Binary analysis with Python: capstone, lief and pwntools
You disassemble and patch compiled programs in Python and, on training binaries in the lab, prove how memory bugs arise and how they are prevented.
Level 501 · 14 lessons · 12 practice labs
Lessons
Disassembling and reading
- Disassembling machine code with capstone
- Sections, symbols and imports with lief
- Finding strings and the code that references them
- Short task: find the validation function in a training binary
Understanding memory bugs
- Talking to a process and automating input with pwntools
- Observing a stack overflow in a lab program
- Mitigations: NX, ASLR, PIE, canaries and checksec
- Triaging crashes and judging exploitability
- Short task: rebuild the vulnerable program with mitigations and prove the difference
Automation
- Patching a binary with lief
- Emulating a code snippet with unicorn
- Writing a script that decodes obfuscated strings
- Short task: extract a malware sample’s embedded configuration
Wrap-up
- Capstone: a behaviour and risk report on an unknown program
Practice labs
- What the program imports: Write a lief script that lists the sections, symbols and imported functions of the given training program, and marks network and file functions separately.
- Which code uses this string: Find the address of an error-message string in the training program, locate the instructions that reference it in code disassembled with capstone, and show the function it belongs to.
- Find the validation function: In a stripped training program, find the function that performs the licence check from string references and call structure, explain its logic in pseudocode and confirm it with your script.
- An inventory of mitigations: Write a Python script that checks NX, PIE, canary and RELRO status of the ELF files in a folder, reports them as a table and flags those built without protection.
- Rebuild with mitigations: Build the given faulty training program from source with mitigations off and on, and show the difference in behaviour on the same long input with a pwntools script.
- Sort crash dumps into buckets: Replay the crash inputs collected by the Demirhan Machinery test team with pwntools, group them by crash location, name each group’s bug class and rank fix priority with reasons.
- Drive a menu program with a script: Write a pwntools script that talks to an interactive menu program in the lab, adds a record, lists records and quits, and show it parses the output correctly.
- Measure exactly where the overflow starts: Write a pwntools script that sends inputs of growing length to a training program to find where it starts crashing, match it with the faulty buffer size in the source and propose the fix.
- A risk report on an unknown program: Write scripts that infer the behaviour of an unknown training program found on a Brightfield Labs server from imports, strings, mitigations and embedded data, and produce a short evidence-based risk report.
- Decode obfuscated strings: Write a script that finds and decodes strings hidden with a single-byte key in a training sample, and list the domains and file paths revealed.
- Emulate the decoding routine: Emulate the string-decoding function of a training sample with unicorn without running the program, and output every decoded string with its address.
- Extract the embedded configuration: Write a script that locates and decodes the encoded configuration block embedded in the data section of the lab’s training malware simulation, and report the server address and interval as IOCs for the defence team.
About this course
You disassemble and patch compiled programs in Python and, on training binaries in the lab, prove how memory bugs arise and how they are prevented.
What you will learn
- Disassembling and reading
- Understanding memory bugs
- Automation
- Wrap-up
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.