pwn-dynamic

PWN Dynamic - Dynamic Analysis

Perform dynamic analysis to verify findings and calculate exact exploitation offsets.

Execution Steps

Step 1: Generate Cyclic Pattern

python3 -c "from pwn import *; print(cyclic(200).decode())"

Save pattern to file for GDB input:

python3 -c "from pwn import *; open('/tmp/pattern', 'wb').write(cyclic(200))"

Step 2: Run Binary with Pattern in GDB

Create a GDB command file:

cat > /tmp/pwn-debug.gdb << 'EOF'
set disable-randomization on
run < /tmp/pattern
EOF

Run GDB:

gdb -q -x /tmp/pwn-debug.gdb <binary>

Step 3: Analyze Crash

After crash, in GDB (pwndbg):

# Check what value is at RSP (return address location)
x/gx $rsp

# Find offset
cyclic -l <value_at_rsp>

# Or for 32-bit
cyclic -l $eip

Step 4: Verify Offset

Test with calculated offset:

python3 << 'EOF'
from pwn import *
offset = 72  # Replace with calculated offset
payload = b'A' * offset + p64(0xdeadbeef)
open('/tmp/verify', 'wb').write(payload)
EOF

Run in GDB and verify RIP/EIP is 0xdeadbeef.

Step 5: Generate Project .gdbinit

Create .gdbinit for the challenge:

# Challenge-specific GDB config for pwndbg
set disable-randomization on
file ./binary

# Useful breakpoints
b main
# b *vuln+<offset_to_ret>

# Commands on stop
define hook-stop
    telescope $rsp 8
end

# Helper commands
define pwn-check
    checksec
    vmmap
    got
end

Step 6: Document Register Control

From crash analysis, document:

• Which registers are controlled
• Stack state at crash
• Any useful values on stack (canary leaks, addresses)

Output Format

## Dynamic Analysis

### Findings
- Offset to RIP: 72 bytes (verified)
- RSP control: Full (can place ROP chain)
- Register state at crash:
  - RAX: 0x0 (return from gets)
  - RBX: 0x0
  - RDI: Points to buffer
- Stack contains: No useful leaks observed

### Debug Session

Program received signal SIGSEGV RSP: 0x7fffffffe4a8 → 'haaaiaaaj...'