mango

Static binary analysis. Overflows, format strings and canaries.

Python / ELF / objdumpGitHub

Static binary analysis

INPUTELF

StackOverflows / canaries
Format stringsOffsets / leaks
MitigationsPIE / NX / RELRO
Environmentglibc-aware

Inside mango

Static analysis

The README documents detection of buffer overflows, format-string vulnerabilities, unterminated string leaks, canaries and security mitigations. Analysis uses Python and objdump.

readme

Remote environments

Passing remote libraries lets the analysis account for different glibc stack layouts. Format-string offsets can change between local and remote environments.

remote_env.py

Test binaries

The repository includes C test cases for gets, fgets, read, scanf and printf, plus nested and multipath format-string cases.

testing/

Source excerpt

readme · excerpt

what it finds:
    - buffer overflows (with sizes)
    - format strings (with offsets)
    - unterminated string leaks
    - stack canaries
    - security mitigations (PIE/NX/RELRO)
    - generates exploit payloads

Read full source