| Action | Command | Description | |
|---|---|---|---|
| Set register | set $rax = 1 | Directly modify a register value | |
| Set memory (value) | set {int}0x404000 = 1337 | Write value to memory address | |
| Set memory (byte) | set {char}0x404000 = 0x90 | Write single byte (useful for patching / NOPs) | |
| Set instruction (opcode) | set {unsigned char}($rip) = 0x90 | Patch instruction at current RIP | |
| Set multiple bytes | set {char[3]}0x401000 = {0x90,0x90,0x90} | Patch sequence (NOP sled etc.) | |
| Redirect execution | set $rip = 0x401000 | Jump execution to arbitrary address | |
| Force return value | set $rax = 0 | Control function return result | |
| Skip instruction | set $rip += 2 | Skip current instruction (size-dependent!) | |
| Modify stack | set {long}$rsp = 0xdeadbeef | Overwrite stack content | |
| Fake argument | set $rdi = 0x404000 | Change function argument (SysV ABI) | |
| Force syscall number | set $rax = 59 | Change syscall (e.g. execve) | |
| Modify flags | `set $eflags | = 0x40` | Set Zero Flag (ZF = 1) |
| Clear flags | set $eflags &= ~0x40 | Clear Zero Flag | |
| Force condition (ZF=1) | `set $eflags | = (1 << 6)` | Make jz always taken |
| Force condition (ZF=0) | set $eflags &= ~(1 << 6) | Make jnz always taken | |
| Inject syscall | Patch + syscall opcode | Manually execute syscalls via RIP patching | |
| Overwrite string | set {char[8]}0x404000 = "/bin/sh" | Inject strings into memory | |
| Continue execution | continue / c | Resume execution | |
| Step instruction | si | Step one instruction | |
| Step over | ni | Step over calls | |
| Breakpoint | b *0x401000 | Set breakpoint at address | |
| Delete breakpoint | del | Remove breakpoints |
BLUE TEAM / MALWARE REVERSE / ANALYSIS / STATIC / DISASSEMBLY / ASM