binary-breaker

name	binary-breaker
description	Binary exploitation and reverse engineering for finding zero-days in compiled software. Use when analyzing binaries, finding memory corruption bugs, reverse engineering firmware, or hunting bugs in C/C++ applications.
domain	cybersecurity
author	oyi77
license	Apache-2.0
subdomain	general-cybersecurity
tags	["binary","breaker","cybersecurity","security","exploit","reverse-engineering","zero-day","money"]
version	1.0.0

Binary Breaker

Overview

Binary Breaker covers the full lifecycle of binary exploitation and reverse engineering — from static analysis of PE/ELF/Mach-O binaries through dynamic debugging, fuzzing, and exploit development. You analyze compiled software (C/C++/Rust/Go binaries) to find memory corruption vulnerabilities, reverse engineer proprietary formats and protocols, and deliver working proof-of-concept exploits with CVSS-scored findings.

The RTX 2060 SUPER GPU accelerates fuzzing workloads via AFL++ dictionary generation, parallel crash triage, and hashcat-assisted reverse engineering of obfuscated strings. The Kali Linux toolchain — Ghidra headless, pwntools, GDB, radare2, and QEMU — handles every target architecture from x86-64 to ARM/MIPS firmware.

When to Use

Trigger phrases:

• "Analyze this binary for vulnerabilities"
• "Reverse engineer this malware/firmware"
• "Exploit this buffer overflow / use-after-free / format string"
• "Hunt zero-days in closed-source application XYZ"
• "CTF pwn challenge — need a walkthrough or exploit"
• "What does this obfuscated function do?"
• "Crack this license validation / serial check"

Concrete scenarios:

• A client's proprietary Windows application crashes on malformed input — find the root cause and assess exploitability
• A CVE report mentions a use-after-free in a popular library version — develop a PoC to verify the fix
• Malware sample uses custom packing — unpack and extract the C2 configuration
• CTF team needs an exploit chain for a heap exploitation challenge
• Firmware update binary contains encrypted strings — identify the crypto routine and recover keys

When NOT to Use

• When you lack authorized access to test the target binary (no reverse engineering without permission)
• When source code is available and static analysis SAST tools are faster (use Semgrep/CodeQL instead)
• When the bug is already documented with a public CVE — you are validating, not hunting
• When legal or export-control restrictions apply (crypto exports, defense contracts)
• When the binary is trivially decompilable via managed code (C#/.NET — use dnSpy instead)
• When the task is purely about detecting known malware IOCs — use YARA/signatures instead

Money-Making Overview

Target Buyer: Security engineering teams, proprietary software vendors, ICS/OT firmware developers, CTF competition teams, malware analysis firms, bug bounty programs.

How You Make Money:

1. Binary Vulnerability Assessment — Analyze a closed-source binary for exploitable memory corruption bugs, deliver CVSS-scored findings with PoC. Vendors pay $2K-10K per engagement to harden products before release.
2. Exploit Development — Write reliable weaponized exploits for verified vulnerabilities. Bug bounty programs, zero-day brokers, and red teams pay $5K-50K+ per working exploit.
3. Reverse Engineering as a Service — Malware analysis, protocol reverse engineering, license algorithm extraction, firmware teardown. Security teams outsource RE at $150-300/hour.

Service Tiers

Tier	Price	What They Get
Basic — Binary Triage	$500-1,000	Automated analysis report: Ghidra headless function listing, strings analysis, dangerous imports (strcpy, gets, sprintf), heuristic CVSS scoring, attack surface summary. 24h turnaround.
Pro — Vulnerability Assessment	$2,500-5,000	Full manual RE: decompilation walkthrough, identified memory corruption bugs (buffer overflows, use-after-free, format strings), working PoC exploit per finding, CVSS 3.1 with environmental vectors, remediation guidance, 30-page technical report. 2 rounds of Q&A.
Enterprise — Zero-Day Retainer	$8,000-15,000/month	Ongoing binary auditing: prioritized bug hunting in critical modules, AFL++/libFuzzer harnesses, exploitability assessment, disclosure-ready advisory drafts, dedicated Slack/Telegram support, 48-hour turnaround on critical findings.

Expected First Dollar: 2-4 weeks (triage of a closed-source Windows app for known dangerous patterns, deliver initial $500-1,000 report).

First Action in 60 Minutes

Save as ~/tools/binary-triage.py on Kali Linux. It runs an ELF/PE binary analysis pipeline using Ghidra headless + pwntools + binutils, outputting a structured vulnerability triage report.

#!/usr/bin/env python3
"""binary-triage.py — ELF/PE binary analysis pipeline. Outputs MD report + CSV + decomp stub."""
import sys, os, subprocess, hashlib, struct, re, json
from pathlib import Path
from datetime import datetime

GHIDRA_HOME = os.environ.get("GHIDRA_HOME", "/opt/ghidra")
PROJECT_DIR = "/tmp/ghidra_projects"
MIN_STR = 6

DANGEROUS = {
    "strcpy": "Buffer overflow — unbounded copy",
    "strcat": "Buffer overflow — unbounded concat",
    "sprintf": "Buffer overflow — unbounded format",
    "gets": "Buffer overflow — unbounded stdin (CWE-20)",
    "scanf": "Format string / overflow if %s used",
    "system": "Command injection via arg control",
    "memcpy": "Overflow if len > dst buffer",
    "free": "Double-free / use-after-free",
    "alloca": "Stack overflow on ctrl size",
}
DANGEROUS_WIN = {
    "lstrcpy": "Buffer overflow (Windows)", "lstrcat": "Buffer overflow (Windows)",
    "wsprintfA": "Buffer overflow (Windows)", "ReadFile": "Overflow if nBytes > buf size",
}

def sha256_file(path):
    h = hashlib.sha256()
    with open(path, "rb") as f:
        for c in iter(lambda: f.read(65536), b""): h.update(c)
    return h.hexdigest()

def file_type(path):
    with open(path, "rb") as f:
        m = f.read(4)
    if m[:4] == b"\x7fELF":  
     m[:2] == b:  
     

def is_64bit(path):
    with open(path, ) as f:
        m = f.read(4)
     m[:4] == b:
        f.seek(4);  f.read(1) == b
     m[:2] == b:
        f.seek(0x3C); e_lfanew = struct.unpack(, f.read(4))[0]
        f.seek(e_lfanew + 4);  struct.unpack(, f.read(2))[0] == 0x8664
     False

def ghidra_decompile(target_path, output_dir):
    n = Path(target_path).stem
    sp = os.path.join(PROJECT_DIR, f)
    os.makedirs(PROJECT_DIR, exist_ok=True); os.makedirs(output_dir, exist_ok=True)
    script = os.path.join(GHIDRA_HOME, , )
     not os.path.exists(script): ();  None
    gs = os.path.join(os.path.dirname(os.path.abspath(__file__)), )
     not os.path.exists(gs):
        with open(gs, ) as f:
            f.write()
     = os.environ.copy(); [] = output_dir; [] = n
    r = subprocess.run([script, PROJECT_DIR, n, , target_path, ,
        , os.path.dirname(os.path.abspath(__file__)), , ],
        capture_output=True, text=True, =300, =)
    Path(os.path.join(output_dir, f)).write_text(
        f)
     r

def readelf_analysis(path):
    r = {}
    try:
         cmd, key  [([,,path],), ([,,path],),
            ([,,path],), ([,,path],),
            ([,,path],), ([,,path],)]:
            o = subprocess.run(cmd, capture_output=True, text=True, =15)
            r[key] = o.stdout[:3000]
    except: ()
     r

def extract_strings(path):
    try:
        r = subprocess.run([,,str(MIN_STR),path], capture_output=True, text=True, =60)
         r.stdout.splitlines()
    except:
        with open(path,) as f: d = f.read()
         [s.decode()  s  re.findall(rb, d)]

def check_mitigations(path, info):
    m = {: , : , : , : , : }
    t = info.get(,) + info.get(,)
       t:
        m[] =     t  
       t: m[] = 
       t:
        try:
            d = subprocess.run([,,path], capture_output=True, text=True, =15).stdout
            m[] =     d  
        except: m[] = 
       t: m[] = 
     any(  s  s  info.get(,).splitlines()): m[] = 
     m

def main():
    target = sys.argv[1]
    assert os.path.exists(target), f
    n = Path(target).stem;  = os.path.join(os.getcwd(), f)
    os.makedirs(, exist_ok=True)
    t = file_type(target); arch64 = is_64bit(target)
    (f)

    info = readelf_analysis(target)  t ==   {}
    strings = extract_strings(target)
    mit = check_mitigations(target, info)  t ==   {}
    interesting = [s  s  strings  any(k  s.lower()  k 
        [,,,,,,,,,])]
    dangerous = []
    all_imports = .(str(v)  v  info.values())  t ==   
     api,desc  {**DANGEROUS, **DANGEROUS_WIN}.items():
         api  all_imports: dangerous.append({: api, : desc})
    cvss = min(10.0, 5.0 + len(dangerous)*0.5 + (0.5  k,v  mit.items()    str(v)))

    ghidra_decompile(target, )

    report = os.path.join(, f)
    with open(report, ) as f:
        f.write(f)
         mit:
            f.write()
            f.write(.(f  k,v  mit.items()))
        f.write(f)
         dangerous:
            f.write()
            f.write(.(f  d  dangerous))
        : f.write()
        f.write(f)
         interesting:
            f.write(.(f  s  interesting[:40]))
             len(interesting) > 40: f.write(f)
        f.write(f{target}

Artifacts

• Report: {report}
• Functions: {od}/{n}_functions.csv
• Decompiled: {od}/{n}_decompiled.c
• Strings: {len(strings)} extracted | Dangerous: {len(dangerous)} flagged | CVSS: {cvss}/10 """) print(f"[+] Report: {report}")

if name == "main": main()

**Usage:**
```bash
python3 binary-triage.py /bin/ls          # Analyze ELF
python3 binary-triage.py app.exe           # Analyze PE (cross-analysis on Kali)

Output: ./app_analysis/app_triage_report.md — structured report with mitigations, dangerous imports, interesting strings, pwntools scaffold, and analysis artifacts.

Deliverable Format

You deliver a structured ZIP archive per engagement:

binary_assessment_<target>_<date>/
├── reports/
│   ├── <target>_vulnerability_report.pdf       ← Full report (30+ pages)
│   └── <target>_executive_summary.pdf          ← 2-page management summary
├── exploits/
│   ├── exploit_poc.py                          ← Working PoC (pwntools)
│   └── trigger_input.bin                       ← Minimal crash trigger
├── analysis/
│   ├── ghidra_project/                         ← Reproducible Ghidra project
│   ├── function_listing.csv                    ← All functions with addresses
│   └── strings_analysis.txt                    ← Filtered strings with context
├── cvss/
│   └── cvss_vectors.txt                        ← CVSS 3.1 vectors per finding
└── README.md                                   ← Reproduction instructions

Finding Template (per vulnerability)

┌──────────────────────────────────────────────────────────────┐
│ Finding #1: Stack Buffer Overflow in parse_config()          │
├──────────────────────────────────────────────────────────────┤
│ CVE:      [Pending / Reserved]                               │
│ CVSS 3.1: 7.8 High — AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H   │
│ CWE:      CWE-121 (Stack-based Buffer Overflow)              │
│ Target:   parse_config() @ 0x401234 in config_parser section │
├──────────────────────────────────────────────────────────────┤
│ Description: parse_config() copies user input into a 256-byte│
│ stack buffer using strcpy() without length checking.         │
│ Attacker overwrites saved return address for arbitrary code  │
│ execution.                                                   │
├──────────────────────────────────────────────────────────────┤
│ Reproduction:                                                │
│   $ python3 exploits/exploit_poc.py                          │
│   → EIP/RIP control at offset 268 → shell with ROP chain     │
├──────────────────────────────────────────────────────────────┤
│ Remediation:                                                 │
│ • Replace strcpy() with strncpy() or snprintf()              │
│ • Enable -fstack-protector-strong for stack canary           │
│ • Enable Full RELRO + ASLR to reduce exploit reliability     │
├──────────────────────────────────────────────────────────────┤
│ Disclosure: Coordinated disclosure. Embargo: 90 days.        │
└──────────────────────────────────────────────────────────────┘

Anti-Rationalization Table

Rationalization	Reality
"I need assembler mastery first"	Ghidra's decompiler shows pseudo-C. Read that, trace variables, learn x86-64 one opcode at a time. The first PoC comes from pattern recognition, not reading the Intel manual cover-to-cover.
"RE is too time-consuming — I can't bill for it"	A 60-min automated triage produces a $500-1,000 report. Deep manual RE bills $150-300/hr. RE is the differentiator — most engineers can't do it, so you set the price.
"Closed-source binaries are black boxes"	Ghidra + pwntools + fuzzing makes closed-source auditing practical. Dangerous patterns like strcpy on attacker data are visible in decompiler output. Some of the highest CVE bounties come from closed-source software.
"Format string bugs don't exist in modern code"	They still appear in embedded firmware, legacy OT/ICS code, and IoT binaries. glibc's fortified printf is often disabled in embedded toolchains.
"ASLR + NX + RELRO make exploitation impossible"	Each mitigation has known bypasses: ret2libc/ROP for NX, partial RELRO → GOT overwrite, ASLR leaks via format strings, canary leaks via TLS. Missing any one layer makes exploitation viable.
"I need IDA Pro ($10K+) for real RE"	Ghidra (NSA, free) matches IDA Pro's decompiler for most targets. Pwntools + GDB+Pwndbg + QEMU handle the full pipeline. IDA Pro only matters for esoteric architectures or heavy obfuscation.
"Bug bounty programs don't accept binary findings"	Microsoft, Google, Adobe, VMWare, and hundreds of IoT vendors explicitly scope binary-level vulnerabilities. Average Chromium V8 bug pays $15,000+.
"Symbol stripping makes analysis impossible"	Stripped binaries lose function names but preserve code flow. Ghidra recovers boundaries, CFGs, and variable references. Label functions by behavior, not by name.

Workflow

"""
PHASE 1: Recon (60 min)
  → run binary-triage.py: type, strings, imports, mitigations, heuristic CVSS

PHASE 2: Static Analysis (4-8 hr)
  → Ghidra decompilation walkthrough, trace input paths
  → Identify reachable dangerous functions, document call chains

PHASE 3: Dynamic Analysis (2-4 hr)
  → GDB + Pwndbg: set breakpoints at dangerous calls, trace data flow
  → Confirm crash reachable, capture register/stack state at crash

PHASE 4: Fuzzing (RTX 2060 SUPER accelerated)
  → AFL++ harness on parsing function, seed corpus from strings
  → Run parallel instances, triage crashes by fault type and offset

PHASE 5: Exploit Development (8-40 hr)
  → Pwntools: cyclic → offset → control flow hijack
  → ROP chain (ROPgadget/ropper), bypass ASLR/NX/RELRO/Canary
  → Iterate to reliable weaponized exploit

PHASE 6: Reporting (2-4 hr)
  → Write CVSS-scored finding per vulnerability
  → Package PoC, reproduction steps, remediation code
  → Submit deliverable ZIP archive
"""

Process

1. Triage — Run automated pipeline: SHA-256, type detection, strings, imports, mitigations, heuristic CVSS.
2. Deep RE — Ghidra decompilation walkthrough, trace input-to-destination paths, identify reachable dangerous functions.
3. Verify — GDB tracing of input-to-crash path, confirm exploitability, document register/stack state at crash.
4. Exploit — Develop working PoC: offset calculation via cyclic pattern, ROP chain, mitigation bypass strategy.
5. Package — Write per-finding CVSS vectors, remediation guidance, reproduce instructions. ZIP the deliverable.

Tools

• Ghidra (headless + GUI) — Primary decompiler for PE/ELF/Mach-O. Batch analysis via analyzeHeadless.
• Pwntools — Exploit framework: cyclic()/cyclic_find(), ELF(), ROP(), p64()/p32(), remote/local process I/O.
• GDB + Pwndbg — Dynamic debugging: breakpoints, register/stack inspection, crash context analysis.
• ROPgadget / ropper — Automated ROP gadget discovery from binary + loaded libraries.
• AFL++ — Coverage-guided fuzzer; RTX 2060 SUPER handles display/compute loads, freeing CPU for sustained parallel fuzzing.
• Radare2 / r2pipe — Lightweight analysis for quick binary inspections.
• binutils (objdump, readelf, strings) — Standard structural analysis, symbols, string extraction.
• QEMU user-mode — Cross-architecture binary execution for ARM/MIPS firmware RE.

Prerequisites

• Kali Linux (or Debian-based with security tools)
• Ghidra 11.x+ at /opt/ghidra (set GHIDRA_HOME if different)
• Python 3.9+ with pwntools (pip install pwntools)
• GDB with pwndbg (apt install gdb)
• AFL++ (apt install afl++)
• Written authorization to analyze target binary (bug bounty scope or client contract)
• Basic x86/x86-64 assembly literacy (call/ret, stack frame, registers, addressing modes)

Verification

• All dangerous imports verified reachable with attacker-controlled input (not dead code)
• Crash confirmed with minimal payload (not a 1MB fuzz crash)
• EIP/RIP control confirmed with cyclic pattern; offset documented
• PoC exploit achieves its objective (crash, info leak, or code execution) on target version
• Mitigation bypass strategy documented and working (or noted as POC-only)
• CVSS 3.1 vector calculated per finding with environmental adjustments
• Remediation code or configuration change provided per finding
• False positives documented — unreachable or guarded imports flagged as such
• Deliverable ZIP tested: clean extract, PoC runs, README instructions verified
• Disclosure timeline agreed with client (embargo period or immediate)