longld/peda
Peda
Peda is a security tool suite and exploit development framework designed for binary analysis, debugger automation, and memory inspection. It functions as a set of Python scripts that extend a debugger to automate the analysis of compiled files and the inspection of process memory.
The project provides specialized utilities for memory corruption research, including a payload generation utility for creating cyclic patterns to discover buffer overflows and a gadget finder to locate return-oriented programming sequences within binaries. It differentiates itself by offering a visualization tool that transforms raw register, disassembly, and memory data into color-coded text to simplify the analysis of CPU states.
The framework covers a broad range of capabilities including binary security analysis to detect protections, regular-expression memory scanning, and the ability to map process environments directly from the system kernel. It also includes tools for modifying memory addresses and generating shellcode templates.
Features
- GDB Extensions - Integrates as a GDB extension to visualize CPU registers, disassembly, and memory state during execution.
- Cyclic Pattern Generators - Provides utilities to generate non-repeating cyclic patterns for determining buffer overflow offsets.
- ROP Chain Automators - Identifies and dumps ROP gadgets within binaries to build functional execution chains.
- Debugger Visualizations - Provides a visualization tool that transforms raw register, disassembly, and memory data into color-coded text for easier CPU state analysis.
- System State Visualizations - Transforms raw register and assembly data into color-coded visual representations for faster CPU state analysis.
- Binary Analysis Tools - Analyzes compiled files to detect security protections and extract binary header information.
- State Visualizations - Provides a color-coded visualization of disassembly, registers, and memory to simplify CPU state analysis.
- Debugger Extensions - Extends the GDB debugger with custom Python commands to automate binary analysis.
- Buffer Overflow Research - Provides tools for identifying memory offsets and manipulating process memory to test for overflow vulnerabilities.
- Exploit Frameworks - Provides a modular platform of GDB Python scripts for automating binary analysis and memory inspection.
- Exploit Payload Generators - Includes a utility for creating cyclic patterns to discover buffer overflow offsets and generating shellcode templates for exploit payloads.
- Runtime Memory Manipulation - Modifies memory addresses with custom data to alter the state of a running process.
- Instruction Gadget Discovery - Implements search utilities to identify instruction sequences (gadgets) within binaries for ROP chain construction.
- Exploit Payloads - Generates shellcode, Python exploit templates, and memory patterns to achieve code execution.
- Memory Scanning - Scans process memory ranges using regular expressions to locate specific data structures or exploit signatures.
- Binary File Inspectors - Examines compiled binaries to inspect symbols, sections, and security protections.
- Memory Mapping Interfaces - Retrieves virtual memory mapping ranges and protection flags directly from the system kernel.
- Process Memory Scanners - Locates specific byte patterns, addresses, or regex matches within the memory space of a running process.
- Binary Pattern Searching - Searches process memory using regular expressions and allows modification of memory addresses.
- Process State Inspection - Retrieves and displays metadata and mapping ranges for active processes from the system kernel.
- Binary Analysis Tools - Python-based exploit development assistance for GDB.
- Exploit Development - Assistance tool for exploit development within GDB.
- GDB Enhancements - Python-based exploit development assistance for GDB.
- Reverse Engineering - GDB plugin for exploit development.
- Security Tools - Python Exploit Development Assistance for GDB.
Star history
How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
