karkinos - A thorough library database to assist with binary

项目说明

Karkinos
==========

A large library database to assist in binary exploitation on Linux. This tool
can help identify unknown libraries by pro the location of known symbols,
it can help locate the name of packages that contain a gi and it can
find the debugging of a library you are working with.

Once the library is identified you can dump useful information such as symbols
(both exported symbols and special useful calculated locations that are useful
for exploitation), gadgets for ROP chains or one shot (AKA magic gadgets or one
gadgets) and their constraints.

The usage is inspired by the excellent libc-database.

It supports many architectures including:

* x86 (i386 / amd64)
* arm (arm / arm64)
* mips (mips / mips64)
* ppc (ppc / ppc64)
* sparc (sparc / sparc64)
* sh4
* hppa
* m68k
* riscv

There are many libraries indexed over many distributions spanning many years. The
libraries indexed are:

* glibc
* libstdc++
* glibc-ld
* libgcc
* musl

Install
-------

The preferred method is to just download and extract the latest release. Karkinos
will manage updates by itself from that point on. Alternatively, you can clone this repository.

Once you ha through either method, you can then access the tool by running:

$ ./kark.py --help

On the first run it will attempt to extract the databases from the compressed files,
you will need to have the xz and cat binaries installed and a through the PATH env
var.

Usage
-----

usage: kark.py [-h] [--libdb {glibc,libstdc++}] [--distro DISTRO]
[--arch {x86,amd64,i386,arm,arm64,mips,mips64,ppc,ppc64,sparc,sparc64,m68k,hppa,sh4}]
[--endian {little,big}]
{find,dump,info,update} ...

description:
karkinos is a library database to assist with exploitation by helping to
identify libraries from known offsets or to dump useful offsets from those
identified libraries. Each database indexes symbols, gadgets and where
possible one shot gadgets (AKA magic gadgets or one gadgets).

architectures indexed:
- x86 (amd64, i386)
- arm (arm, arm64)
- mips (mips, mips64)
- ppc (ppc, ppc64)
- sparc (sparc, sparc64)
- m68k
- hppa
- sh4
- riscv

libraries indexed:
- glibc
- libstdc++
- glibc-ld
- libgcc
- musl

commands:
- find find a library by symbol offsets, file, build id or file hash
- dump dump symbols/gadgets for a gi
- info print some information about a specific library
- update check for updates to the database
- display information and exit

positional arguments:
{find,dump,info,update}
command to execute
args arguments for specific command, see examples

optional arguments:
-h, --help show this help message and exit
--libdb {glibc,libstdc++}
the library database to use
--distro DISTRO the linux distribution to filter in symbol search
--arch {x86,amd64,i386,arm,arm64,mips,mips64,ppc,ppc64,sparc,sparc64,m68k,hppa,sh4}
architecture to filter in symbol search
--endian {little,big}
endianess to filter in symbol search

examples:
./kark.py find fgets b20 puts 9c0 fwrite 8a0
./kark.py find 50390b2ae8aaa73c47745040f54e602f
./kark.py find b417c0ba7cc5cf06d1d1bed6652cedb9253c60d0
./kark.py find /lib/x86_64-linux-gnu/libc.so.6
./kark.py --arch arm --endian big find system 440
./kark.py --distro ubuntu fgets b20 puts 9c0
./kark.py dump centos_glibc-2.12-1.107.el6_4.2.x86_64
./kark.py dump opensuse_glibc-2.19-16.9.1.i686 fgets system str_bin_sh
./kark.py info ubuntu_libc6-udeb_2.27-3ubuntu1_amd64
./kark.py update

Screenshots
-----------

!Karkinos

TODO
----

* Make the database faster (queries are far from optimised)
* Make the database smaller (schema is not optimal)
* Clean the code up (was hobbled together very quickly)
* More gadgets, more one shot gadgets
* Make usable as a library (remo, reorganise code)

Contact
-------

@0xb0bb

项目信息

开发语言：Python

Star 数：198

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A thorough library database to assist with binary exploitation tasks.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。