pwndbg

This release brings support for m68k architecture and unknown architectures, better C++ symbols, expression support and guides (debugging C++, symbol mangling, pretty printing), nearpc -o showing opcode bytes, Android Bionic detection and libc information, Objective-C class inspection (objc show-class and objc list-classes), better glibc heap discovery, Linux kernel 7.0 SLUB sheaf and barn inspection, a new setrlimit command to set debugee' resource limits, displaying SIMD registers with regs command and more!

Screenshots and details below. Thanks to everyone who contributed!

Please sponsor us at Pwndbg so we can keep improving it! -- We can give you a talk about Pwndbg too!

---

Quick install

Install Pwndbg portable on Linux or macOS (choose one line for GDB or LLDB):

curl --proto '=https' --tlsv1.2 -LsSf 'https://install.pwndbg.re' | sh -s -- -t pwndbg-gdb
curl --proto '=https' --tlsv1.2 -LsSf 'https://install.pwndbg.re' | sh -s -- -t pwndbg-lldb

Homebrew package (macOS only; choose one line for GDB or LLDB):

brew install pwndbg/tap/pwndbg-gdb  # only allows for remote debugging of ELFs
brew install pwndbg/tap/pwndbg-lldb

Nix package manager (Linux/macOS; choose one line for GDB or LLDB):

nix shell github:pwndbg/pwndbg  # this is pwndbg-gdb
nix shell github:pwndbg/pwndbg#pwndbg-lldb

Other options:

• For distro and architecture packages, see the setup docs and the release assets below.
• For the latest development version, install from source.

---

What's changed

Architectures

Added m68k support including disassembly via Capstone and emulation of code via Unicorn engine. This includes branch target resolution and instruction annotations (#4225)

Pwndbg also no longer refuses to start on architectures it does not explicitly support. It falls back to the underlying debugger's disassembler, with reduced context functionality and no emulation (#4226).

Nearpc changes and regs

The nearpc --opcode (or -o) now shows opcode bytes to fit the longest instruction in the listing, or nearpc -o 4 for a fixed four-byte column. This works per command, without changing nearpc-num-opcode-bytes (#4220).

The nearpc <start> <end> now disassembles up to an end address. Use -r 0 to omit the preceding instructions (#4176)

Branch visualization now colors the full branch path and avoids misleading connections between separate address regions (#4182, #4175)

Regs command changes

The regs command now decodes individual flags register flags (regs eflags; #4211) and can display SIMD registers, for example regs xmm0 (#4212).

Android Bionic libc support

Pwndbg now detects Bionic and resolves Android libc and loader mappings. It shows this with the libc (or libcinfo) command. This is a first step toward better Android debugging (#3988).

Heap & Linux Kernel Debugging

We improvec glibc heap discovery co

This release brings lots of disassembly improvements: backwards disassembly in context and nearpc, better indirect jumps display and nearpc -f|--function working without debugging symbols; new stack-vis command to visualize stack frames (similarly to vis-heap-chunks); emulation working with x64 kernels; v2p, p2v and pageinfo commands displaying full page info; LLDB and portable fixes; improved glibc 2.42-2.44 support and many other!

See below for screenshots and more info!

Also, please sponsor the project to let us keep improving!

Thanks to everyone who made this possible!

---

Quick install

Install Pwndbg portable on Linux or macOS (choose one line for GDB or LLDB):

curl --proto '=https' --tlsv1.2 -LsSf 'https://install.pwndbg.re' | sh -s -- -t pwndbg-gdb
curl --proto '=https' --tlsv1.2 -LsSf 'https://install.pwndbg.re' | sh -s -- -t pwndbg-lldb

Homebrew package (macOS only; choose one line for GDB or LLDB):

brew install pwndbg/tap/pwndbg-gdb  # only allows for remote debugging of ELFs
brew install pwndbg/tap/pwndbg-lldb

Nix package manager (Linux/macOS; choose one line for GDB or LLDB):

nix shell github:pwndbg/pwndbg  # this is pwndbg-gdb
nix shell github:pwndbg/pwndbg#pwndbg-lldb

Other options:

• Want specific distro and architecture package? Check out setup docs and download the specific asset below.
• Want latest development version? See install from source.

---

Dissasembly improvements

• Pwndbg can now disassemble backwards, which makes lifes easier in many ways (in context disasm it gives info on the stuff before $PC when stopping at a breakpoint or right after a syscall, and in nearpc you no longer need to guess addresses to go backwards)

• The nearpc -f|--function now works without debugging symbols. Finally, it now acts as a full replacement for GDB's/LLDB's disass command to disassemble a full function (is guaranteed to work in all cases the underlying command would work). Our disassembly adds all sorts of nice stuff (branch visualization, branch targets, showing strings and symbols of instruction operands, etc.)

• Indirect jumps are handled much better for x86 PLT. Return (ret etc.) instructions and memory-indirect jumps that can segfault are now also handled, visualizing segfaulting ROP chains.

• Emulation now works when debugging x64 kernels, so get more perks of our disassembly system (emulated flow of instructions, concrete instructions operands indicated)

New stack-vis command

The stack-vis command can now be used to visualize the stack frames of current thread in a similar fashion as vis-heap-chunks can be used for heap chunks (#3994)

Linux kernel debugging

• The v2p, p2v and pageinfo commands now display full page info (vaddr, paddr, and page) (#4057)

Others

• Set defauly debuginfod server timeouts (#4079)
• Fixed Glibc >= 2.42 tcache handling (#4133), glibc 2.44 refilling of AT_RANDOM (#4054), exithandlers command with glibc 2.44 (#4053), and tcache_max_bytes for glibc 2.42 (#4128)
• Bumped versions of LLDB to 23 and Capstone to 8.0.0 (#4071, #4094)
• Fixed multiple bugs and cr

This release brings: exithandlers command to inspect glibc exit handlers, Linux kernel task introspection without typeinfo (kstack, kseccomp, ksighand, knamespace), glibc 2.43 heap inspection improvements, heap tracker allocation call sites (track-heap --where), a much richer procinfo output (netlink info, socket or pipe peers), vmmap being cached on macOS, LLDB fixes and many other!

See below for screenshots and more info!

Also, please sponsor the project to let us keep improving!

Thanks to everyone who made this possible!

---

Quick install

Install Pwndbg portable on Linux or macOS (choose one line for GDB or LLDB):

curl --proto '=https' --tlsv1.2 -LsSf 'https://install.pwndbg.re' | sh -s -- -t pwndbg-gdb
curl --proto '=https' --tlsv1.2 -LsSf 'https://install.pwndbg.re' | sh -s -- -t pwndbg-lldb

Homebrew package (macOS only; choose one line for GDB or LLDB):

brew install pwndbg/tap/pwndbg-gdb  # only allows for remote debugging of ELFs
brew install pwndbg/tap/pwndbg-lldb

Nix package manager (Linux/macOS; choose one line for GDB or LLDB):

nix shell github:pwndbg/pwndbg  # this is pwndbg-gdb
nix shell github:pwndbg/pwndbg#pwndbg-lldb

Other options:

• Want specific distro and architecture package? Check out setup docs and download the specific asset below.
• Want latest development version? See install from source.

---

What's changed

Breaking Changes

• The mallocng-*, jemalloc-* and knft-* commands are now subcommands - use mallocng dump, mallocng vis, jemalloc heap, jemalloc extent-info, knft list-tables etc. instead of the old dash-separated names (#3750)
• cyclic output is now consistent with pwntools - the generated de Bruijn sequence matches pwn cyclic (#3801)
• Developer API: pwndbg.aglib.disasm.arch was renamed to pwndbg.aglib.disasm.assistant (#3919)

New: exithandlers

Added the exithandlers command (alias exitfuncs) - lists the currently registered glibc exit handlers by walking __exit_funcs and tls_dtor_list, demangling the PTR_MANGLEd function pointers and printing the pointer_guard cookie. Very handy when hijacking exit handlers during exploitation (#3973, alignment fixes in #3983)

Linux Kernel Debugging

Full support for debugging kernel tasks without typeinfo - along with four new commands to introspect any kernel task (#3647):

• kstack [pid] - display information about the stack of a task
• kseccomp [pid] - display seccomp information of a user task
• ksighand [pid] - display signal handlers of a task
• knamespace [pid] - display namespaces of a task

Other kernel improvements:

• Added the percpu GDB function - to resolve per-CPU variables from print/break expressions (#3950)
• Added v2p and p2v GDB function helpers - to convert between virtual and physical addresses inside expressions (#3842)
• Added support for breaking at the start of a JIT-compiled eBPF program (#3757)
• Page table scanning now reads /proc/pid/mem by default, which is much faster ([#3947](https://github

This is a hotfix release for the 2026.02.17 recent release.

This release brings A LOT: radare2-inspired branch visualization in nearpc disassembly, new decompiler integration (supporting IDA, Binary Ninja, Ghidra and angr), stack variable annotations from debug info, new kernel debugging commands: kmem-trace for tracing allocations, kcurrent/kfile/pagewalk to dump kernel tasks info or memory pages information; LLDB core file support, new compact register display modes and many fixes and improvements.

We also release:

• debuginfod client enabled by default in Pwndbg portable releases
• niche-elf, a fast library to build minimal ELFs with symbols, used in Pwndbg

The portable release also sets the DEBUGINFOD_URLS=debuginfod.pwndbg.re to a debuginfod server we developed which contains debug symbols from multiple different mainstream distros (ubuntu, centos, nix, debian, fedora, opensuse, systemtap, archlinux and others). We will open source the server soon.

Branch visualization showcase:

See What's changed below for more info. Big thanks to everyone who made this possible!

Also, please sponsor the project to let us keep improving!

---

Quick install

Install Pwndbg portable on Linux or macOS (choose one line for GDB or LLDB):

curl --proto '=https' --tlsv1.2 -LsSf 'https://install.pwndbg.re' | sh -s -- -t pwndbg-gdb
curl --proto '=https' --tlsv1.2 -LsSf 'https://install.pwndbg.re' | sh -s -- -t pwndbg-lldb

Homebrew package (macOS only; choose one line for GDB or LLDB):

brew install pwndbg/tap/pwndbg-gdb  # only allows for remote debugging of ELFs
brew install pwndbg/tap/pwndbg-lldb

Nix package manager (Linux/macOS; choose one line for GDB or LLDB):

nix shell github:pwndbg/pwndbg  # this is pwndbg-gdb
nix shell github:pwndbg/pwndbg#pwndbg-lldb

Other options:

• Want specific distro and architecture package? Check out setup docs and download the specific asset below.
• Want latest development version? See install from source.

---

What's changed

Breaking Changes

• Removed deprecated underscore command aliases (e.g. heap_config -> heap-config) (#3383)
• Replaced all pwndbg.aglib.regs["x"] bracket access with pwndbg.aglib.regs.read_reg("x") (#3440)
• Dropped ppc64 big-endian portable release (#3424)

Debuginfod Server

We developed and open-sourced our own debuginfod server and host it at debuginfod.pwndbg.re. It is now enabled by default in our gdb-for-pwndbg release and in portable releases. If you use your own system GDB, you can enable it manually by setting the DEBUGINFOD_URLS environment variable. This means debug symbols for system libraries are automatically fetched when available, making debugging significantly easier out of the box.

Disassembly

Branch visualization - visualize branch sources and targets in nearpc output using Unicode characters, inspired by radare2. Enabled by default, disable with -n | -no-branch flag (#3361) Disassemble entire function - nearpc -f <funcname> can now display all instructions of a function at once (#3736)

---