Chapter 8: Auditing Program Binaries
In this chapter, you will learn about auditing executable binary files. It consists of analyzing binary programs to identify their vulnerabilities. It is interesting for us because this is another common Ghidra use case. Furthermore, if you find an unknown vulnerability in a program, in most cases, you will be able to hack computers without needing to convince the user to perform some action via social engineering.
You will walk through a review of the main memory corruption vulnerabilities (that is, integer overflows, buffer overflow, format strings, and so on) while approaching them with Ghidra. Finally, you will learn how these vulnerabilities can be exploited in practice.
We will cover the following topics in this chapter:
- Understanding memory corruption vulnerabilities
- Finding vulnerabilities using Ghidra
- Exploiting a simple stack-based buffer overflow