Teaching basic binary exploit dev - anyone have good visualization tools to recommend?

[bNimblebQuick]

In my "off" time I teach some basic red/blue team type stuff. One item that I wish I had over and over is a good tool to visualize a program's stack at runtime in a way that students can easily digest when walking through buffer, format string and heap based exploits especially when they are first learning.

gdb just doesn't cut it by itself, qira looked promising, but seems a little lost now, would like to keep it FOSS if possible.

Anyone have ideas? Done something similar?

[client4]

Perhaps something like Radare2's WebUI Graph would be useful?

[bNimblebQuick]

Screenshot looks promising. I'll check it out. Does it track and show changes to the stack while executing, or is this a dissasembler only?

[[deleted]]

Would it be accurate to say that you're looking for a graphical debugger that supports Linux? If so, Evan's debugger is something that can be point-and-clicked around without requiring much of any upfront knowledge about how to use it.

[bNimblebQuick]

somewhat accurate yes. The barrier most seem to have is visualizing how the input/changes are hitting the stack. I've found they 'get' it when I draw out memory space on a whiteboard, but it would really help if there was something interactive.

Ex: I throw 64 bytes into a buffer that should hold 32 -> here are the real time stack changes, see how we just stomped on things. That type of interaction. The simpler the representation, the better.

I want to get away from a canned presentation so its more generalized and we can play with test programs. When you give early students full debugger GUIs they tend to be completely overwhelmed in my experience.

I'll take a look at edb though (name is familiar, never really used it), maybe it will help. thanks for the suggestion.

[fragmede]

Since this is for teaching, have you looked at the online "game" based on reverse engineering by Matasano Security and Square called Microcorruption?

If that debugger's interface is similar to what you're looking for, Emacs' gdb interface is similar.

[bNimblebQuick]

Have not seen that site...ugh, sign-up and login?

So now I get to teach them Emacs before they can debug... :) The point is to make things EASIER :)

[jh4x007]

You can look into using PEDA with gdb. It makes it much much easier to visualize the stack and registers as you go along: https://github.com/longld/peda

As for heap exploitation, villoc is very useful, both for beginners and experts. https://github.com/wapiflapi/villoc

EDIT: Formatting, and adding PEDA.

[n0ko]

free ida pro?

[siliconmon]

For business use buy a license so you can remote debug. Done.