Binary Analysis Skill

Quick Workflow

Progress:
- [ ] Run checksec (identify protections)
- [ ] Identify binary type and dangerous functions
- [ ] Find vulnerability (BOF/format string/heap)
- [ ] Calculate offsets
- [ ] Develop exploit with pwntools
- [ ] Test locally, then remote

Quick Analysis Pipeline

# 1. File identification
file <binary>

# 2. Security features
checksec --file=<binary>

# 3. Interesting strings
strings <binary> | grep -iE "flag|ctf|password|correct|wrong|win|shell|secret"

# 4. Function symbols
nm <binary> 2>/dev/null | grep -E " T | t " | head -20

# 5. Dangerous functions
objdump -d <binary> 2>/dev/null | grep -E "gets|strcpy|sprintf|scanf|system|exec"

# 6. Auto vulnerability scan
cwe_checker <binary>

Reference Files

Topic	Reference
Protections & Vuln Detection	reference/protections.md
Exploitation Templates	reference/exploits.md
Advanced Tools	reference/tools.md

Quick Commands

# Generate cyclic pattern
python3 -c "from pwn import *; print(cyclic(200))"

# Find offset
python3 -c "from pwn import *; print(cyclic_find(0x61616167))"

# Find ROP gadgets
ROPgadget --binary <binary> | grep "pop rdi"

# Find one_gadget
one_gadget <libc>

Tools Summary

Tool	Purpose
checksec	Check binary protections
pwntools	Exploit development
ROPgadget	Find ROP gadgets
one_gadget	Find libc one-shot gadgets
cwe_checker	Auto vuln detection
qira	Runtime analysis
Triton	Symbolic execution