Stanislas Lejay P1kachu

## P1kachu.txt

                      $$$$$
                      $NNN$$$:
                      $$$N  $$$7   7$$$$$$$
                        $$>>>>$$$$$$$  NNN$
                        :$$$::::::::>>>NOO$
                           $:       >$$$$
                          C>         $777
                          $:Q:    $  $$$$$$$
                          $:H:   :H  $?????$?

## commiter.sh
curl http://whatthecommit.com/ 2> /dev/null | sed '40q;d'| cut -c 4-

## shell_me_maybe.c
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(void)
{
  const char shelly[] = ""; // Your shellcode

  printf("Length: %lu\n", strlen(shelly));

## print_errno.h
#include <errno.h>
#include <string.h>
#define NONE         "\033[0m"
#define RED         "\033[31m"


# define print_errno()                                                                      \
        {                                                                                   \
                if (errno)                                                                  \
                {                                                                           \

## angr-add.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                P1kachu
                / angr-add.md
            
            
              Last active
              June 6, 2016 15:13
            
              
                Things to add/fix in angr's documentation and code
              
          
    angr-doc

Useful


Basic blocks are broken on calls, unlike IDA
Pruned path are quite useless

Missing


Lots of pathgroup init parameters
Analysis techniques and heuristics used in CFGFast (there is a TODO already)

Unclear


## mmap.py
#!/usr/bin/env python3

import sys
from v0lt import *

MMAP_SIZE = 0x1000
PERM_RWX  = 0x7

def check_stack():
    '''

## memosploit.ipynb

      
              2 files
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                P1kachu
                / memosploit.ipynb
            
            
              Last active
              March 6, 2017 11:02
            
              
                First shot at exploiting memo (BKP2017 - pwn 300) (ipynb with gdb and py without)
              
          
      Sorry, something went wrong. Reload?
      Sorry, we cannot display this file.
      Sorry, this file is invalid so it cannot be displayed.
      
          Viewer requires iframe.
      
    
## installation.sh
#!/bin/sh
set -x
set -e

# Notes:
# This is how I was able to get a working kivy + ffpyplayer on my Rpi 3 (I can launch a mp4 video, at least)
#
# This script was not ran on a fresh distribution, so details might change.
# It was mainly copied from https://github.com/matham/ffpyplayer/blob/master/.travis.yml#L20
# Other steps required: Increasing the GPU memory (see https://github.com/kivy/kivy/issues/4662)

## hex_to_shellcode.sh
#!/bin/bash

# Translate hexdump output to ready_to_send shellcode

# C'EST PAS OPTI
# MAIS JE M'EN FOUS

to_shellcode()
{
    hexdump -x $1

## calling_printf_osx.c
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <mach-o/dyld.h>
#include <mach-o/nlist.h>
#include <mach-o/dyld_images.h>
#include <mach/mach_vm.h>

/* Dyld is the OSX Dynamic Linker
 * /usr/include//mach-o/loader.h

	$$$$$
	$NNN$$$:
	$$$N $$$7 7$$$$$$$
	$$>>>>$$$$$$$ NNN$
	:$$$::::::::>>>NOO$
	$: >$$$$
	C> $777
	$:Q: $ $$$$$$$
	$:H: :H $?????$?
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>

	int main(void)
	{
	const char shelly[] = ""; // Your shellcode

	printf("Length: %lu\n", strlen(shelly));
	#include <errno.h>
	#include <string.h>
	#define NONE "\033[0m"
	#define RED "\033[31m"


	# define print_errno() \
	{ \
	if (errno) \
	{ \
	#!/usr/bin/env python3

	import sys
	from v0lt import *

	MMAP_SIZE = 0x1000
	PERM_RWX = 0x7

	def check_stack():
	'''
	#!/bin/sh
	set -x
	set -e

	# Notes:
	# This is how I was able to get a working kivy + ffpyplayer on my Rpi 3 (I can launch a mp4 video, at least)
	#
	# This script was not ran on a fresh distribution, so details might change.
	# It was mainly copied from https://github.com/matham/ffpyplayer/blob/master/.travis.yml#L20
	# Other steps required: Increasing the GPU memory (see https://github.com/kivy/kivy/issues/4662)
	#!/bin/bash

	# Translate hexdump output to ready_to_send shellcode

	# C'EST PAS OPTI
	# MAIS JE M'EN FOUS

	to_shellcode()
	{
	hexdump -x $1
	#include <string.h>
	#include <stdlib.h>
	#include <unistd.h>
	#include <mach-o/dyld.h>
	#include <mach-o/nlist.h>
	#include <mach-o/dyld_images.h>
	#include <mach/mach_vm.h>

	/* Dyld is the OSX Dynamic Linker
	* /usr/include//mach-o/loader.h