Quiz Entry - updated: 2026.07.14
How does GDB's x (examine) command format work for reading memory, such as a jump table?
x/NFU address — examine N items, in Format (x=hex, d=dec, i=instruction, s=string…), of Unit size (b/h/w/g = 1/2/4/8 bytes) — starting at address.
GDB's x is the Swiss-army knife for inspecting raw memory while reverse-engineering. The count, format, and unit are bundled into one slash-separated spec:
Format characters (F):
| Char | Meaning | Char | Meaning | |
|---|---|---|---|---|
| x | hexadecimal | t | binary | |
| d | signed decimal | i | instruction | |
| u | unsigned decimal | s | string | |
| o | octal |
Unit sizes (U):
| Char | Size |
|---|---|
| b | byte (1) |
| h | halfword (2) |
| w | word (4) |
| g | giant word (8) |
Examples:
(gdb) x/10xw 0x4000 # 10 hex words (4 bytes each)
(gdb) x/5i main # 5 instructions starting at main
(gdb) x/s 0x4005c8 # the string at that address
(gdb) x/7xg 0x4005c8 # 7 hex 8-byte values -> exactly a 7-entry jump table
Why x/7xg for a jump table: each x86_64 jump-table entry is an 8-byte (g) address, so reading 7 giant-words in hex dumps the table's targets — which you then match against the function's instruction addresses to decode which case goes where.
Go deeper:
GDB manual — the x (examine memory) command — the x command and its NFU format in the GDB manual.