Arsenal Assembly: Essential Tools for the Modern Exploit Developer

Well it's been a busy week but here we are again! Last time in our exploit development journey, we set up our lab environment using Proxmox VE and got our virtualization game on point. Today though, we're going to load up our Parrot OS VM with all the essential tools we'll actually be using day-to-day. Having the right tools doesn't just make your work possible - it makes everything way more efficient.

Arsenal Assembly: Essential Tools for the Modern Exploit Developer

The Exploit Developer's Toolkit: A Multi-Layered Approach

When I first started diving into offensive security projects, I was completely overwhelmed by the vast number of tools out there. It's so easy to get lost in the sea of available tools, and honestly, most of them are command line beasts with a million different flags and options that just make everything more confusing. Over time though, I've figured out that most tools are built to solve specific problems, and while a bunch of different tools might get the job done, some just do it better or faster than others. The trick is understanding how they all work together.

Let's break down our toolkit so it's not so overwhelming:

In this post, we'll dig into each category and I'll show you the specific tools I recommend for our exploit dev journey. We'll spend some extra time on Binary Ninja since that's gonna be our main disassembler and reverse engineering platform.

System Foundation Setup

Before we jump into the fun stuff, let's get our system ready with the basic development packages:

sudo apt update && sudo apt full-upgrade -y

sudo apt install build-essential git curl wget python3-pip python3-venv -y

mkdir -p $HOME/tools
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc
source ~/.bashrc

Core Analysis Platform: Binary Ninja

Binary Ninja's going to be my go-to disassembler and code analysis platform throughout this whole series. Sure, IDA Pro and Ghidra are solid alternatives, but Binary Ninja strikes a really nice balance between being powerful, easy to use, and extensible - which makes it perfect for learning this stuff.

Here's what makes Binary Ninja great for our work:

Multi-level IL (Intermediate Language) - Binary Ninja's got this unique IL system that basically translates assembly into progressively higher-level representations, making complex code much easier to understand
Graph View - Shows you program flow in a visual way that makes the logic and relationships much more obvious
Type System - Lets you define and spread data types throughout a binary, which brings some structure to those crazy raw memory operations
API and Plugin Ecosystem - You can automate boring repetitive tasks and extend functionality however you want

Setting Up Binary Ninja

Since Binary Ninja's going to be our main platform, let's get it installed first:

Binary Ninja Installation:

Download it manually from https://binary.ninja (you'll need a commercial license for all the good features)
Extract to ~/tools/binaryninja
Run the initial setup: ./binaryninja
Configure your license

Alternative Disassemblers

While Binary Ninja's going to be our main tool, it's worth knowing about the alternatives in case you prefer something different:

IDA Free (Industry-standard disassembler):

Download from https://hex-rays.com/ida-free/ (requires registration and free serial key) Free version of the professional IDA Pro with excellent disassembly capabilities.

# Download IDA Free from Hex-Rays website first
cd ~/tools
# Download idafree_linux.run from https://hex-rays.com/ida-free/
chmod +x idafree_linux.run
./idafree_linux.run

Ghidra (Free NSA-developed tool):

sudo apt install ghidra -y

Radare2 + Cutter (Open source alternative):

sudo apt install radare2 -y

sudo snap install cutter --classic

Dynamic Analysis: Debuggers and Runtime Tools

While static analysis gives us the blueprint, dynamic analysis lets us watch the machinery actually work. These tools help us see what's happening when programs are running, and debuggers are probably the most important tools for exploit development.

Core Debuggers

GDB with Extensions (Linux): GDB is the standard Linux debugger, but it gets way better with extensions. Modern GDB extensions completely transform the experience with better memory visualization, register tracking, and exploit-specific features.

Binary Ninja Debugger: Binary Ninja's built-in debugger lets you seamlessly switch between static and dynamic analysis. We'll use this feature a ton when we're examining exploitable conditions.

x64dbg (Windows Targets): For Windows targets, x64dbg is a powerful open-source alternative to the expensive commercial debuggers, with great visualization and plugin support.

Setting Up Your Debugging Environment

⚠️ Heads up: Pick just ONE of these GDB enhancements - they don't play nice together and installing multiple will break things.

Option 1: Pwndbg (Recommended for modern interface)

git clone https://github.com/pwndbg/pwndbg.git
cd pwndbg
./setup.sh

Option 2: GEF (Modular and script-friendly)

bash -c "$(curl -fsSL https://gef.blah.cat/sh)"

Option 3: PEDA (Lightweight and stable)

git clone https://github.com/longld/peda.git ~/peda
echo "source ~/peda/peda.py" >> ~/.gdbinit

Process Monitoring Tools

Beyond debuggers, we need tools to keep an eye on what processes are doing:

System Call Tracing:

sudo apt install strace ltrace -y

strace tracks system calls during execution, while ltrace tracks library function calls - both are super helpful for figuring out what programs are actually doing.

Static Analysis Utilities: Understanding Code Structure

Beyond our main disassembler, there are a bunch of specialized static analysis tools that'll make our lives easier. These tools help us quickly understand binary structure and pull out key info before we dive deeper.

Essential Binary Utilities

Core Analysis Tools:

sudo apt install binutils coreutils -y

This gives us the fundamental tools:

objdump: Disassemble binaries and check out headers
readelf: Look at ELF headers and section details
strings: Pull out human-readable text from binaries
file: Figure out file type and architecture
hexdump: View raw hex representation

Specialized Binary Analysis Tools

Firmware and Binary Analysis:

sudo apt install binwalk patchelf upx-ucl -y

binwalk: Find embedded files and code in firmware
patchelf: Modify ELF binaries (handy for exploitation setup)
upx: Deal with UPX-packed executables

Security-Focused Analysis:

sudo apt install checksec -y

checksec looks at binary hardening features (RELRO, PIE, NX, stack canaries, etc.) - super important info for exploit development.

Windows Binary Analysis

PE (Portable Executable) Tools:

sudo apt install pev -y

You'll need these for analyzing Windows executables - they give you PE header analysis and structure examination.

Exploitation Frameworks and Development Tools

Once we've found vulnerabilities, exploitation frameworks help us build and deliver payloads. These tools bridge the gap between finding bugs and actually exploiting them.

Python-Based Exploit Development

pwntools (Primary exploit development framework):

cd $HOME/tools
mkdir pwntools && cd pwntools
python3 -m venv venv
source venv/bin/activate
pip install --upgrade pip
pip install pwntools

echo "alias pwntools='$HOME/tools/pwntools/venv/bin/python'" >> ~/.bashrc
source ~/.bashrc

pwntools is worth calling out specifically since it'll be our main coding framework for exploit development. This Python library makes common exploit development tasks way easier:

# Example of pwntools making binary exploitation easier
from pwn import *

# Set up binary and context
context.binary = "./vulnerable_program"
p = process("./vulnerable_program")

# Create cyclic pattern to find offset
payload = cyclic(500)
p.sendline(payload)
p.wait()
core = p.corefile
rsp = core.rsp
pattern_offset = cyclic_find(core.read(rsp, 4))

# Actual exploit with the correct offset
p = process("./vulnerable_program")
payload = flat(
    b"A" * pattern_offset,
    p64(address_of_win_function)
)
p.sendline(payload)
p.interactive()

Return-Oriented Programming (ROP) Tools

ROPgadget (Find ROP gadgets):

cd $HOME/tools
mkdir ROPGadget && cd ROPGadget
python3 -m venv venv
source venv/bin/activate
pip install --upgrade pip
pip install ROPGadget

echo "alias ropgadget='$HOME/tools/ROPGadget/venv/bin/ROPgadget'" >> ~/.bashrc
source ~/.bashrc

Ropper (Alternative ROP tool):

cd $HOME/tools
mkdir ropper && cd ropper
python3 -m venv venv
source venv/bin/activate
pip install --upgrade pip
pip install ropper

echo "alias ropper='$HOME/tools/ropper/venv/bin/ropper'" >> ~/.bashrc
source ~/.bashrc

Quick Exploitation Helpers

one_gadget (Find execve gadgets in libc):

cd $HOME/tools
mkdir one_gadget && cd one_gadget
python3 -m venv venv
source venv/bin/activate
pip install --upgrade pip
pip install one_gadget

echo "alias one_gadget='$HOME/tools/one_gadget/venv/bin/one_gadget'" >> ~/.bashrc
source ~/.bashrc

Compiler and Assembly Tools

Development Toolchain:

sudo apt install gcc g++ nasm make -y

You'll need these for building test programs, compiling shellcode, and creating custom exploits.

Fuzzing Tools: Automated Vulnerability Discovery

Fuzzing automates the process of finding vulnerabilities by throwing massive amounts of input data at programs and seeing what breaks. These tools can find bugs that manual analysis might miss.

Coverage-Guided Fuzzing

AFL (American Fuzzy Lop - Gold standard):

sudo apt install afl -y

AFL basically invented coverage-guided fuzzing and it's still really effective for finding vulnerabilities in file-parsing applications.

Performance-Focused Fuzzing

Honggfuzz (High-performance fuzzer):

cd $HOME/tools
git clone https://github.com/google/honggfuzz.git
cd honggfuzz

sudo apt install binutils-dev libunwind-dev libblocksruntime-dev libcapstone-dev clang -y

make && sudo make install

General-Purpose Fuzzing

Radamsa (Versatile mutation fuzzer):

cd $HOME/tools
git clone https://gitlab.com/akihe/radamsa.git
cd radamsa

make && sudo make install

Network Analysis: Protocol and Communication Analysis

For exploits that involve network protocols or remote targets, we need specialized tools for packet analysis and traffic manipulation.

Packet Analysis

Wireshark (The packet analysis tool):

sudo apt install wireshark -y

Network Utilities:

sudo apt install netcat-traditional proxychains4 -y

netcat: The "Swiss Army knife" of networking
proxychains: Route tools through proxies for anonymity or testing

Web Application Testing

Burp Suite Community:

cd $HOME/tools
wget https://portswigger.net/burp/releases/download?product=community&version=latest&type=Linux -O burpsuite.sh
chmod +x burpsuite.sh
./burpsuite.sh

Hex Editing and Binary Manipulation

wxHexEditor (GUI hex editor):

sudo apt install wxhexeditor -y

xxd Command-line hex utility:

sudo apt install xxd -y

Building Analysis Pipelines: Beyond Individual Tools

As you start using more and more of these tools, you'll get comfortable with them and start to figure out which combinations work really well together and how to use them to speed up your research. Here's a simple example of how different tools can work together in a typical workflow:

Pipeline Workflow

Initial Triage: Use basic tools (file, strings, objdump) to figure out what you're dealing with
Static Analysis: Dig deeper with Binary Ninja or whatever disassembler you prefer to find potential vulnerabilities
Dynamic Analysis: Check out suspicious code paths with GDB/GEF or whatever debugger works best for your target system
Vulnerability Confirmation: Build targeted tests to confirm you can actually exploit the bug
Exploit Development: Build and refine a working exploit using pwntools

This back-and-forth process between tools is the foundation of good vulnerability research.

Binary Ninja: Deep Dive and Configuration

Since Binary Ninja's gonna be our main analysis platform throughout this series, let's take a closer look at setting it up just right for exploit development work.

Key Features for Exploit Development

1. Linear vs. Graph View Both views are useful for different things:

Linear view shows every instruction one after another
Graph view shows how the control flow works

When I'm hunting for vulnerabilities, I usually start with graph view to understand how the program is structured, then switch to linear view when I need to analyze specific functions in detail.

2. Intermediate Language Layers Binary Ninja's IL system gives you multiple levels of abstraction:

Low Level IL (LLIL) - Close to assembly but standardized
Medium Level IL (MLIL) - Introduces variables and types
High Level IL (HLIL) - Looks more like source code

When I'm analyzing potential vulnerabilities, I typically work between MLIL and LLIL, using HLIL to get the big picture but dropping to lower levels when I need precision.

Essential Plugins for Exploit Development

A bunch of community plugins make Binary Ninja even better for exploit work:

Kaitai UI Plugin - Parse binary file formats
Annotate Functions - Better function documentation
Comments Viewer - Manage analysis comments
Dependency Analyzer - Visualize relationships between functions
Snippet UI Plugin - Save and reuse common analysis patterns
RopView - ROP gadget discovery and analysis
Shellcoder - Shellcode development assistance

Learning Curve Considerations: Where to Start

Don't feel overwhelmed by all these tools – nobody masters them all at once. Here's a reasonable way to approach learning them:

Phase 1: Foundation Tools

Binary Ninja (or whatever disassembler you choose)
GDB with your chosen extension (GEF/Pwndbg/PEDA)
Basic utilities (strings, file, objdump)

Phase 2: Development Tools

pwntools for exploit development
Process monitoring tools (strace, ltrace)
ROPgadget for advanced techniques

Phase 3: Specialized Tools

Fuzzing frameworks for vulnerability discovery
Advanced exploitation frameworks
Network analysis tools for protocol work

You should add each tool to your arsenal when you understand what it's for and you feel limited by your current toolset. The key is getting good with the core tools before expanding to specialized utilities.

Looking Ahead: From Tools to Techniques

Now that our exploit lab is fully loaded, we're ready to dive into the technical foundations of exploit development. Next week, we'll start exploring memory architecture by looking at virtual memory fundamentals – the critical foundation that underlies most modern exploitation techniques.

Having the right tools is important, but understanding how memory works at a deep level is what really enables exploit development. The tools we've talked about today are just the means, not the end – they help us see and manipulate the underlying systems where vulnerabilities live.

In my experience, the transition from having tools to actually using them effectively happens when you understand not just what each tool does, but when and why to use it. That understanding comes from practice and from developing an intuition about the exploitation process itself – something we'll build throughout this series.

Until Next Time

I hope this overview has given you a clearer picture of what's in an exploit developer's toolkit. Setting up these tools in your Parrot OS environment now will pay off big time throughout the rest of this series, since we'll be using them constantly in future posts.

The installation process might look intimidating, but remember that you don't need every tool right away. Start with the foundation tools, get comfortable with them, and gradually expand your toolkit as your skills grow.

Which of these tools are you most excited to explore? Got any favorite utilities or configurations that I didn't mention? Drop your thoughts in the comments, or hit me up on X – I'm always interested in learning about other researchers' preferred tools and workflows.

Until next time