Let's just try to play around with angr and see what we can get with it.

Solution:

Makefile: makefile script, ASCII text # The build file with -no-pie

stack: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=0d1603738be3a1d75ffa981fbe56f5c0b1ca8c30, for GNU/Linux 4.4.0, not stripped # We will work

stack.c: C source, ASCII text # We won't look

Solution:

from angr import *

load_bin = Project('./stack')

# What we already know:
print("Name file: ", load_bin.filename)
print("Architecture: ", load_bin.arch)
print("Entry point: ", hex(load_bin.entry))
print("Bit depth: ", load_bin.arch.bits)
print("Endianness: ", load_bin.arch.memory_endness)

# Name file:  ./stack
# Architecture:  <Arch AMD64 (LE)>
# Entry point:  0x401070
# Bit depth:  64
# Endianness:  Iend_LE

print("\nSegments:")
for seg in load_bin.loader.main_object.segments:
    print(f"{seg}")

# Segments:
# <ELFSegment flags=0x4, relro=0x0, vaddr=0x400000, memsize=0x670, filesize=0x670, offset=0x0>
# <ELFSegment flags=0x5, relro=0x0, vaddr=0x401000, memsize=0x22d, filesize=0x22d, offset=0x1000>
# <ELFSegment flags=0x4, relro=0x0, vaddr=0x402000, memsize=0x174, filesize=0x174, offset=0x2000>
# <ELFSegment flags=0x4, relro=0x1, vaddr=0x403de8, memsize=0x218, filesize=0x218, offset=0x2de8>
# <ELFSegment flags=0x6, relro=0x0, vaddr=0x404000, memsize=0x38, filesize=0x30, offset=0x3000>

print("\nFunc:")
cfg = load_bin.analyses.CFGFast()
for addr, func in cfg.functions.items():
    print(f"0x{addr:x}: {func.name}")

# Func:
# 0x401000: _init
# 0x401020: sub_401020
# 0x40102c: sub_40102c
# 0x401030: puts
# 0x401040: system
# 0x401050: printf
# 0x401060: __isoc99_scanf
# 0x401070: _start
# 0x401095: sub_401095
# 0x401096: sub_401096
# 0x4010a0: _dl_relocate_static_pie
# 0x4010a5: sub_4010a5
# 0x4010b0: sub_4010b0
# 0x4010d1: sub_4010d1
# 0x401112: sub_401112
# 0x401119: sub_401119
# 0x401120: sub_401120
# 0x40113f: sub_40113f
# 0x401141: sub_401141
# 0x401150: sub_401150
# 0x401156: win
# 0x40116c: main
# 0x401220: _fini
# 0x500000: __libc_start_main
# 0x500008: puts
# 0x500010: system
# 0x500018: printf
# 0x500020: __isoc99_scanf
# 0x601050: UnresolvableJumpTarget
# 0x601058: UnresolvableCallTarget

Control Flow Graph (CFG) analysis in angr constructs a graph representation of all reachable code in a binary, identifying functions, basic blocks, and control flow edges between them. CFG recovery is the foundation for most static analyses in angr, providing the structural information needed for decompilation, dataflow analysis, and binary diffing.

To raed: