longld/peda
Peda
Peda is a security tool suite and exploit development framework designed for binary analysis, debugger automation, and memory inspection. It functions as a set of Python scripts that extend a debugger to automate the analysis of compiled files and the inspection of process memory.
The project provides specialized utilities for memory corruption research, including a payload generation utility for creating cyclic patterns to discover buffer overflows and a gadget finder to locate return-oriented programming sequences within binaries. It differentiates itself by offering a visualization tool that transforms raw register, disassembly, and memory data into color-coded text to simplify the analysis of CPU states.
The framework covers a broad range of capabilities including binary security analysis to detect protections, regular-expression memory scanning, and the ability to map process environments directly from the system kernel. It also includes tools for modifying memory addresses and generating shellcode templates.
Features
- GDB Extensions - Integrates as a GDB extension to visualize CPU registers, disassembly, and memory state during execution.
- Cyclic Pattern Generators - Provides utilities to generate non-repeating cyclic patterns for determining buffer overflow offsets.
- ROP Chain Automators - Identifies and dumps ROP gadgets within binaries to build functional execution chains.
- Debugger Visualizations - Provides a visualization tool that transforms raw register, disassembly, and memory data into color-coded text for easier CPU state analysis.
- System State Visualizations - Transforms raw register and assembly data into color-coded visual representations for faster CPU state analysis.
- Binary Analysis Tools - Analyzes compiled files to detect security protections and extract binary header information.
- State Visualizations - Provides a color-coded visualization of disassembly, registers, and memory to simplify CPU state analysis.
- Debugger Extensions - Extends the GDB debugger with custom Python commands to automate binary analysis.
- Buffer Overflow Research - Provides tools for identifying memory offsets and manipulating process memory to test for overflow vulnerabilities.
- Exploit Frameworks - Provides a modular platform of GDB Python scripts for automating binary analysis and memory inspection.
- Exploit Payload Generators - Includes a utility for creating cyclic patterns to discover buffer overflow offsets and generating shellcode templates for exploit payloads.
- Runtime Memory Manipulation - Modifies memory addresses with custom data to alter the state of a running process.
- Instruction Gadget Discovery - Implements search utilities to identify instruction sequences (gadgets) within binaries for ROP chain construction.
- Exploit Payloads - Generates shellcode, Python exploit templates, and memory patterns to achieve code execution.
- Memory Scanning - Scans process memory ranges using regular expressions to locate specific data structures or exploit signatures.
- Binary File Inspectors - Examines compiled binaries to inspect symbols, sections, and security protections.
- Memory Mapping Interfaces - Retrieves virtual memory mapping ranges and protection flags directly from the system kernel.
- Process Memory Scanners - Locates specific byte patterns, addresses, or regex matches within the memory space of a running process.
- Binary Pattern Searching - Searches process memory using regular expressions and allows modification of memory addresses.
- Process State Inspection - Retrieves and displays metadata and mapping ranges for active processes from the system kernel.
- बाइनरी विश्लेषण उपकरण - Python-based exploit development assistance for GDB.
- Exploit Development - Assistance tool for exploit development within GDB.
- GDB Enhancements - Python-based exploit development assistance for GDB.
- Reverse Engineering - GDB plugin for exploit development.
- Security Tools - Python Exploit Development Assistance for GDB.
