GEF (GDB Enhanced Features) is a production-grade GDB plugin for exploit development, reverse engineering, and binary analysis. It is a single Python script (gef.py) that loads into GDB (>=10.0) and provides over 90 commands covering memory inspection, heap analysis, security mitigation checks (checksec), pattern generation, format string detection, and remote debugging. The architecture is monolithic but well-organized, with a clear separation of concerns via class hierarchies for architectures, memory regions, heap structures, and command registration. The test suite is extensive, using a Docker-based CI matrix that runs on multiple architectures (x86, ARM, AARCH64, etc.) and validates behaviour through RPyC-driven remote GDB sessions. While primarily an application, it also serves as a research tool for heap allocator internals and glibc version-specific behaviour, blending practical utility with deep system understanding.
Core Analyzer is a production-grade memory debugging tool that integrates with GDB (as a plugin) and WinDbg (as an extension) to provide deep heap introspection, object reference tracking, and memory corruption detection for core dumps and live processes. It supports multiple heap allocators (glibc ptmalloc, tcmalloc, jemalloc, mimalloc, Windows CRT, Darwin malloc) by parsing their internal metadata structures directly from target memory. The tool offers commands to walk heap blocks, search for pointer references across registers/stack/globals/heap, detect C++ objects via vtables, find shared objects across threads (race condition candidates), and annotate disassembly with object context. The architecture is a plugin system where each allocator registers a `CoreAnalyzerHeapInterface` struct, and the core engine provides segment management, binary-search-accelerated block lookup, and bit-vector-optimized memory scanning. The codebase is heavily coupled to debugger internals (GDB C API, WinDbg COM) and maintains separate source copies for multiple GDB versions (9.2, 12.1, 16.3, 17.1), which increases maintenance burden but ensures compatibility. The project includes a comprehensive test suite using Docker containers across Linux distributions and allocator versions.