ELF, PE and Mach-O binary analyzer
Parse headers, sections, imports, and symbols from Linux, Windows, and macOS binaries, with C++ symbol demangling and gadget discovery.
Open in ctfpalBefore disassembling anything, read the headers. They tell you the architecture, whether the binary is stripped, which protections are on, and which libraries it calls - and those four facts determine the entire approach to the challenge.
The protections decide the exploit
| Protection | If enabled | If disabled |
|---|---|---|
| NX | No shellcode on the stack - use ROP | Shellcode works |
| PIE | Addresses randomised - you need a leak | Fixed addresses, straightforward |
| Canary | Overflow is detected - leak or overwrite it | Overwrite the return address directly |
| RELRO (full) | GOT is read-only - no GOT overwrite | GOT overwrite available |
checksec prints, and the same decisions it drives.Imports name the vulnerability
The import table is a summary of what the program can do. gets means an unavoidable overflow. system present in a binary that never appears to call it means a ret2libc is intended. printf called with a user-controlled first argument is a format string bug. Reading the imports before the disassembly saves a great deal of time.
Part of a module
10. Binary exploitation
Read a binary’s protections, find an overflow offset in one crash, and build a ROP chain when the stack is not executable.
Practise on real challenges
Go deeper
- From crash to shell: stack overflows, offsets, ret2win, and ret2libcA segfault is not an exploit. The path from an unexpected crash to a controlled instruction pointer to a shell, with the mitigation checks that decide which technique you need and the stack-alignment detail that breaks working exploits.
Related tools
ROP gadget finder
Search a binary for return-oriented programming gadgets, filter by the registers they touch, and exclude ones containing bad bytes.
Strings extractor for binaries and blobs
Pull printable ASCII and UTF-16 strings out of any file, filtered by length, with flag-pattern highlighting.
WebAssembly disassembler
Convert a .wasm module to readable WAT, list exports and imports, and follow the control flow.
Pwntools exploit script generator
Generate a working pwntools template with the right context, process or remote connection, and the boilerplate every exploit repeats.