binary-analysis

Binary Analysis Skill

Quick Workflow

Progress:
- [ ] Run checksec (identify protections)
- [ ] Identify binary type and dangerous functions
- [ ] Find vulnerability (BOF/format string/heap)
- [ ] Calculate offsets
- [ ] Develop exploit with pwntools
- [ ] Test locally, then remote

Quick Analysis Pipeline

# 1. File identification
file <binary>

2. Security features

checksec --file=

3. Interesting strings

strings | grep -iE "flag|ctf|password|correct|wrong|win|shell|secret"

4. Function symbols

nm 2>/dev/null | grep -E " T | t " | head -20

5. Dangerous functions

objdump -d 2>/dev/null | grep -E "gets|strcpy|sprintf|scanf|system|exec"

6. Auto vulnerability scan

cwe_checker

## Reference Files

| Topic | Reference |
|-------|-----------|
| Protections & Vuln Detection | [reference/protections.md](reference/protections.md) |
| Exploitation Templates | [reference/exploits.md](reference/exploits.md) |
| Advanced Tools | [reference/tools.md](reference/tools.md) |

## Quick Commands

```bash
# Generate cyclic pattern
python3 -c "from pwn import *; print(cyclic(200))"

# Find offset
python3 -c "from pwn import *; print(cyclic_find(0x61616167))"

# Find ROP gadgets
ROPgadget --binary <binary> | grep "pop rdi"

# Find one_gadget
one_gadget <libc>

Tools Summary

Tool	Purpose
checksec	Check binary protections
pwntools	Exploit development
ROPgadget	Find ROP gadgets
one_gadget	Find libc one-shot gadgets
cwe_checker	Auto vuln detection
qira	Runtime analysis
Triton	Symbolic execution