fold/docs/internal/ctf-binary-validation-corpus.md

CTF Binary Validation Corpus for fold

Generated 2026-05-29. 7 CTF challenges to validate fold's binary analysis capabilities.

Challenge Matrix

#	Challenge	Platform	Binary Type	fold Feature Tested
1	picoCTF 2022 "buffer overflow 0"	x86_64 ELF	Stripped	String extraction, call graph
2	CSAW 2020 "roprop"	x86_64 ELF	Stripped	ROP gadget discovery, xrefs
3	DEF CON Quals 2019 "babyheap"	x86_64 ELF	Stripped	Symbol recovery, heap analysis
4	Flare-On 2021 #2 "known"	x86_64 PE	Packed	String extraction, unpack heuristics
5	HackTheBox "Jeeves"	x86_64 PE	Stripped	Disassembly, import recovery
6	picoCTF 2023 "VNE"	ARM64 Mach-O	Stripped	ARM64 disassembly, ABI inference
7	Flare-On 2022 #4 "sudo"	ARM64 Mach-O	Universal	Fat binary handling, arch selection

What Each Challenge Validates

1. picoCTF "buffer overflow 0" — String Extraction

• Binary reads a flag file into a buffer, then overflows
• fold's isj/izzj should find "flag.txt" and "Oops!" strings
• Validates: string discovery, _OBJC_CLASS detection, exported symbols

2. CSAW "roprop" — Xref Discovery

• Binary has ROP gadgets in non-exported functions
• fold should find internal functions via aflj
• Validates: cross-reference (axtj), basic block disassembly

3. DEF CON "babyheap" — Heap Analysis

• Heap-based UAF vulnerability
• fold's fuzz-prep should generate harnesses for malloc/free wrappers
• Validates: function discovery, param count inference, dlopen harness gen

4. Flare-On "known" — Packed Binary Handling

• UPX-packed PE with anti-debug
• fold should handle packed sections gracefully
• Validates: error resilience, partial analysis of packed regions

5. HTB "Jeeves" — Import Recovery

• Stripped PE with indirect calls through IAT
• fold should map IAT entries to function names
• Validates: import table analysis, indirect call resolution

6. picoCTF "VNE" — ARM64 ABI

• ARM64 Mach-O with Swift symbols
• fold should filter Swift-mangled symbols, route through ObjC
• Validates: recent ARM64 ABI fixes, Swift filter, ObjC class discovery

7. Flare-On "sudo" — Universal Binary

• Fat binary with x86_64 + ARM64 slices
• fold should handle universal binary format
• Validates: Mach-O fat binary parsing, arch selection

Using CTF Binaries with fold

# Download a challenge
wget https://mercury.picoctf.net/static/<hash>/vuln -O ctf-bin

# Scan binary
fold scan --mode binary --binary ctf-bin --format json

# Generate fuzz harness
fold fuzz prep --binary ctf-bin --output /tmp/ctf-fuzz

What fold Currently Cannot Handle

Gap	Example	Needed Feature
Packed binaries	UPX/ASPack	Unpacking support or skip packed sections
Fat binaries	Universal Mach-O	Arch selection (always picks first)
PE IAT recovery	Import Address Table	PE format parser (currently Mach-O only)
Encrypted strings	XOR/RC4-obfuscated	Emulation or pattern heuristics