Binary Exploitation Toolkit

Binary exploitation toolkit. Linux x86_64 syscall table (325 entries), stack frame visualizer with cyclic pattern and endian converter, and format string payload generator with write-what-where and GOT overwrite.

#Syscall Reference

#Linux x86_64 Syscall Table

325 syscalls (NR 0-335), searchable by name or number, register arguments (%rdi through %r9). Shellcode favorites filter. Click any row to copy the ASM stub (mov rax, NR; syscall).

Linux x86_64 Syscall Table

x86_64 uses syscall instruction. Result in %rax. Args: %rdi, %rsi, %rdx, %r10, %r8, %r9

%rax System call %rdi %rsi %rdx %r10 %r8 %r9

x86_64 uses syscall instruction. Result in %rax. Click a row to copy mov rax, NR ; sys_name. Highlighted = shellcode favorites.

#Stack & Memory

#Stack Frame Visualizer

Visual stack layout (buffer, RBP, RIP, canary), automatic padding calculation, Python2/3 exploit skeleton, De Bruijn cyclic pattern generator with find-offset, and endian converter (hex to little-endian with Python copy). Mitigations quick reference (ASLR, NX, canary, PIE, RELRO, shadow stack).

Stack Frame Visualizer

Buffer overflow / RIP-EIP overwrite layout

Stack grows downward (high addr to low addr). Overflow fills upward.

Stack Layout (high addr at top) overflow ↑
Exploit Skeleton 







Cyclic Pattern (De Bruijn)

























Endian Converter
















Mitigations Quick Reference







Protection
What It Does
Bypass Technique






ASLR
Randomizes base addresses of stack/heap/libs each run
Info leak, brute force (32-bit), partial overwrite, ret2plt, VDSO




NX / DEP
Marks stack/heap non-executable; prevents shellcode execution
ROP chains, ret2libc, ret2plt, JOP, SROP




Stack Canary
Random value placed before saved RBP; checked on return
Leak canary via fmt string / read primitive, brute (fork), overwrite TLS




PIE
Randomizes binary base address (code/data segments)
Info leak for base addr, partial overwrite (last 12 bits fixed), ret2plt with known offset




RELRO (Full)
Makes GOT read-only at runtime, prevents GOT overwrite
Overwrite other function pointers (exit_funcs, __malloc_hook), use Partial RELRO target




SafeStack / Shadow Stack
Keeps return addresses in a separate protected shadow stack
Leak shadow stack pointer, overwrite non-return-addr targets (longjmp bufs, vtables)





















#Format String Payload Generator




Leak payloads, interactive offset finder, write-what-where via %n/%hn/%hhn, GOT overwrite. x86/x64 architecture with x64-specific notes, goal selector (leak/write/GOT), Windows %n warning, configurable offset. All variants generated live.




Format String Payload Generator


%n / %p / %s exploitation helper


































1 - Leak & Detect Payloads








2 - Offset Finder


















3 - Write Payloads


























%hhn = write 1 byte  | 
      %hn = write 2 bytes  | 
      %n = write 4 bytes  | 
      %lln = write 8 bytes (64-bit).
      Split large values into 2-byte shorts to avoid blocking on huge %Nc padding.
    






4 - GOT Overwrite





























5 - Format Specifier Reference








Specifier
Meaning
Exploit Use Case






%p
Print pointer (void*) in hex
Stack leak, ASLR bypass, canary leak




%x / %lx
Print unsigned int/long as hex (no 0x prefix)
Stack leak, offset finding. Use %lx on x64 for full 8-byte values




%s
Dereference arg as char* string
Read arbitrary memory (can SIGSEGV on bad addr)




%c
Print char; %Nc pads output to N chars
Control the byte counter for %n writes




%n
Write # of chars printed so far into int*
Arbitrary 4-byte write




%hn
Write lower 2 bytes (short) into short*
Split writes (2 bytes at a time) for large values




%hhn
Write 1 byte (char) into unsigned char*
Byte-by-byte write; minimal padding; precise control




%lln
Write 8 bytes (long long) - 64-bit
x64 arbitrary write (rare; use %hn pairs instead)




%N$...
Direct parameter access (position N)
Target specific stack slot without consuming earlier args

























#Also See






#Official Resources











#Cyber Aurelien Guidi