> For the complete documentation index, see [llms.txt](https://ivalexev.gitbook.io/rednote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ivalexev.gitbook.io/rednote/pentesting-process/software-attacks/binary.md). # Binary {% tabs %} {% tab title="Resources" %} See my note on [Software Security](https://797548868-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhqLG4rHdEASJgZEcYdEJ%2Fuploads%2FygReuElFj1mWRa2qC8ri%2FSoftwareSecurity.pdf?alt=media\&token=51491027-f493-41ff-96f7-db319244f864).


Nightmare	Intro book to to binary exploitation / reverse engineering.
pwntools	Pwntools Cheatsheet
syscall_x64	Syscalls for x64
syscall_x86	Syscalls for x86
syscall_arm64	Syscalls for arm64
Decompiler Explorer	Compare tools on the forefront of static analysis in your web browser
GoReSym	Go symbol recovery tool

{% endtab %} {% tab title="Tools" %}


objdump	Display information from object files like ELF
ldd	Print shared object dependencies
gdb	Debugger
pwndbg	gdb but with more features
Libdebug	A Python library to debug binary executables
ROPgadget	Extract ROP gadget
dnSpy	.NET debugger and assembly editor.

{% endtab %} {% endtabs %} ## Binary Ninja

Keybindings


macOS	`~/Library/Application Support/Binary Ninja`
Linux	`~/.binaryninja`
Windows	`%APPDATA%\\Binary Ninja`

Create a `keybindings.json` file inside the directory and set my keybindings: {% code title="keybindings.json" overflow="wrap" %} ```json { "" : "", "" : "" } ``` {% endcode %}

Remote Dubugging

* Download [*debugger-linux.zip*](https://github.com/Vector35/debugger/releases/download/1.0/debugger-linux.zip) * Move on VM `lldbdebugger-linux/plugins/lldb` ### **Debug Server** On VM

lldb-server p --server --listen 0.0.0.0:31337

On Binary Ninja {% code overflow="wrap" %} ``` "Debugger" —> "Connect to Debug Server” Platform: remote-linux Host: Port: 31337 Reopen "Debugger" —> "Connect to Debug Server” Working Directory: # edit only this ``` {% endcode %} ### **Remote Process** On VM {% code overflow="wrap" %} ```bash ./lldb-server g 0.0.0.0:31337 -- ``` {% endcode %} {% code overflow="wrap" %} ```bash ./lldb-server g 0.0.0.0:31337 --attach ``` {% endcode %} On Binary Ninja {% code overflow="wrap" %} ``` "Debugger" —> "Remote Process Settings" Plugin: gdb-remote Host: Port: 31337 ``` {% endcode %}

## [GDB](https://sourceware.org/gdb/current/onlinedocs/gdb.html/index.html) To be expanded with [PEDA](https://github.com/longld/peda), [GEF](https://github.com/hugsy/gef) or [**PWNDBG**](https://github.com/pwndbg/pwndbg). ### Start


`gdb <ELF>`	Run gdb on that program. Be careful with addresses (it would be better to use PID).
`gdb --pid <PID>`	Run gdb on a process. Run the program in the background, get PID and provide it to gdb.
`gdb --args <ELF> <ARGs>`	Run gdb on that program passing it arguments.

### Execution


`file <ELF>`	Load the program to analyze
`set args <ARGs>`	Set the arguments to use on each bugger run.
`r`	Run
`r <ARGs>`	Run with arguments
`r ${python3 -c ‘print "\xBYTES"’}`	Run with byte arguments using Python
`r ${echo -e “\xBYTES”}`	run with byte arguments using Echo

### Breakpoints


`b <function>` `b *<address>`	Set a breakpoint. Also possible to do: `b *main+10`
`i b`	Info breakpoint
`enable <ID>`	Enable breakpoints. If no ID is specified, enable all breakpoints.
`disable <ID>`	Disable breakpoints. If no ID is specified, disable all breakpoints.
`d <ID>`	Delete breakpoint If no ID is specifyied, deletes all breakpoints.
`c`	Continue. Normal execution.
`s`	Step. IN function.
`n`	Next. NO IN function.
`finish`	Continue until the current function returns.
`k`	Kill. Stop the current execution.

### Visualization


`disassemble <FUNCTION>`	Get assembly and their memory addresses.
`i fu`	Get the list of program functions with their addresses.
`bt [full]`	Show backtrace (function calls list). With `full` print even the local variables of each frame, if you have access to them.
`i s`	Info Stack Frame.
`i f`	Info Current Stack Frame. (ex. $RIP in BOF)
`i r` `i all-r`	Info Registers.
`i dll`	list of used DLLs
`p/<F> <expr>`	Print what you want in the specified format `<F>`. ex. `p/x $esp` `p/x $esp+8` `p <FUN>` `p <VAR>`
`x/<N><F><U> <addr>`	Print and display memory only once. Specifies how many elements (`<N>`), in what format (`<F>`), and in what units (`<U>`) to display starting at address `<addr>`. ex. `x/40x $esp` `x/5i $pc` (next 5 instruction)
`display/<N><F><U> <addr>`	As x/ but are saved and printed/displayed at each step. `i display` `undisplay <ID>` `enable display <ID>` `disable display <ID>` If you don't put ID it applies to all. ex. `display/5i $pc` (next 5 instruction)

{% tabs %} {% tab title="Format" %} Format * `a` Pointer. * `c` Read as integer, print as character. * `d` Integer, signed decimal. * `f` Floating point number. * `o` Integer, print as octal. * `s` String. * `t` Integer, print as binary *(t = "two")*. * `u` Integer, unsigned decimal. * `x` Integer, print as hexadecimal. * `i` Disassembly. {% endtab %} {% tab title="Unit" %} Unit * `b` Byte * `h` Half-word (2 bytes) * `w` Word (4 bytes) * `g` Giant word (8 bytes) {% endtab %} {% tab title="Simbols" %} * `variable` Contents of a variable * `&variable` Address of a variable * `*address` Contents of an address {% endtab %} {% endtabs %} ### Edit memory


`set {type}address = value`	Change the value of the addresses. ex. `set{int}0x650000 = 0x42` `set{char[1]}0x650000 = 0x42`
`set variable = value`	Change the value of variables
`set $reg = value`	Change the value of the registers
`set *address = value`	Change the value of an address

### Utility


`call <FUNCTION>()`	Call function. ex. `call (void)win()`
`echo $((16#<NUM>))`	From bash convert hex to decimal.
`r << <CommandFile>`	It is possible to specify a file with the inputs that should be given to the program in read, scanf, etc. Like `cat <CommandFile> \| ./<ELF>`
`j *<EXPRESSION>`	Jump and force execution to a specific address (addr, $reg, function).

### pwndbg


`pwndbg [<TOPIC>]`	Print info about pwndbg commands
`vmmap`	Display memory mappings information
`context [<SECTION>]`	Display context or a given context section (regs, disasm, args, code, stack, backtrace, expressions, ghidra, threads)
`search <WHAT>`	Search memory for a given value
`telescope <WHERE> [<COUNT>]`	Examine memory dereferencing valid pointers
`hexdump <WHERE> [<COUNT>]`	Print hexdump of given address
`xinfo <WHERE>`	Show offsets of the specified address from various useful locations
`retaddr`	Print return addresses on the stack
`canary`	Print the global stack canary/cookie value and finds canaries on the stack
`xuntil`	Continue until an address or function
`nextcall`	Continue to next call instruction
`nextjmp`	Continue to next jump instruction
`nextret`	Continue to next return-like instruction
`stepret`	Step until a ret instruction is found
`checksec`	Print binary mitigations status
`piebase`	Print the relocated binary base address
`got`	Print symbols in the .got section
`gotplt`	Print symbols in the .got.plt section
`plt`	Print symbols in the .plt section
`tls`	Print thread local storage address
`distance <WHERE1> <WHERE2>`	Compute difference between two addresses
`procinfo`	Display process information
`heap_config`	Show glibc allocator hacking configuration
`heap`	Iteratively print chunks on heap (glibc only)
`vis_heap_chunks`	Visualize chunks on a heap
`try_free <ADDRESS>`	Check what would happen if free was called with given address

## [PwnTools](https://docs.pwntools.com/en/stable/) {% code overflow="wrap" %} ```bash checksec pwn checksec ``` {% endcode %} ### Context

Architecture context.arch = '<ARCH>'
'aarch64', 'arm', 'i386', 'amd64'

Log Output


Architecture	`context.arch = '<ARCH>'` `'aarch64'`, `'arm'`, `'i386'`, `'amd64'`
Log Output	`context.log_level = '<VALUE>'` `'debug'`, `'info'`, `'warn'`, `'error'`
Endianness	`context.endian = '<ENDIANNESS>'` `'big'`, `'little'`

context.log_level = '<VALUE>'

'debug', 'info', 'warn', 'error'

Endianness

context.endian = '<ENDIANNESS>'

'big', 'little'

### Start


ELF	`elf = ELF('<PATH_BINARY>')` `libc = ELF("./libc.so.6")`
Process	`p = process('<PATH_BINARY>')`
Remote	`p = remote('<IP/DOMAIN>', PORT)`
Hybrid	`elf = ELF('<PATH_BINARY>')` `p = elf.process()`

### Debugger


Debugger GDB	`p = gdb.debug('<PATH_BINARY>', aslr=False, gdbscript='b *main+123')`

### Encoding e Packing


Hex	`enhex(b'/flag')` ('2f666c6167') `unhex('2f666c6167')` (b'/flag')
Base64	`b64e(b'/flag')` ('L2ZsYWc=') `b64d('L2ZsYWc=')` (b'/flag')
Packing	`p32(0x41424344)` (b'\x44\x43\x42\x41') `p8`, `p16`, `p64`
Unpacking	`u32(b'\x44\x43\x42\x41')` (0x41424344) `u8`, `u16`, `u64`

### Address


Function address	`address = elf.sym['<Name_Function>']` `address = elf.symbols.<Name_Function>` `address = elf.plt[’<Name_Function>’]` (in PLT) `address = elf.got[’<Name_Function>’]` (in GOT)
String address	`address = next(elf.search(b'<STRING>'))` Or with ghidra in `.rodata`, `.text`

### Cyclic

Create Search String cyclic(16) (b'aaaabaaacaaadaaa')
cyclic(16, n=8) (b'aaaaaaaabaaaaaaa')

Find Offset


Create Search String	`cyclic(16)` (b'aaaabaaacaaadaaa') `cyclic(16, n=8)` (b'aaaaaaaabaaaaaaa')
Find Offset	`cyclic_find(0x61616164)` (12) `cyclic_find(0x6161616161616162, n=8)` (8) `cyclic_find(io.corefile.fault_addr, n=8)` (in BOF) In BOF use `setuid=False` in `p = process()`

cyclic_find(0x61616164) (12)
cyclic_find(0x6161616161616162, n=8) (8)

cyclic_find(io.corefile.fault_addr, n=8) (in BOF)
In BOF use setuid=False in p = process()

### Shellcode [Shellcraft](https://docs.pwntools.com/en/stable/shellcraft.html), must be NULL-free.


Assembly	`code = shellcraft.cat('/flag')` `code = shellcraft.amd64.linux.sh()`
Bytecode	`shellcode = asm(code)` (use the context architecture) `shellcode = asm(code, arch='x86_64')`

### [ROP](https://docs.pwntools.com/en/stable/rop/rop.html)


Start	`rop = ROP(elf)` `rop = ROP(elf, badchars=b'\n')` (char not to be used in the chain) `rop = ROP([elf, libc])` (specify double elf)
Extract Gadget	`pop_ = rop.find_gadget(['pop <REG>', 'ret']).address` `pop_ = rop.<REG>.address` or ROPgadget.
ROP chain	`rop.call(<ADDR_FUNCTION>, [<ADDR_ARG1>, ... ])` `rop.puts(); rop.main()` (adds puts and main to the chain) `rop.chain()` (builds the chain with the elements called before) `rop.dump()` (text representation, to be put in `log.info(X)`) `rop.clear()` (clears the rop chain) `rop.execve(next(libc.search(b'/bin/sh\0')), 0, 0)` (calls execv with parameters)
Set Base Address (ex. libc)	`libc = ELF(<PATH_LIBC>)` (ex ./glibc/libc.so.6) `libc.address = <INT_ADDRESS_BASE>` `rop_libc = ROP(libc)` (after set base libc)

### Format String {% tabs %} {% tab title="Format" %}


`%p`	Pointer
`%s`	String
`%d`	Int
`%x`	Hex
`%c`	Char
`%n`	Writes the number of characters printed in the specified pointer. `%n` = int (8 byte) `%hn` = short (4 byte) `%hhn` = byte (1 byte)
`%<P>x`	Specifies the precision <P> (filled with 0)
`%<N>$x`	Take the <N>-th argument

{% endtab %} {% tab title="Read" %} Find the buffer in which you are writing with `%$x` where `N` increments.\ When you reach the buffer take note of `N` which will be the `OFFSET` {% code overflow="wrap" %} ``` %$x ``` {% endcode %} {% endtab %} {% tab title="Write" %} Find the buffer in which you are writing with `%$x` where `N` increments.\ When you reach the buffer take note of `N` which will be the `OFFSET` \ `VAL` is the value that you want to write. {% code overflow="wrap" %} ``` %c%$n ``` {% endcode %} {% code overflow="wrap" %} ``` %c%$n BUT for every 8 characters you insert, increase the offset by 1 ``` {% endcode %} {% endtab %} {% endtabs %}


fmtstr_payload	`fmtstr_payload(offset, writes, numbwritten=0, write_size='byte')` `offset`: Offset to the buffer `writes`: Dictionary with address:value `{addr: value, addr2: value2, etc.}` `numbwritten`: Number of bytes already written by printf() ex. `printf(hello <VAR>)` = 6 `write_size`: The write size: byte, short or int (hhn, hn or n) Note: Set the right `<ARCH>`

fmtstr_payload

fmtstr_payload(offset, writes, numbwritten=0, write_size='byte')

offset: Offset to the buffer
writes: Dictionary with address:value
{addr: value, addr2: value2, etc.}
numbwritten: Number of bytes already written by printf()
ex. printf(hello <VAR>) = 6
write_size: The write size: byte, short or int (hhn, hn or n)

Note: Set the right <ARCH>

## [ANGR](https://angr.io/)

Code

{% code overflow="wrap" %} ```python import angr import claripy import sys FILE = './' FLAG_LENGTH = 30 FLAG_KNOW = 'FLAG{' FIND_ADDR = 0x1def AVOID_ADDR = 0x1df8 # Define program project = angr.Project(FILE, main_opts={"base_addr": 0x0}) # auto_load_libs=False # Define the initial state simply OPTION_NO_ERROR = {angr.options.ZERO_FILL_UNCONSTRAINED_MEMORY, angr.options.ZERO_FILL_UNCONSTRAINED_REGISTERS} initial_state = project.factory.entry_state(add_options = OPTION_NO_ERROR) # ---------------- OR ---------------- # OPTIONAL: Define variable format # known_chars = [claripy.BVV(FLAG_KNOW[i]) for i in range(len(FLAG_KNOW))] # flag_chars = [claripy.BVS(f"flag_{i}",8) for i in range(FLAG_LENGTH-len(FLAG_KNOW))] # flag_input = claripy.Concat(*known_chars+flag_chars) # OPTIONAL: Define how to make the input # Define initial state with interactive input # initial_state = project.factory.entry_state(stdin=flag_input, add_options = OPTION_NO_ERROR) # Define initial state with input from argument # initial_state = project.factory.entry_state(args=[FILE, flag_input], add_options = OPTION_NO_ERROR) # ------------------------------------ # Create a simulator with the initial state simgr = project.factory.simulation_manager(initial_state) # Start the exploration of the program path simgr.explore(find=FIND_ADDR, avoid=AVOID_ADDR) # If Angr finds a path that meets the success criterion. if simgr.found: # Extract the input that led to the path to success flag_solution = simgr.found[0].posix.dumps(0) print("Flag found:", flag_solution.decode()) else: print("No flag found.") # ---------------- OR ---------------- # If there are multiple inputs # if simgr.found: # print("[+] Input:") # for state in simgr.found: # solution = state.posix.dumps(0) # print(solution.decode()) # else: # print("No solution found.") # ------------------------------------ ``` {% endcode %}