706c86013e
- picoCTF, CSAW, DEF CON, Flare-On, HackTheBox challenges - Tests: string extraction, xrefs, heap UAF, ARM64 ABI, ObjC routing - Gaps identified: packed binaries, fat Mach-O, PE IAT, encrypted strings
74 lines
3.1 KiB
Markdown
74 lines
3.1 KiB
Markdown
# CTF Binary Validation Corpus for fold
|
|
|
|
> Generated 2026-05-29. 7 CTF challenges to validate fold's binary analysis capabilities.
|
|
|
|
## Challenge Matrix
|
|
|
|
| # | Challenge | Platform | Binary Type | fold Feature Tested |
|
|
|---|-----------|----------|-------------|-------------------|
|
|
| 1 | picoCTF 2022 "buffer overflow 0" | x86_64 ELF | Stripped | String extraction, call graph |
|
|
| 2 | CSAW 2020 "roprop" | x86_64 ELF | Stripped | ROP gadget discovery, xrefs |
|
|
| 3 | DEF CON Quals 2019 "babyheap" | x86_64 ELF | Stripped | Symbol recovery, heap analysis |
|
|
| 4 | Flare-On 2021 #2 "known" | x86_64 PE | Packed | String extraction, unpack heuristics |
|
|
| 5 | HackTheBox "Jeeves" | x86_64 PE | Stripped | Disassembly, import recovery |
|
|
| 6 | picoCTF 2023 "VNE" | ARM64 Mach-O | Stripped | ARM64 disassembly, ABI inference |
|
|
| 7 | Flare-On 2022 #4 "sudo" | ARM64 Mach-O | Universal | Fat binary handling, arch selection |
|
|
|
|
## What Each Challenge Validates
|
|
|
|
### 1. picoCTF "buffer overflow 0" — String Extraction
|
|
- Binary reads a flag file into a buffer, then overflows
|
|
- fold's `isj`/`izzj` should find `"flag.txt"` and `"Oops!"` strings
|
|
- Validates: string discovery, `_OBJC_CLASS` detection, exported symbols
|
|
|
|
### 2. CSAW "roprop" — Xref Discovery
|
|
- Binary has ROP gadgets in non-exported functions
|
|
- fold should find internal functions via `aflj`
|
|
- Validates: cross-reference (`axtj`), basic block disassembly
|
|
|
|
### 3. DEF CON "babyheap" — Heap Analysis
|
|
- Heap-based UAF vulnerability
|
|
- fold's fuzz-prep should generate harnesses for malloc/free wrappers
|
|
- Validates: function discovery, param count inference, dlopen harness gen
|
|
|
|
### 4. Flare-On "known" — Packed Binary Handling
|
|
- UPX-packed PE with anti-debug
|
|
- fold should handle packed sections gracefully
|
|
- Validates: error resilience, partial analysis of packed regions
|
|
|
|
### 5. HTB "Jeeves" — Import Recovery
|
|
- Stripped PE with indirect calls through IAT
|
|
- fold should map IAT entries to function names
|
|
- Validates: import table analysis, indirect call resolution
|
|
|
|
### 6. picoCTF "VNE" — ARM64 ABI
|
|
- ARM64 Mach-O with Swift symbols
|
|
- fold should filter Swift-mangled symbols, route through ObjC
|
|
- Validates: recent ARM64 ABI fixes, Swift filter, ObjC class discovery
|
|
|
|
### 7. Flare-On "sudo" — Universal Binary
|
|
- Fat binary with x86_64 + ARM64 slices
|
|
- fold should handle universal binary format
|
|
- Validates: Mach-O fat binary parsing, arch selection
|
|
|
|
## Using CTF Binaries with fold
|
|
|
|
```bash
|
|
# Download a challenge
|
|
wget https://mercury.picoctf.net/static/<hash>/vuln -O ctf-bin
|
|
|
|
# Scan binary
|
|
fold scan --mode binary --binary ctf-bin --format json
|
|
|
|
# Generate fuzz harness
|
|
fold fuzz prep --binary ctf-bin --output /tmp/ctf-fuzz
|
|
```
|
|
|
|
## What fold Currently Cannot Handle
|
|
|
|
| Gap | Example | Needed Feature |
|
|
|-----|---------|---------------|
|
|
| Packed binaries | UPX/ASPack | Unpacking support or skip packed sections |
|
|
| Fat binaries | Universal Mach-O | Arch selection (always picks first) |
|
|
| PE IAT recovery | Import Address Table | PE format parser (currently Mach-O only) |
|
|
| Encrypted strings | XOR/RC4-obfuscated | Emulation or pattern heuristics |
|