// buffer_overflow_analysis.c - Educational buffer overflow examples
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/mman.h>
#include <stdint.h>

// WARNING: This code contains intentional vulnerabilities for educational purposes
// Never use these patterns in production code

// Classic stack buffer overflow
void vulnerable_function(char *input) {
    char buffer[64];
    
    // VULNERABILITY: No bounds checking
    strcpy(buffer, input);
    
    printf("Buffer contents: %s\n", buffer);
}

// Buffer overflow with return address overwrite
void stack_overflow_demo(char *input) {
    char buffer[64];
    char *ret_addr;
    
    printf("Stack layout analysis:\n");
    printf("  Buffer address: %p\n", buffer);
    printf("  Return address location: %p\n", &ret_addr);
    printf("  Distance: %ld bytes\n", (char*)&ret_addr - buffer);
    
    // Show stack before overflow
    printf("Stack before overflow:\n");
    for (int i = 0; i < 20; i++) {
        printf("  [%p]: 0x%08x\n", buffer + i*4, *(uint32_t*)(buffer + i*4));
    }
    
    strcpy(buffer, input);
    
    printf("Stack after overflow:\n");
    for (int i = 0; i < 20; i++) {
        printf("  [%p]: 0x%08x\n", buffer + i*4, *(uint32_t*)(buffer + i*4));
    }
}

// Heap buffer overflow
void heap_overflow_demo(char *input) {
    char *buffer1 = malloc(64);
    char *buffer2 = malloc(64);
    
    printf("Heap layout:\n");
    printf("  Buffer1: %p\n", buffer1);
    printf("  Buffer2: %p\n", buffer2);
    
    strcpy(buffer2, "SAFE_DATA");
    printf("Buffer2 before overflow: %s\n", buffer2);
    
    // VULNERABILITY: Overflow from buffer1 into buffer2
    strcpy(buffer1, input);
    
    printf("Buffer1 after input: %s\n", buffer1);
    printf("Buffer2 after overflow: %s\n", buffer2);
    
    free(buffer1);
    free(buffer2);
}

// Format string vulnerability
void format_string_demo(char *input) {
    int secret = 0xDEADBEEF;
    char buffer[256];
    
    printf("Secret value address: %p\n", &secret);
    printf("Secret value: 0x%x\n", secret);
    
    // VULNERABILITY: User input used directly in format string
    snprintf(buffer, sizeof(buffer), input);
    printf("Formatted output: %s\n", buffer);
    
    printf("Secret value after format: 0x%x\n", secret);
}

// Use-after-free vulnerability
typedef struct {
    void (*function_ptr)(void);
    char data[32];
} vulnerable_struct_t;

void safe_function(void) {
    printf("Safe function called\n");
}

void dangerous_function(void) {
    printf("Dangerous function called - EXPLOITED!\n");
}

void use_after_free_demo(void) {
    vulnerable_struct_t *obj1 = malloc(sizeof(vulnerable_struct_t));
    vulnerable_struct_t *obj2;
    
    obj1->function_ptr = safe_function;
    strcpy(obj1->data, "Original data");
    
    printf("Original object:\n");
    printf("  Function pointer: %p\n", obj1->function_ptr);
    printf("  Data: %s\n", obj1->data);
    
    // Free the object
    free(obj1);
    
    // Allocate new object (might reuse same memory)
    obj2 = malloc(sizeof(vulnerable_struct_t));
    obj2->function_ptr = dangerous_function;
    strcpy(obj2->data, "Attacker controlled");
    
    // VULNERABILITY: Use freed pointer
    printf("Calling function through freed pointer:\n");
    obj1->function_ptr();
    
    free(obj2);
}

// Integer overflow leading to buffer overflow
void integer_overflow_demo(size_t size) {
    if (size > 1024) {
        printf("Size too large\n");
        return;
    }
    
    // VULNERABILITY: Integer overflow in allocation size calculation
    size_t alloc_size = size * sizeof(int) + sizeof(int);
    
    if (alloc_size < size) {
        printf("Integer overflow detected!\n");
        return;
    }
    
    int *buffer = malloc(alloc_size);
    if (!buffer) {
        printf("Allocation failed\n");
        return;
    }
    
    // This will overflow if alloc_size wrapped around
    for (size_t i = 0; i <= size; i++) {
        buffer[i] = i;
    }
    
    printf("Buffer filled successfully\n");
    free(buffer);
}

// Stack canary bypass demonstration
void stack_canary_analysis(void) {
    char buffer[64];
    
    printf("Stack canary analysis:\n");
    
    // Try to locate stack canary
    uint64_t *stack_ptr = (uint64_t*)buffer;
    
    printf("Stack contents around buffer:\n");
    for (int i = -4; i < 20; i++) {
        printf("  [%d]: 0x%016lx\n", i, stack_ptr[i]);
        
        // Look for canary pattern (null byte terminated)
        if ((stack_ptr[i] & 0xFF) == 0 && (stack_ptr[i] >> 8) != 0) {
            printf("    ^ Possible stack canary\n");
        }
    }
}

// Memory layout analysis
void memory_layout_analysis(void) {
    char stack_var[64];
    char *heap_var = malloc(64);
    static char data_var[64] = "data section";
    const char *text_ptr = memory_layout_analysis;
    
    printf("Memory layout analysis:\n");
    printf("  Stack variable: %p\n", stack_var);
    printf("  Heap variable:  %p\n", heap_var);
    printf("  Data section:   %p\n", data_var);
    printf("  Text section:   %p\n", text_ptr);
    printf("  Library function: %p\n", printf);
    
    // Check ASLR
    static int call_count = 0;
    call_count++;
    
    if (call_count == 1) {
        printf("\nCall this function multiple times to observe ASLR:\n");
    } else {
        printf("  Call #%d - addresses may differ due to ASLR\n", call_count);
    }
    
    free(heap_var);
}

// Exploit mitigation demonstration
void mitigation_demo(void) {
    printf("=== Exploit Mitigation Demonstration ===\n\n");
    
    // Check DEP/NX bit
    printf("1. DEP/NX Bit Protection:\n");
    char *executable_memory = mmap(NULL, 4096, PROT_READ | PROT_WRITE | PROT_EXEC,
                                  MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
    
    if (executable_memory == MAP_FAILED) {
        printf("   Cannot allocate executable memory - DEP/NX protection active\n");
    } else {
        printf("   Executable memory allocated at: %p\n", executable_memory);
        printf("   DEP/NX protection may be disabled\n");
        munmap(executable_memory, 4096);
    }
    
    // Stack canary check
    printf("\n2. Stack Canary Protection:\n");
    stack_canary_analysis();
    
    // ASLR check
    printf("\n3. ASLR (Address Space Layout Randomization):\n");
    memory_layout_analysis();
    
    // FORTIFY_SOURCE check
    printf("\n4. FORTIFY_SOURCE Protection:\n");
    #ifdef _FORTIFY_SOURCE
    printf("   FORTIFY_SOURCE level: %d\n", _FORTIFY_SOURCE);
    #else
    printf("   FORTIFY_SOURCE not enabled\n");
    #endif
    
    // PIE check
    printf("\n5. PIE (Position Independent Executable):\n");
    if ((uintptr_t)main < 0x400000) {
        printf("   PIE likely enabled (main at %p)\n", main);
    } else {
        printf("   PIE likely disabled (main at %p)\n", main);
    }
}

// Safe string handling examples
void safe_string_handling_demo(void) {
    printf("=== Safe String Handling Examples ===\n\n");
    
    char buffer[64];
    char *input = "This is a very long string that could potentially overflow a buffer if not handled properly";
    
    // Unsafe: strcpy
    printf("1. Unsafe strcpy (commented out for safety):\n");
    printf("   // strcpy(buffer, input); // NEVER DO THIS\n");
    
    // Safe: strncpy with null termination
    printf("2. Safe strncpy:\n");
    strncpy(buffer, input, sizeof(buffer) - 1);
    buffer[sizeof(buffer) - 1] = '\0';
    printf("   Result: %.50s...\n", buffer);
    
    // Safe: snprintf
    printf("3. Safe snprintf:\n");
    snprintf(buffer, sizeof(buffer), "Input: %.30s", input);
    printf("   Result: %s\n", buffer);
    
    // Safe: strlcpy (if available)
    printf("4. Safe strlcpy (BSD extension):\n");
    #ifdef __has_include
    #if __has_include(<bsd/string.h>)
    #include <bsd/string.h>
    size_t copied = strlcpy(buffer, input, sizeof(buffer));
    printf("   Copied %zu bytes: %s\n", copied, buffer);
    #else
    printf("   strlcpy not available\n");
    #endif
    #endif
}

int main(int argc, char *argv[]) {
    printf("Linux Security Exploit Development and Mitigation Demo\n");
    printf("======================================================\n\n");
    
    if (argc < 2) {
        printf("Available demos:\n");
        printf("  mitigation  - Show exploit mitigation techniques\n");
        printf("  memory      - Memory layout analysis\n");
        printf("  safe        - Safe programming examples\n");
        printf("  stack       - Stack overflow demo (requires input)\n");
        printf("  heap        - Heap overflow demo (requires input)\n");
        printf("  format      - Format string demo (requires input)\n");
        printf("  uaf         - Use-after-free demo\n");
        printf("  integer     - Integer overflow demo\n");
        return 1;
    }
    
    if (strcmp(argv[1], "mitigation") == 0) {
        mitigation_demo();
    } else if (strcmp(argv[1], "memory") == 0) {
        memory_layout_analysis();
    } else if (strcmp(argv[1], "safe") == 0) {
        safe_string_handling_demo();
    } else if (strcmp(argv[1], "stack") == 0 && argc > 2) {
        stack_overflow_demo(argv[2]);
    } else if (strcmp(argv[1], "heap") == 0 && argc > 2) {
        heap_overflow_demo(argv[2]);
    } else if (strcmp(argv[1], "format") == 0 && argc > 2) {
        format_string_demo(argv[2]);
    } else if (strcmp(argv[1], "uaf") == 0) {
        use_after_free_demo();
    } else if (strcmp(argv[1], "integer") == 0) {
        integer_overflow_demo(0xFFFFFFFF);
    } else {
        printf("Invalid demo or missing parameters\n");
        return 1;
    }
    
    return 0;
}

// rop_chain_analysis.c - ROP (Return-Oriented Programming) analysis
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/mman.h>
#include <stdint.h>
#include <elf.h>

// ROP gadget structure
typedef struct {
    uintptr_t address;
    char description[64];
    uint8_t *bytes;
    size_t length;
} rop_gadget_t;

// ROP chain builder
typedef struct {
    uintptr_t *chain;
    size_t capacity;
    size_t length;
} rop_chain_t;

// Initialize ROP chain
rop_chain_t* rop_chain_create(size_t capacity) {
    rop_chain_t *chain = malloc(sizeof(rop_chain_t));
    if (!chain) return NULL;
    
    chain->chain = calloc(capacity, sizeof(uintptr_t));
    if (!chain->chain) {
        free(chain);
        return NULL;
    }
    
    chain->capacity = capacity;
    chain->length = 0;
    
    return chain;
}

// Add gadget to ROP chain
int rop_chain_add(rop_chain_t *chain, uintptr_t address) {
    if (chain->length >= chain->capacity) {
        return -1;
    }
    
    chain->chain[chain->length++] = address;
    return 0;
}

// Find ROP gadgets in memory
void find_rop_gadgets(void *start_addr, size_t size, rop_gadget_t *gadgets, size_t *count) {
    uint8_t *memory = (uint8_t *)start_addr;
    size_t found = 0;
    
    printf("Searching for ROP gadgets in memory region %p - %p\n", 
           start_addr, (char*)start_addr + size);
    
    for (size_t i = 0; i < size - 2 && found < *count; i++) {
        // Look for 'ret' instruction (0xc3)
        if (memory[i] == 0xc3) {
            // Check for useful gadgets before the ret
            
            // pop rdi; ret (0x5f 0xc3)
            if (i > 0 && memory[i-1] == 0x5f) {
                gadgets[found].address = (uintptr_t)(memory + i - 1);
                strcpy(gadgets[found].description, "pop rdi; ret");
                gadgets[found].bytes = &memory[i-1];
                gadgets[found].length = 2;
                found++;
                continue;
            }
            
            // pop rsi; ret (0x5e 0xc3)
            if (i > 0 && memory[i-1] == 0x5e) {
                gadgets[found].address = (uintptr_t)(memory + i - 1);
                strcpy(gadgets[found].description, "pop rsi; ret");
                gadgets[found].bytes = &memory[i-1];
                gadgets[found].length = 2;
                found++;
                continue;
            }
            
            // pop rdx; ret (0x5a 0xc3)
            if (i > 0 && memory[i-1] == 0x5a) {
                gadgets[found].address = (uintptr_t)(memory + i - 1);
                strcpy(gadgets[found].description, "pop rdx; ret");
                gadgets[found].bytes = &memory[i-1];
                gadgets[found].length = 2;
                found++;
                continue;
            }
            
            // pop rax; ret (0x58 0xc3)
            if (i > 0 && memory[i-1] == 0x58) {
                gadgets[found].address = (uintptr_t)(memory + i - 1);
                strcpy(gadgets[found].description, "pop rax; ret");
                gadgets[found].bytes = &memory[i-1];
                gadgets[found].length = 2;
                found++;
                continue;
            }
            
            // syscall; ret (0x0f 0x05 0xc3)
            if (i > 1 && memory[i-2] == 0x0f && memory[i-1] == 0x05) {
                gadgets[found].address = (uintptr_t)(memory + i - 2);
                strcpy(gadgets[found].description, "syscall; ret");
                gadgets[found].bytes = &memory[i-2];
                gadgets[found].length = 3;
                found++;
                continue;
            }
        }
    }
    
    *count = found;
    printf("Found %zu gadgets\n", found);
}

// Demonstrate ROP chain construction
void demonstrate_rop_chain(void) {
    printf("=== ROP Chain Construction Demonstration ===\n\n");
    
    // Search for gadgets in the current binary
    rop_gadget_t gadgets[32];
    size_t gadget_count = 32;
    
    // Get approximate text section bounds
    extern char _start, _end;
    void *text_start = &_start;
    size_t text_size = 65536; // Approximate
    
    find_rop_gadgets(text_start, text_size, gadgets, &gadget_count);
    
    printf("\nFound gadgets:\n");
    for (size_t i = 0; i < gadget_count; i++) {
        printf("  %p: %s", (void*)gadgets[i].address, gadgets[i].description);
        printf(" (");
        for (size_t j = 0; j < gadgets[i].length; j++) {
            printf("%02x ", gadgets[i].bytes[j]);
        }
        printf(")\n");
    }
    
    // Construct example ROP chain for execve("/bin/sh", NULL, NULL)
    printf("\nConstructing ROP chain for execve(\"/bin/sh\", NULL, NULL):\n");
    
    rop_chain_t *chain = rop_chain_create(16);
    
    // This is a simplified example - real ROP chains need actual gadget addresses
    printf("1. Set rax = 59 (execve syscall number)\n");
    printf("2. Set rdi = pointer to \"/bin/sh\"\n");
    printf("3. Set rsi = NULL\n");
    printf("4. Set rdx = NULL\n");
    printf("5. Call syscall\n");
    
    // In a real exploit, you would:
    // 1. Find actual gadget addresses
    // 2. Set up the string "/bin/sh" in memory
    // 3. Chain the gadgets together
    
    printf("\nROP chain would look like:\n");
    printf("  [overflow padding]\n");
    printf("  [pop rax; ret gadget address]\n");
    printf("  [59 (execve syscall number)]\n");
    printf("  [pop rdi; ret gadget address]\n");
    printf("  [address of \"/bin/sh\" string]\n");
    printf("  [pop rsi; ret gadget address]\n");
    printf("  [0 (NULL)]\n");
    printf("  [pop rdx; ret gadget address]\n");
    printf("  [0 (NULL)]\n");
    printf("  [syscall; ret gadget address]\n");
    
    free(chain->chain);
    free(chain);
}

// ASLR bypass techniques
void aslr_bypass_demo(void) {
    printf("=== ASLR Bypass Techniques ===\n\n");
    
    // Information disclosure
    printf("1. Information Disclosure:\n");
    printf("   Stack address: %p\n", &aslr_bypass_demo);
    printf("   Heap address: %p\n", malloc(1));
    printf("   Library address: %p\n", printf);
    
    // Brute force (demonstration only)
    printf("\n2. Brute Force Attack Simulation:\n");
    printf("   ASLR entropy on x86_64:\n");
    printf("   - Stack: ~19 bits (1 in 524,288 chance)\n");
    printf("   - Heap: ~13 bits (1 in 8,192 chance)\n");
    printf("   - Libraries: ~19 bits (1 in 524,288 chance)\n");
    printf("   PIE: ~19 bits (1 in 524,288 chance)\n");
    
    // Partial overwrites
    printf("\n3. Partial Overwrite Technique:\n");
    char *stack_addr = (char*)&aslr_bypass_demo;
    printf("   Current function address: %p\n", stack_addr);
    printf("   Last 12 bits (page offset): 0x%03lx\n", 
           (uintptr_t)stack_addr & 0xFFF);
    printf("   Partial overwrite can modify only lower bits\n");
    
    // Return-to-PLT
    printf("\n4. Return-to-PLT/GOT:\n");
    printf("   PLT entries have fixed offsets relative to binary base\n");
    printf("   Can call library functions without knowing their addresses\n");
    
    free(malloc(1)); // Clean up the malloc from earlier
}

// Stack smashing protection bypass
void stack_protection_bypass(void) {
    printf("=== Stack Protection Bypass Techniques ===\n\n");
    
    // Canary analysis
    printf("1. Stack Canary Analysis:\n");
    char buffer[64];
    uint64_t *stack_ptr = (uint64_t*)buffer;
    
    // Look for canary
    for (int i = 8; i < 16; i++) {
        if ((stack_ptr[i] & 0xFF) == 0) {
            printf("   Possible canary at offset %d: 0x%016lx\n", 
                   i * 8, stack_ptr[i]);
        }
    }
    
    // Canary bypass techniques
    printf("\n2. Canary Bypass Techniques:\n");
    printf("   a) Information disclosure to leak canary\n");
    printf("   b) Brute force single byte at a time\n");
    printf("   c) Fork-based brute force (if fork preserves canary)\n");
    printf("   d) Jump over canary check\n");
    printf("   e) Overwrite exception handlers before canary check\n");
    
    // Shadow stack
    printf("\n3. Shadow Stack Protection:\n");
    printf("   Intel CET (Control-flow Enforcement Technology)\n");
    printf("   - Hardware shadow stack for return addresses\n");
    printf("   - Indirect branch tracking\n");
    
    #ifdef __CET__
    printf("   CET support: Enabled\n");
    #else
    printf("   CET support: Not detected\n");
    #endif
}

// Format string exploitation
void format_string_exploitation_demo(void) {
    printf("=== Format String Exploitation ===\n\n");
    
    int target_variable = 0x41414141;
    char buffer[256];
    
    printf("Target variable address: %p\n", &target_variable);
    printf("Target variable value: 0x%08x\n", target_variable);
    
    printf("\n1. Reading from Stack:\n");
    // %n$x reads the n-th argument from stack
    snprintf(buffer, sizeof(buffer), "Stack dump: %08x %08x %08x %08x");
    printf("   Format: %%08x %%08x %%08x %%08x\n");
    printf("   Result: %s\n", buffer);
    
    printf("\n2. Writing to Memory (%%n specifier):\n");
    printf("   %%n writes number of characters printed so far\n");
    printf("   Can be used to overwrite memory locations\n");
    printf("   Example: printf(\"AAAA%%8x%%n\", addr) writes 12 to addr\n");
    
    printf("\n3. Direct Parameter Access:\n");
    printf("   %%6$x reads 6th parameter directly\n");
    printf("   Useful for targeting specific stack positions\n");
    
    printf("\n4. Width Specifiers for Precise Writes:\n");
    printf("   %%2048x%%n writes 2048 + existing chars\n");
    printf("   Can construct arbitrary values byte by byte\n");
    
    printf("\nTarget variable after demo: 0x%08x\n", target_variable);
}

int main(int argc, char *argv[]) {
    printf("Advanced Exploitation Techniques Demo\n");
    printf("=====================================\n\n");
    
    if (argc < 2) {
        printf("Available demos:\n");
        printf("  rop        - ROP chain construction\n");
        printf("  aslr       - ASLR bypass techniques\n");
        printf("  stack      - Stack protection bypass\n");
        printf("  format     - Format string exploitation\n");
        printf("  all        - Run all demos\n");
        return 1;
    }
    
    if (strcmp(argv[1], "rop") == 0 || strcmp(argv[1], "all") == 0) {
        demonstrate_rop_chain();
        printf("\n");
    }
    
    if (strcmp(argv[1], "aslr") == 0 || strcmp(argv[1], "all") == 0) {
        aslr_bypass_demo();
        printf("\n");
    }
    
    if (strcmp(argv[1], "stack") == 0 || strcmp(argv[1], "all") == 0) {
        stack_protection_bypass();
        printf("\n");
    }
    
    if (strcmp(argv[1], "format") == 0 || strcmp(argv[1], "all") == 0) {
        format_string_exploitation_demo();
        printf("\n");
    }
    
    return 0;
}

#!/bin/bash
# security_analysis.sh - Comprehensive security analysis tools

# Binary security analysis
analyze_binary_security() {
    local binary=${1:-"/bin/ls"}
    
    echo "=== Binary Security Analysis: $binary ==="
    
    if [ ! -f "$binary" ]; then
        echo "Binary not found: $binary"
        return 1
    fi
    
    # Basic file information
    echo "File information:"
    file "$binary"
    echo
    
    # Check ELF security features
    echo "ELF Security Features:"
    
    # NX bit / DEP
    if readelf -l "$binary" 2>/dev/null | grep -q "GNU_STACK.*RWE"; then
        echo "  ✗ NX/DEP: Disabled (executable stack)"
    elif readelf -l "$binary" 2>/dev/null | grep -q "GNU_STACK.*RW"; then
        echo "  ✓ NX/DEP: Enabled (non-executable stack)"
    else
        echo "  ? NX/DEP: Unknown"
    fi
    
    # PIE (Position Independent Executable)
    if readelf -h "$binary" 2>/dev/null | grep -q "DYN"; then
        echo "  ✓ PIE: Enabled"
    elif readelf -h "$binary" 2>/dev/null | grep -q "EXEC"; then
        echo "  ✗ PIE: Disabled"
    else
        echo "  ? PIE: Unknown"
    fi
    
    # Stack canaries
    if objdump -d "$binary" 2>/dev/null | grep -q "__stack_chk_fail"; then
        echo "  ✓ Stack Canaries: Enabled"
    else
        echo "  ✗ Stack Canaries: Not detected"
    fi
    
    # FORTIFY_SOURCE
    if objdump -d "$binary" 2>/dev/null | grep -q "__.*_chk"; then
        echo "  ✓ FORTIFY_SOURCE: Enabled"
    else
        echo "  ✗ FORTIFY_SOURCE: Not detected"
    fi
    
    # RELRO (RELocation Read-Only)
    if readelf -l "$binary" 2>/dev/null | grep -q "GNU_RELRO"; then
        if readelf -d "$binary" 2>/dev/null | grep -q "BIND_NOW"; then
            echo "  ✓ RELRO: Full"
        else
            echo "  ⚠ RELRO: Partial"
        fi
    else
        echo "  ✗ RELRO: Disabled"
    fi
    
    # RPATH/RUNPATH security
    echo
    echo "RPATH/RUNPATH Analysis:"
    local rpath=$(readelf -d "$binary" 2>/dev/null | grep -E "(RPATH|RUNPATH)")
    if [ -n "$rpath" ]; then
        echo "  ⚠ RPATH/RUNPATH found:"
        echo "$rpath" | sed 's/^/    /'
        
        # Check for insecure paths
        if echo "$rpath" | grep -qE "(\.|/tmp|/var/tmp)"; then
            echo "  ✗ Insecure RPATH detected!"
        fi
    else
        echo "  ✓ No RPATH/RUNPATH"
    fi
    
    # Check for dangerous functions
    echo
    echo "Dangerous Function Analysis:"
    local dangerous_funcs=("strcpy" "strcat" "sprintf" "gets" "scanf" "system")
    
    for func in "${dangerous_funcs[@]}"; do
        if objdump -T "$binary" 2>/dev/null | grep -q "$func"; then
            echo "  ⚠ Uses dangerous function: $func"
        fi
    done
    
    # Check symbols
    echo
    echo "Symbol Analysis:"
    local symbol_count=$(readelf -s "$binary" 2>/dev/null | grep -c "FUNC.*GLOBAL")
    echo "  Global functions: $symbol_count"
    
    if nm -D "$binary" 2>/dev/null | grep -q "^[0-9a-f]"; then
        echo "  ✗ Symbols not stripped"
    else
        echo "  ✓ Symbols stripped"
    fi
}

# System-wide security analysis
analyze_system_security() {
    echo "=== System-wide Security Analysis ==="
    
    # Kernel security features
    echo "Kernel Security Features:"
    
    # KASLR
    if [ -f /proc/sys/kernel/randomize_va_space ]; then
        local aslr_level=$(cat /proc/sys/kernel/randomize_va_space)
        case $aslr_level in
            0) echo "  ✗ ASLR: Disabled" ;;
            1) echo "  ⚠ ASLR: Conservative" ;;
            2) echo "  ✓ ASLR: Full randomization" ;;
            *) echo "  ? ASLR: Unknown level ($aslr_level)" ;;
        esac
    fi
    
    # SMEP/SMAP
    if grep -q smep /proc/cpuinfo; then
        echo "  ✓ SMEP: Available"
    else
        echo "  ✗ SMEP: Not available"
    fi
    
    if grep -q smap /proc/cpuinfo; then
        echo "  ✓ SMAP: Available"
    else
        echo "  ✗ SMAP: Not available"
    fi
    
    # Control Flow Integrity
    if grep -q cet /proc/cpuinfo; then
        echo "  ✓ Intel CET: Available"
    else
        echo "  ✗ Intel CET: Not available"
    fi
    
    # Kernel mitigations
    echo
    echo "Kernel Mitigations:"
    if [ -f /proc/sys/kernel/kptr_restrict ]; then
        local kptr=$(cat /proc/sys/kernel/kptr_restrict)
        echo "  Kernel pointer restriction: $kptr"
    fi
    
    if [ -f /proc/sys/kernel/dmesg_restrict ]; then
        local dmesg=$(cat /proc/sys/kernel/dmesg_restrict)
        echo "  dmesg restriction: $dmesg"
    fi
    
    if [ -f /proc/sys/kernel/perf_event_paranoid ]; then
        local perf=$(cat /proc/sys/kernel/perf_event_paranoid)
        echo "  perf_event restriction: $perf"
    fi
    
    # Check for Spectre/Meltdown mitigations
    echo
    echo "Spectre/Meltdown Mitigations:"
    if [ -f /sys/devices/system/cpu/vulnerabilities/spectre_v1 ]; then
        echo "  Spectre v1: $(cat /sys/devices/system/cpu/vulnerabilities/spectre_v1)"
    fi
    if [ -f /sys/devices/system/cpu/vulnerabilities/spectre_v2 ]; then
        echo "  Spectre v2: $(cat /sys/devices/system/cpu/vulnerabilities/spectre_v2)"
    fi
    if [ -f /sys/devices/system/cpu/vulnerabilities/meltdown ]; then
        echo "  Meltdown: $(cat /sys/devices/system/cpu/vulnerabilities/meltdown)"
    fi
    
    # Memory protections
    echo
    echo "Memory Protections:"
    
    # Check for SMACK, SELinux, AppArmor
    if command -v getenforce >/dev/null 2>&1; then
        local selinux_status=$(getenforce 2>/dev/null)
        echo "  SELinux: $selinux_status"
    fi
    
    if [ -f /sys/kernel/security/apparmor/profiles ]; then
        local apparmor_profiles=$(wc -l < /sys/kernel/security/apparmor/profiles)
        echo "  AppArmor: $apparmor_profiles profiles loaded"
    fi
    
    if [ -f /sys/fs/smackfs/load ]; then
        echo "  SMACK: Enabled"
    fi
    
    # Grsecurity/PaX (if present)
    if [ -f /proc/sys/kernel/grsecurity ]; then
        echo "  Grsecurity: Enabled"
    fi
}

# Vulnerability scanning
vulnerability_scan() {
    local target_dir=${1:-"/usr/bin"}
    
    echo "=== Vulnerability Scanning: $target_dir ==="
    
    # Install scanning tools if needed
    if ! command -v checksec >/dev/null; then
        echo "Installing checksec..."
        wget -O /usr/local/bin/checksec https://github.com/slimm609/checksec.sh/raw/main/checksec
        chmod +x /usr/local/bin/checksec
    fi
    
    # Scan binaries for security features
    echo "Scanning binaries for security features..."
    
    find "$target_dir" -type f -executable | head -20 | while read binary; do
        echo
        echo "--- $binary ---"
        checksec --file="$binary" 2>/dev/null || analyze_binary_security "$binary"
    done
    
    # Check for SUID/SGID binaries
    echo
    echo "SUID/SGID Binary Analysis:"
    find /usr -perm -u+s -type f 2>/dev/null | head -10 | while read suid_binary; do
        echo "  SUID: $suid_binary"
        ls -la "$suid_binary"
    done
    
    find /usr -perm -g+s -type f 2>/dev/null | head -10 | while read sgid_binary; do
        echo "  SGID: $sgid_binary"
        ls -la "$sgid_binary"
    done
}

# Exploit development environment setup
setup_exploit_dev_environment() {
    echo "=== Exploit Development Environment Setup ==="
    
    # Install development tools
    echo "Installing exploit development tools..."
    
    apt-get update
    apt-get install -y \
        gcc \
        gdb \
        python3 \
        python3-pip \
        radare2 \
        objdump \
        readelf \
        ltrace \
        strace \
        valgrind \
        binutils \
        patchelf
    
    # Install useful Python libraries
    pip3 install pwntools ropper
    
    # Install additional tools
    if ! command -v one_gadget >/dev/null; then
        gem install one_gadget 2>/dev/null || echo "Could not install one_gadget (ruby required)"
    fi
    
    # GDB enhancements
    echo "Setting up GDB enhancements..."
    
    # Install GEF
    if [ ! -f ~/.gdbinit ] || ! grep -q "gef" ~/.gdbinit; then
        wget -O ~/.gdbinit-gef.py https://github.com/hugsy/gef/raw/master/gef.py
        echo "source ~/.gdbinit-gef.py" >> ~/.gdbinit
    fi
    
    # Disable ASLR for testing
    echo "To disable ASLR for exploit development:"
    echo "  echo 0 | sudo tee /proc/sys/kernel/randomize_va_space"
    echo
    echo "To re-enable ASLR:"
    echo "  echo 2 | sudo tee /proc/sys/kernel/randomize_va_space"
    
    echo "Exploit development environment setup complete!"
}

# Secure coding guidelines
show_secure_coding_guidelines() {
    echo "=== Secure Coding Guidelines ==="
    
    cat << 'EOF'
1. Input Validation:
   - Always validate input length, type, and content
   - Use safe string functions (strncpy, snprintf, strlcpy)
   - Implement proper bounds checking

2. Memory Management:
   - Initialize all variables
   - Check return values of malloc/calloc
   - Always free dynamically allocated memory
   - Set pointers to NULL after freeing
   - Use tools like valgrind to detect memory errors

3. Integer Handling:
   - Check for integer overflow/underflow
   - Use safe arithmetic functions where available
   - Be careful with signed/unsigned conversions

4. Format Strings:
   - Never use user input directly in format strings
   - Use printf("%s", user_input) instead of printf(user_input)

5. Compilation Options:
   - Enable stack protection: -fstack-protector-strong
   - Enable FORTIFY_SOURCE: -D_FORTIFY_SOURCE=2
   - Enable PIE: -fPIE -pie
   - Enable full RELRO: -Wl,-z,relro,-z,now
   - Enable NX bit: -Wl,-z,noexecstack

6. Static Analysis:
   - Use static analysis tools (cppcheck, clang-static-analyzer)
   - Enable compiler warnings: -Wall -Wextra -Werror
   - Use sanitizers during development: -fsanitize=address,undefined

7. Privilege Management:
   - Follow principle of least privilege
   - Drop privileges as soon as possible
   - Use secure IPC mechanisms

8. Cryptography:
   - Use well-established cryptographic libraries
   - Generate random numbers securely
   - Properly handle cryptographic keys

Example secure compilation:
gcc -O2 -fstack-protector-strong -D_FORTIFY_SOURCE=2 -fPIE -pie \
    -Wl,-z,relro,-z,now -Wl,-z,noexecstack \
    -Wall -Wextra -Werror \
    source.c -o secure_binary

EOF
}

# Main function
main() {
    local action=${1:-"help"}
    
    case "$action" in
        "binary")
            analyze_binary_security "$2"
            ;;
        "system")
            analyze_system_security
            ;;
        "scan")
            vulnerability_scan "$2"
            ;;
        "setup")
            setup_exploit_dev_environment
            ;;
        "guidelines")
            show_secure_coding_guidelines
            ;;
        "all")
            analyze_system_security
            echo
            analyze_binary_security "/bin/ls"
            echo
            show_secure_coding_guidelines
            ;;
        *)
            echo "Security Analysis Tools"
            echo "======================"
            echo
            echo "Usage: $0 <command> [args]"
            echo
            echo "Commands:"
            echo "  binary <file>     - Analyze binary security features"
            echo "  system           - Analyze system-wide security"
            echo "  scan <dir>       - Scan directory for vulnerabilities"
            echo "  setup            - Setup exploit development environment"
            echo "  guidelines       - Show secure coding guidelines"
            echo "  all              - Run system and binary analysis"
            ;;
    esac
}

main "$@"