# CTF Binary Validation Corpus for fold

> Generated 2026-05-29. 7 CTF challenges to validate fold's binary analysis capabilities.

## Challenge Matrix

| # | Challenge | Platform | Binary Type | fold Feature Tested |
|---|-----------|----------|-------------|-------------------|
| 1 | picoCTF 2022 "buffer overflow 0" | x86_64 ELF | Stripped | String extraction, call graph |
| 2 | CSAW 2020 "roprop" | x86_64 ELF | Stripped | ROP gadget discovery, xrefs |
| 3 | DEF CON Quals 2019 "babyheap" | x86_64 ELF | Stripped | Symbol recovery, heap analysis |
| 4 | Flare-On 2021 #2 "known" | x86_64 PE | Packed | String extraction, unpack heuristics |
| 5 | HackTheBox "Jeeves" | x86_64 PE | Stripped | Disassembly, import recovery |
| 6 | picoCTF 2023 "VNE" | ARM64 Mach-O | Stripped | ARM64 disassembly, ABI inference |
| 7 | Flare-On 2022 #4 "sudo" | ARM64 Mach-O | Universal | Fat binary handling, arch selection |

## What Each Challenge Validates

### 1. picoCTF "buffer overflow 0" — String Extraction
- Binary reads a flag file into a buffer, then overflows
- fold's `isj`/`izzj` should find `"flag.txt"` and `"Oops!"` strings
- Validates: string discovery, `_OBJC_CLASS` detection, exported symbols

### 2. CSAW "roprop" — Xref Discovery  
- Binary has ROP gadgets in non-exported functions
- fold should find internal functions via `aflj`
- Validates: cross-reference (`axtj`), basic block disassembly

### 3. DEF CON "babyheap" — Heap Analysis
- Heap-based UAF vulnerability
- fold's fuzz-prep should generate harnesses for malloc/free wrappers
- Validates: function discovery, param count inference, dlopen harness gen

### 4. Flare-On "known" — Packed Binary Handling  
- UPX-packed PE with anti-debug
- fold should handle packed sections gracefully
- Validates: error resilience, partial analysis of packed regions

### 5. HTB "Jeeves" — Import Recovery
- Stripped PE with indirect calls through IAT
- fold should map IAT entries to function names
- Validates: import table analysis, indirect call resolution

### 6. picoCTF "VNE" — ARM64 ABI  
- ARM64 Mach-O with Swift symbols
- fold should filter Swift-mangled symbols, route through ObjC
- Validates: recent ARM64 ABI fixes, Swift filter, ObjC class discovery

### 7. Flare-On "sudo" — Universal Binary
- Fat binary with x86_64 + ARM64 slices
- fold should handle universal binary format
- Validates: Mach-O fat binary parsing, arch selection

## Using CTF Binaries with fold

```bash
# Download a challenge
wget https://mercury.picoctf.net/static/<hash>/vuln -O ctf-bin

# Scan binary
fold scan --mode binary --binary ctf-bin --format json

# Generate fuzz harness
fold fuzz prep --binary ctf-bin --output /tmp/ctf-fuzz
```

## What fold Currently Cannot Handle

| Gap | Example | Needed Feature |
|-----|---------|---------------|
| Packed binaries | UPX/ASPack | Unpacking support or skip packed sections |
| Fat binaries | Universal Mach-O | Arch selection (always picks first) |
| PE IAT recovery | Import Address Table | PE format parser (currently Mach-O only) |
| Encrypted strings | XOR/RC4-obfuscated | Emulation or pattern heuristics |