longld/peda
Peda
Peda ist eine Sicherheits-Tool-Suite und ein Exploit-Development-Framework für Binäranalyse, Debugger-Automatisierung und Speicherinspektion. Es fungiert als eine Reihe von Python-Skripten, die einen Debugger erweitern, um die Analyse kompilierter Dateien und die Inspektion des Prozessspeichers zu automatisieren.
Das Projekt bietet spezialisierte Dienstprogramme für die Forschung zu Speicherfehlern, einschließlich eines Payload-Generators zur Erstellung zyklischer Muster, um Pufferüberläufe zu entdecken, sowie eines Gadget-Finders, um Return-Oriented-Programming-Sequenzen (ROP) innerhalb von Binärdateien zu lokalisieren. Es unterscheidet sich durch ein Visualisierungstool, das rohe Register-, Disassembly- und Speicherdaten in farbcodierten Text umwandelt, um die Analyse von CPU-Zuständen zu vereinfachen.
Das Framework deckt ein breites Spektrum an Funktionen ab, einschließlich binärer Sicherheitsanalyse zur Erkennung von Schutzmechanismen, regulärer Speicherscans und der Fähigkeit, Prozessumgebungen direkt aus dem System-Kernel abzubilden. Es enthält zudem Tools zur Modifikation von Speicheradressen und zur Generierung von Shellcode-Vorlagen.
Features
- GDB Extensions - Integrates as a GDB extension to visualize CPU registers, disassembly, and memory state during execution.
- Cyclic Pattern Generators - Provides utilities to generate non-repeating cyclic patterns for determining buffer overflow offsets.
- ROP Chain Automators - Identifies and dumps ROP gadgets within binaries to build functional execution chains.
- Debugger Visualizations - Provides a visualization tool that transforms raw register, disassembly, and memory data into color-coded text for easier CPU state analysis.
- System State Visualizations - Transforms raw register and assembly data into color-coded visual representations for faster CPU state analysis.
- Binary Analysis Tools - Analyzes compiled files to detect security protections and extract binary header information.
- State Visualizations - Provides a color-coded visualization of disassembly, registers, and memory to simplify CPU state analysis.
- Debugger Extensions - Extends the GDB debugger with custom Python commands to automate binary analysis.
- Buffer Overflow Research - Provides tools for identifying memory offsets and manipulating process memory to test for overflow vulnerabilities.
- Exploit Frameworks - Provides a modular platform of GDB Python scripts for automating binary analysis and memory inspection.
- Exploit Payload Generators - Includes a utility for creating cyclic patterns to discover buffer overflow offsets and generating shellcode templates for exploit payloads.
- Runtime Memory Manipulation - Modifies memory addresses with custom data to alter the state of a running process.
- Instruction Gadget Discovery - Implements search utilities to identify instruction sequences (gadgets) within binaries for ROP chain construction.
- Exploit Payloads - Generates shellcode, Python exploit templates, and memory patterns to achieve code execution.
- Memory Scanning - Scans process memory ranges using regular expressions to locate specific data structures or exploit signatures.
- Binary File Inspectors - Examines compiled binaries to inspect symbols, sections, and security protections.
- Memory Mapping Interfaces - Retrieves virtual memory mapping ranges and protection flags directly from the system kernel.
- Process Memory Scanners - Locates specific byte patterns, addresses, or regex matches within the memory space of a running process.
- Binary Pattern Searching - Searches process memory using regular expressions and allows modification of memory addresses.
- Process State Inspection - Retrieves and displays metadata and mapping ranges for active processes from the system kernel.
- Binäranalyse-Tools - Python-based exploit development assistance for GDB.
- Exploit Development - Assistance tool for exploit development within GDB.
- GDB Enhancements - Python-based exploit development assistance for GDB.
- Reverse Engineering - GDB plugin for exploit development.
- Security Tools - Python Exploit Development Assistance for GDB.
