longld/peda
Peda
Peda este o suită de instrumente de securitate și un framework de dezvoltare a exploit-urilor conceput pentru analiză binară, automatizarea debugger-ului și inspecția memoriei. Acesta funcționează ca un set de scripturi Python care extind un debugger pentru a automatiza analiza fișierelor compilate și inspecția memoriei proceselor.
Proiectul oferă utilitare specializate pentru cercetarea coruperii memoriei, inclusiv un utilitar de generare a payload-urilor pentru crearea de tipare ciclice în vederea descoperirii buffer overflow-urilor și un gadget finder pentru a localiza secvențe de return-oriented programming (ROP) în binare. Se diferențiază oferind un instrument de vizualizare care transformă datele brute din registre, dezasamblare și memorie în text colorat pentru a simplifica analiza stărilor CPU.
Framework-ul acoperă o gamă largă de capabilități, inclusiv analiza de securitate binară pentru detectarea protecțiilor, scanarea memoriei prin expresii regulate și capacitatea de a mapa mediile proceselor direct din kernel-ul sistemului. Include, de asemenea, instrumente pentru modificarea adreselor de memorie și generarea de șabloane de shellcode.
Features
- GDB Extensions - Integrates as a GDB extension to visualize CPU registers, disassembly, and memory state during execution.
- Cyclic Pattern Generators - Provides utilities to generate non-repeating cyclic patterns for determining buffer overflow offsets.
- ROP Chain Automators - Identifies and dumps ROP gadgets within binaries to build functional execution chains.
- Debugger Visualizations - Provides a visualization tool that transforms raw register, disassembly, and memory data into color-coded text for easier CPU state analysis.
- System State Visualizations - Transforms raw register and assembly data into color-coded visual representations for faster CPU state analysis.
- Binary Analysis Tools - Analyzes compiled files to detect security protections and extract binary header information.
- State Visualizations - Provides a color-coded visualization of disassembly, registers, and memory to simplify CPU state analysis.
- Debugger Extensions - Extends the GDB debugger with custom Python commands to automate binary analysis.
- Buffer Overflow Research - Provides tools for identifying memory offsets and manipulating process memory to test for overflow vulnerabilities.
- Exploit Frameworks - Provides a modular platform of GDB Python scripts for automating binary analysis and memory inspection.
- Exploit Payload Generators - Includes a utility for creating cyclic patterns to discover buffer overflow offsets and generating shellcode templates for exploit payloads.
- Runtime Memory Manipulation - Modifies memory addresses with custom data to alter the state of a running process.
- Instruction Gadget Discovery - Implements search utilities to identify instruction sequences (gadgets) within binaries for ROP chain construction.
- Exploit Payloads - Generates shellcode, Python exploit templates, and memory patterns to achieve code execution.
- Memory Scanning - Scans process memory ranges using regular expressions to locate specific data structures or exploit signatures.
- Binary File Inspectors - Examines compiled binaries to inspect symbols, sections, and security protections.
- Memory Mapping Interfaces - Retrieves virtual memory mapping ranges and protection flags directly from the system kernel.
- Process Memory Scanners - Locates specific byte patterns, addresses, or regex matches within the memory space of a running process.
- Binary Pattern Searching - Searches process memory using regular expressions and allows modification of memory addresses.
- Process State Inspection - Retrieves and displays metadata and mapping ranges for active processes from the system kernel.
- Instrumente de analiză binară - Python-based exploit development assistance for GDB.
- Exploit Development - Assistance tool for exploit development within GDB.
- GDB Enhancements - Python-based exploit development assistance for GDB.
- Reverse Engineering - GDB plugin for exploit development.
- Security Tools - Python Exploit Development Assistance for GDB.
