Billy-Ellis/Exploit-Challenges
FreeA collection of vulnerable ARM binaries for practicing exploit development
FreeFree tier
About Billy-Ellis/Exploit-Challenges
A GitHub repository containing a collection of vulnerable ARM binaries (ARMv7 Mach-O executables) designed for beginner vulnerability researchers and exploit developers. The binaries cover essential exploitation techniques including Return-Oriented Programming (7 levels), heap exploitation (3 levels covering overflow, use-after-free, and double free), and a real-world style example (Xylex). Also includes some ARM64 versions. Recommended for testing on jailbroken iOS devices with radare2 or similar debugging tools. Write-ups and explanations are available via the author's YouTube channel and book.
Key Features
Collection of vulnerable ARM binaries for practicing exploit development
Includes 7 ROP challenges (roplevel1-7) covering simple ROP, ASLR, format string leaks, stack pivoting, and off-by-one
Includes 3 heap exploitation challenges (heaplevel1-3) covering overflow, use-after-free, and double free
Real-world style challenge (Xylex) for applied learning
ARM64 versions of select challenges (roplevel1-64, roplevel6-64)
Recommended for use with radare2 on jailbroken iOS devices
Write-ups available on the author's YouTube channel and in the book 'Beginner's Guide to Exploitation on ARM'
Pros & Cons
Pros
- Beginner-friendly with progressive difficulty from simple to advanced challenges
- Covers essential exploitation techniques: ROP, heap, format string, ASLR, stack pivoting
- Includes a real-world style challenge (Xylex) for practical application
- Free and open-source with no licensing restrictions
- Accompanied by video write-ups and a dedicated book for guidance
Cons
- Requires a jailbroken iOS device or ARM emulator to run the ARMv7 binaries
- Only targets ARM architecture; no x86 or other architectures included
- No pre-built binary releases or packages provided; users must build or clone the repo
- Documentation within the repository is minimal; external resources (YouTube, book) are needed for write-ups
Best For
Learning ARM binary exploitation fundamentalsPracticing Return-Oriented Programming (ROP) techniquesPracticing heap exploitation (overflow, use-after-free, double free)Preparing for ARM-based exploit development challengesEducational resource for vulnerability research courses or self-study
FAQ
What architecture are the binaries?
The binaries are primarily ARMv7 Mach-O executables (32-bit). Some ARM64 versions are also included, as noted in the repository.
What tools should I use to debug these challenges?
It is recommended to use radare2 or another debugging utility on a 32-bit jailbroken iOS device to test the binaries.
Are there write-ups or solutions available?
Yes, write-ups and explanations for some of the challenges are available on the author's YouTube channel and in the book 'Beginner's Guide to Exploitation on ARM'.
Is this suitable for complete beginners?
Yes, the challenges are designed for beginner vulnerability researchers and exploit developers, with progressive difficulty from simple ROP to more advanced heap exploitation.