pc

    • Adds attachp command to attach to a process by PID, name, or device file
    • Adds setflag command to set CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. flags register values
    • Adds --reverse flag to telescope command to view memory before a provided address
    • Adds heap_config command to configure heap command settings including symbol addresses
    • Introduces $heap_base variable available after running the heap command

    +1 more show less

    • Adds --trunc-out flag to search and nearpc commands to control output truncation

    6 details in Everything

18. 2022.01.05 Jan 5, 2022 · release notes

    Adds attachp and p2p commands with safe-linking support and VS Code devcontainer.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2022.01.05 https://github.com/pwndbg/pwndbg.git
    # already have the repo? check out this version:
    $ git checkout 2022.01.05

    └──▷ USE IT
    Attach pwndbg to a running chrome process by name for immediate debugging.
    shell copy

    attachp chrome

    Search for pointer chains starting from a specific address to trace heap structures.
    shell copy

    p2p <address>

    • Adds the attachp command to attach pwndbg to a running process by name or PID
    • Adds the p2p command for pointer chain search (P2P) via source code
    • Adds safe-linking support for heap analysis when debug symbols are loaded in glibc detection
    • Adds devcontainer.json configuration to allow direct development inside a Docker container from VS Code

    4 details in Everything

19. 2021.06.22 Jun 22, 2021 · release notes

    pwndbg 2021.06.22 adds telescope skipping, radare2/ghidra enhancements, i8086 support, and profile modules

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2021.06.22 https://github.com/pwndbg/pwndbg.git
    # already have the repo? check out this version:
    $ git checkout 2021.06.22

    • context-backtrace-lines config key to control the number of backtrace lines in the context view
    • start method now supports return offsets via return_offset argument
    • New i8086 architecture support for x86_16 debug sessions
    • Telescope command gains min_repeating_values config to skip short runs of repeated values
    • Telescope command gains skip_count_label option to add a label showing the number of skipped lines

    +1 more show less

    • pyprof2calltree profile module now accepts any valid location for the tool

    6 details in Everything

20. 2020.07.23 Jul 22, 2020 · release notes

    Adds mprotect command to inject and call the mprotect syscall from within pwndbg.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2020.07.23 https://github.com/pwndbg/pwndbg.git
    # already have the repo? check out this version:
    $ git checkout 2020.07.23

    • mprotect command injecting mprotect syscall
    • ctx-watch / ctx-unwatch context watches expressions

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !ctx-watch renamed to ctx-unwatch for unwatching expressions; use ctx-unwatch instead.
21. 2019.12.09 Dec 9, 2019 · release notes

    pwndbg 2019.12.09 adds leakfind and xuntil commands, QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. kernel vmmap support, and context output redirection

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2019.12.09 https://github.com/pwndbg/pwndbg.git
    # already have the repo? check out this version:
    $ git checkout 2019.12.09

    └──▷ TRY IT
    Run the new leak finding algorithm to identify potential memory corruption or leaks in your target process.
    copy

    $ leakfind

    Configure pwndbg to dump the current context pane output to a specific pseudo-terminal device for external logging or analysis.
    text copy

    set context-output /dev/pts/2

    Execute the target program until it reaches a specific memory address, useful for skipping to complex logic or function returns.
    copy

    $ xuntil 0x401234

    • Adds the leakfind command to automate finding memory leaks during debugging sessions
    • Adds the xuntil command to execute until a specified address or condition is reached
    • Adds vmmap QEMU kernel support for x86/x64/risc-v by parsing memory info mem output
    • Adds option to redirect context output to other tty or files via set context-output <path> configuration
    • Adds ctx alias for the context command to reduce typing overhead

    +3 more show less

    • Adds initial support for ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. Cortex-M baremetal debugging workflows
    • Adds __read_chk, __fread_chk and __pread_chk to recognized functions for improved heap analysis
    • Allows hexdump by module name using the existing vmmap syntax

    8 details in Everything

22. 2019.01.25 Jan 25, 2019 · release notes

    Adds bugreport command and PIE/r2 sync enhancements

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2019.01.25 https://github.com/pwndbg/pwndbg.git
    # already have the repo? check out this version:
    $ git checkout 2019.01.25

    └──▷ TRY IT
    Generate a diagnostic report for a debugging issue.
    copy

    $ bugreport

    View source code context with the file path included.
    copy

    $ context code

    • bugreport new subcommand added for generating diagnostics
    • r2 sync now supports PIE binaries
    • context code now displays the source file path

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !pwndbg will now check if added command overrides commands that were registered before launching pwndbg (from other plugins or built-in commands)
23. 2018.07.29 Jul 29, 2018 · release notes

    Adds breakrva, piebase, probeleak, stepret, stepsyscall, tcache, and vis_heap_chunks commands plus $rebase() expression function.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2018.07.29 https://github.com/pwndbg/pwndbg.git
    # already have the repo? check out this version:
    $ git checkout 2018.07.29

    └──▷ TRY IT
    Set a breakpoint at a specific offset from the binary base during PIE debugging.
    copy

    $ breakrva 0x123

    Create a dynamic breakpoint using the new rebase expression function.
    copy

    $ break *$rebase(some_address)

    Visualize heap chunks at a specific address to analyze memory corruption.
    copy

    $ vis_heap_chunks 0x602000

    • Add breakrva command to set a breakpoint at an offset relative to the base address of a given executable.
    • Add piebase command to rebase a given address for a specific executable.
    • Add probeleak command to scan for pointers within specified memory regions.
    • Add stepret command to step execution until a return instruction is hit.
    • Add stepsyscall command to step execution until a system call is entered.

    +5 more show less

    • Add tcache command providing support for ptmalloc's thread cache.
    • Add vis_heap_chunks command to visualize heap chunks at a specified address.
    • Add $rebase(address) expression function allowing rebase logic in breakpoints and other expressions.
    • Allow empty context configuration via the context-sections setting.
    • Add manual memory page manipulation via vmmap_add and vmmap_load commands for bare metal debugging.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !next_syscall is renamed to nextsyscall.
24. 2017.02.01 Feb 1, 2017 · release notes

    Pwndbg 2017.02.01 adds heap inspection commands and config saving

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2017.02.01 https://github.com/pwndbg/pwndbg.git
    # already have the repo? check out this version:
    $ git checkout 2017.02.01

    • Adds bins, fastbins, largebins, mp, smallbins, and unsortedbin commands for increased heap functionality
    • Adds configfile command to save settings to a file for ~/.gdbinit
    • Adds themefile command to save theme settings to a file for ~/.gdbinit

    3 details in Everything

25. 2016.09.22 Sep 22, 2016 · release notes

    Adds Cheat Engine style memory searching to pwndbg

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2016.09.22 https://github.com/pwndbg/pwndbg.git
    # already have the repo? check out this version:
    $ git checkout 2016.09.22

    • Add CheatEngine style searching

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removes input-radix and output-radix configuration options; defaulting to hexadecimal for both instead.