ctf_import Logo

ctf_import

0
Free
Visit Website

A small library that allows you to run basic functions from stripped binaries cross platform. This library is designed for you to be able to quickly call functions from a stripped binary. All you need is the file name, the function offset, and the function signature. You can get these by reverse engineering the binary in IDA or Binary Ninja. void *import(char *file, size_t offset) #include "ctf_import.h" int main() { int (* fib)(int); // a.out is a binary with a fibonacci function at offset 0xf00 fib = (int (*)(int)) import("a.out", 0xf00); printf("%d %d %d %d %d\n", fib(1), fib(2), fib(3), fib(4), fib(5)); } To compile: $ gcc example.c ctf_import.c -o example $ ./example > 1 1 2 3 5 Notes: Although the code will run "cross-OS", it will not run cross architecture. Additionally, this does not handle syscalls and anything that interacts with globals.

FEATURES

ALTERNATIVES

Automate the process of writing YARA rules based on executable code within malware.

Interactive .NET SQL console client with enhanced SQL Server discovery, access, and data exfiltration features

An open-source binary debugger for Windows with a comprehensive plugin system for malware analysis and reverse engineering.

Yaraprocessor allows for scanning data streams in unique ways and dynamic scanning of payloads from network packet captures.

RetDec is a versatile machine-code decompiler with support for various file formats and architectures.

A minimal library to generate YARA rules from JAVA with maven support.

Tools for working with Android .dex and Java .class files, including dex-reader/writer, d2j-dex2jar, and smali/baksmali.

A javascript malware analysis tool with backend code execution.