circleous

Keybase proof

I hereby claim:

• I am circleous on github.
• I am circleous (https://keybase.io/circleous) on keybase.
• I have a public key ASAdoj9TLDRFcsJnQECJA0Cjwffh6YlO5nx5SWW982FlFwo

To claim this, I am signing this object:

circleous

gruvbox dark

circleous

#include <stdio.h>
#include <jni.h>
#include <android/log.h>
#include <dlfcn.h>
#include <sys/types.h>
#include <stdlib.h>
//#include "TKHooklib.h"

#define LOG_TAG "HOOK"
#define LOGI(...)  __android_log_print(ANDROID_LOG_INFO,LOG_TAG,__VA_ARGS__)

circleous

#!/bin/sh
pomf() {
token=""
uppomf="https://safe.moe/api/upload"

if test $# -lt 1 ; then
    echo "Usage: `basename $0` FILE [FILE...]"
    exit 1
fi

circleous

# https://github.com/ray-cp/pwn_debug/blob/master/build.sh

#!/bin/sh

# echo "install some deps"
# sudo apt-get install gawk -y
# sudo apt-get install bison -y
# sudo apt-get install gcc-multilib -y
# sudo apt-get install g++-multilib -y

circleous

#!/bin/bash

if [ $# -ne 1 ]; then
  echo -e "$0 - get last gists from a user"
  echo -e "Usage:"
  echo -e "\t$0 <username>\n"
  echo -e "Example:"
  echo -e "\t$0 circleous"
else
  url=`curl -s https://api.github.com/users/$1/gists | grep url | head -n 1 | awk '{print $2}' | sed 's/"\(.*\)",/\1/'`

circleous

source ~/git/pwndbg/gdbinit.py
#source ~/git/peda/peda.py

set context-code-lines 7
set dereference-limit 3
set context-source-code-lines 5
set context-stack-lines 5
set context-sections regs disasm code stack expressions
add-auto-load-safe-path /home/kyra/ctf/

circleous

#!/bin/sh
# Copyright © 2015 Serpent7776. All Rights Reserved.

# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:

#	1. Redistributions of source code must retain the above copyright
#	   notice, this list of conditions and the following disclaimer.
#	2. Redistributions in binary form must reproduce the above copyright
#	   notice, this list of conditions and the following disclaimer in the

circleous

get_system_call:
	mov ecx, 0xc0000082
	rdmsr ; eax = low, edx = high
	sal rdx, 32
	cdqe
	or rax, rdx ; rax = guess

.loop_init:
	mov rcx, rax
	add rcx, 500

circleous

# pwndbg scripting

gdb.execute('b* 0x555555554982') # call rdx
gdb.execute('r < input')
gdb.execute('s') # step into call

flag = []
while True:
    instr = pwndbg.disasm.one() # get current instruction
    # instr is a part of capstone object, https://www.capstone-engine.org/lang_python.html