file binary
strings binary | grep -i flag
strings binary | grep -i password

# Check for packed/obfuscated
upx -d binary  # Unpack UPX

readelf -h binary     # Headers
readelf -S binary     # Sections
readelf -s binary     # Symbols
checksec binary       # Security features

1. Import binary
2. Auto-analyze
3. Find main() in Symbol Tree
4. Check Functions for interesting names
5. Look for strings in Defined Strings

1. Open binary
2. F5 for decompile
3. X for cross-references
4. N to rename variables

r2 -A binary          # Analyze
afl                   # List functions
pdf @ main            # Disassemble main
axt @ sym.func        # Cross refs to function
iz                    # Strings

objdump -d binary           # Disassemble
objdump -d -M intel binary  # Intel syntax
objdump -t binary           # Symbols

gdb ./binary

# Commands
r                    # Run
b main               # Breakpoint at main
b *0x401234          # Breakpoint at address
c                    # Continue
ni                   # Next instruction
si                   # Step into
x/s 0x401234         # Examine as string
x/10wx $rsp          # Examine 10 words at RSP
info registers       # Show registers

# Better interface
vmmap                # Memory mapping
heap                 # Heap info
telescope            # Smart memory view

ltrace ./binary      # Library calls
strace ./binary      # System calls

// Look for strcmp, strncmp
if (strcmp(input, "secret") == 0) {
    printf("Correct!");
}

// XOR password
for (i = 0; i < len; i++) {
    if (input[i] ^ key[i] != encrypted[i]) fail();
}

// ptrace check
if (ptrace(PTRACE_TRACEME, 0, 0, 0) < 0) exit(1);

// Bypass: patch the check or use LD_PRELOAD

# XOR'd strings - find the XOR key
# Look for loops that modify data
# Check initialized data sections

# Python bytecode
uncompyle6 program.pyc
pycdc program.pyc

python -m dis program.pyc

# Decompile with dnSpy or ILSpy
dnSpy.exe program.exe
# Can also modify and save

# JAR files
jar tf program.jar           # List contents
jd-gui program.jar          # Decompile

# Check for obvious strings
strings binary | grep -iE "flag|password|secret|key"

# Check for Base64
strings binary | grep -E "^[A-Za-z0-9+/]{20,}={0,2}$"

# Run with ltrace
ltrace ./binary 2>&1 | grep -i strcmp

# Patch binary
# In GDB: set {char}0x401234 = 0x90 (NOP)