Skip to content

Concolic tracer to detect flag leaks and create Type-2 POVs.

License

Notifications You must be signed in to change notification settings

mechaphish/colorguard

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Colorguard

Detect and exploit leaks of the flag page given an input. Makes stdin entirely concrete with the only symbolic data being the flag page. For most binaries this should allow us to execute almost entirely in Unicorn

>>> cg = colorguard.Colorguard("../binaries/tests/i386/simple_leak", "deadbeef")
>>> pov = cg.attempt_exploit() # if a leak occurs exploit it
>>> pov # these POVs are the same as the POVs generated by Rex
<colorguard.pov.ColorguardType2Exploit at 0x7f7d9a2c2610>
>>> pov.test_binary() # being Rex POVs they can also be run against a simulation of the CGC architecture
True
>>> pov.dump_c('leak.c') # they can be dumped just like Rex POVs too
>>> pov.dump_binary('leak.pov')

About

Concolic tracer to detect flag leaks and create Type-2 POVs.

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages