A comprehensive binary analysis tool designed for CTF pwn challenges. This tool provides detailed information about ELF binaries including architecture, security mitigations, disassembly, GOT/PLT entries, ROP gadgets, memory layouts, and heap structures.
Now includes an intelligent AI assistant that:
- 🤖 Automatically detects vulnerabilities
- 💡 Suggests optimal exploit strategies
- 📝 Generates working exploit templates
- 🎓 Provides step-by-step guidance
Try it now:
python pwn_analyzer.py binary --aiSee AI_GUIDE.md for complete AI features documentation.
- 📋 Basic Information: Architecture, bits, endianness, stripped status, entry point
- 🛡️ Security Mitigations: RELRO, Stack Canary, NX, PIE, RUNPATH
- 📑 Section Analysis: All section headers with addresses, sizes, and flags
- 📊 GOT/PLT Analysis: Global Offset Table and Procedure Linkage Table entries
- 🔤 Symbol Table: All symbols with addresses and types
- 📜 Disassembly: Beautiful disassembly with symbol resolution (shows function names!)
- 🔗 ROP Gadgets: Enhanced gadget finder (3-5x more gadgets)
- 🗺️ Memory Layout: Visual representation of memory segments
- 📚 Stack Frame Layout: Binary-specific stack analysis with real offset calculations
- 🏗️ Heap Layout: Tcache header structure and heap exploitation techniques
- 🤖 AI Assistant: Automatic exploit generation and guidance
Make sure you have Python 3.7+ installed.
pip install -r requirements.txtOr install manually:
pip install pwntools capstone pyelftools richRun complete analysis on a binary:
python pwn_analyzer.py ./binary_fileBasic Information Only:
python pwn_analyzer.py ./binary_file -bSecurity Mitigations Only:
python pwn_analyzer.py ./binary_file -sShow GOT/PLT Entries:
python pwn_analyzer.py ./binary_file --gotDisassemble N Instructions:
python pwn_analyzer.py ./binary_file -d 100Find N ROP Gadgets:
python pwn_analyzer.py ./binary_file -g 50Show Stack Frame Layout:
python pwn_analyzer.py ./binary_file --stackShow Heap/Tcache Layout:
python pwn_analyzer.py ./binary_file --heapShow All Sections:
python pwn_analyzer.py ./binary_file --sectionsCombine Multiple Options:
python pwn_analyzer.py ./binary_file -s -g 30 -d 50📋 Basic Information
┌────────────────────┬─────────────────────────┐
│ Property │ Value │
├────────────────────┼─────────────────────────┤
│ File │ challenge │
│ Architecture │ x86-64 (64-bit) │
│ Bits │ 64 │
│ Endianness │ little │
│ Stripped │ ❌ Yes (Stripped) │
│ Entry Point │ 0x401040 │
└────────────────────┴─────────────────────────┘
🛡️ Security Mitigations
┌────────────────────┬──────────────────┬─────────────────────────────┐
│ Protection │ Status │ Description │
├────────────────────┼──────────────────┼─────────────────────────────┤
│ RELRO │ ⚠️ Partial │ GOT is writable │
│ Stack Canary │ ❌ Disabled │ Vulnerable to overflow │
│ NX (DEP) │ ✅ Enabled │ Stack is not executable │
│ PIE │ ❌ Disabled │ Fixed addresses │
└────────────────────┴──────────────────┴─────────────────────────────┘
The tool provides visual tree representation of memory segments and sections.
Shows detailed stack frame structure with:
- Command line arguments location
- Stack growth direction
- Saved base pointer
- Return address (pwn target!)
- Local variables
- Buffer locations
- Stack canary position
Displays:
- Tcache perthread structure
- Tcache entry format
- Heap chunk structure
- Common exploitation techniques
python pwn_analyzer.py ./challenge -b -sGet a quick look at what you're dealing with - architecture and security features.
python pwn_analyzer.py ./challenge -g 100Find useful ROP gadgets for your exploit.
python pwn_analyzer.py ./challenge --stack --heapUnderstand stack and heap structures for exploitation.
python pwn_analyzer.py ./challenge --gotSee which functions are in GOT for overwrite attacks.
python pwn_analyzer.py ./challengeComplete analysis before starting exploitation.
The tool handles stripped binaries gracefully and shows available information.
Currently optimized for x86 and x86-64. Other architectures have basic support.
You can extend the BinaryAnalyzer class to add custom analysis features.
- Full RELRO: GOT is read-only, harder to exploit
- Partial RELRO: GOT is writable, vulnerable to GOT overwrite
- No RELRO: No protection
- Enabled: Stack buffer overflow protection active
- Disabled: Vulnerable to classic buffer overflow
- Enabled: Stack is not executable, need ROP/ret2libc
- Disabled: Can execute shellcode on stack
- Enabled: ASLR applies to executable, need information leak
- Disabled: Fixed addresses, easier exploitation
pip install pwntoolspip install capstoneMake sure the script is executable:
chmod +x pwn_analyzer.pyFeel free to extend this tool with additional features:
- More architecture support
- Advanced gadget classification
- Automatic exploit template generation
- Integration with debugging tools
- String/reference finding
Free to use for CTF and educational purposes.
- Pwn College: https://pwn.college/
- ROPemporium: https://ropemporium.com/
- How2Heap: https://github.com/shellphish/how2heap
- Pwnable.kr: http://pwnable.kr/
- Nightmare: https://guyinatuxedo.github.io/
# 1. First, analyze the binary
python pwn_analyzer.py ./challenge
# 2. Check for easy wins (no canary, no PIE, executable stack)
python pwn_analyzer.py ./challenge -s
# 3. Find ROP gadgets if needed
python pwn_analyzer.py ./challenge -g 100
# 4. Check GOT for overwrite targets
python pwn_analyzer.py ./challenge --got
# 5. Start exploitation with pwntools!Happy Pwning! 🔥