LOGBOOK

HELP

Quiz Entry - updated: 2026.07.14

How does GDB's x (examine) command format work for reading memory, such as a jump table?

x/NFU address — examine N items, in Format (x=hex, d=dec, i=instruction, s=string…), of Unit size (b/h/w/g = 1/2/4/8 bytes) — starting at address.

GDB's x is the Swiss-army knife for inspecting raw memory while reverse-engineering. The count, format, and unit are bundled into one slash-separated spec:

Format characters (F):

Char Meaning Char Meaning
x hexadecimal t binary
d signed decimal i instruction
u unsigned decimal s string
o octal

Unit sizes (U):

Char Size
b byte (1)
h halfword (2)
w word (4)
g giant word (8)

Examples:

(gdb) x/10xw 0x4000     # 10 hex words (4 bytes each)
(gdb) x/5i  main        # 5 instructions starting at main
(gdb) x/s   0x4005c8    # the string at that address
(gdb) x/7xg 0x4005c8    # 7 hex 8-byte values -> exactly a 7-entry jump table

Why x/7xg for a jump table: each x86_64 jump-table entry is an 8-byte (g) address, so reading 7 giant-words in hex dumps the table's targets — which you then match against the function's instruction addresses to decode which case goes where.

Go deeper:

From Quiz: REVE1 / Translation of C to Assembly | Updated: Jul 14, 2026