Here are some tools for general evaluation of targets:
file --keep-going
Decodify auto-decodes strings using various methods
Several techniques exist to prevent dynamic analysis. This section needs more info on that.
/proc/self/statusDoes strace appear to show a different execution than the normal one? If the program reads /proc/self/status, that's probably why. TracerPid in there is non-zero if any debugger is connected:
$ grep TracerPid /proc/self/status
TracerPid: 0
$ strace grep TracerPid /proc/self/status
TracerPid: 6553Tell me more (see article 19:04)
Instruction encodings may have some undefined/reserved bits. If these are garbled, the program may still be valid, but your disassembler might choke.
It can pay off, during bigger challenges, to write robust tools.
pwnlib has excellent i/o facilities, on top of all the exploit development goodies. pwndbg makes GDB a lot friendlier.
It's surprisingly easy to implement your own GDB commands using the python API:
If you know what a binary is up to, you can set breakpoints at well-chosen locations and use a GDB script to pretty-print program state.
Snippets of ghidra-python API reference
Windows PE can have a windows portion and a DOS portion in the same .exe. Usually the DOS part just prints a helpful message, but nothing prevents a narnia door to another world... Rusty from justCTF2020 is an example of this in the wild.
Macintosh apps can be both Intel and PPC (and presumably ARM now).
There are a few mechanisms to run code before main() gets invoked. Look for _init_array (called by __libc_start_main) and the even sneakier _preinit_array (invoked by the loader). Try LD_DEBUG=all to see what ld is up to.
JAR is zip and zip can be combined with all kinds of stuff.
Polyfile can help map out files like this. Beware zip bombs, PDF bombs and the like, they can make output explode.
Mitra can generate 2-polyglots between a large number of formats
Apparently it's pretty common to mess with the byte-to-opcode mapping of Python and then embed your custom interpreter.
Detect it Easy shows all kinds of info about binaries.
xvolkolak emulates the processor to safely let the binary unpack itself.
file can identify UPX packing, and the tool can also unpack.
Helpful list of DOS/Windows packers.
PEiD can identify several DOS/Windows packers.
bytepointer has a bunch of small utilities
Last updated
import os
class MyCMD (gdb.Command):
"""Implements the run_my_stuff command, which will be available at the gdb prompt"""
def __init__(self):
super(MyCMD, self).__init__("run_my_stuff", gdb.COMMAND_USER)
def invoke(self, arg, from_tty):
gdb.execute("info breakpoints")
rax = gdb.parse_and_eval("$rax")
MyCMD()