hgarrereyn

# Author: hgarrereyn
# Desc: Lifter solution for GoogleCTF 2022 eldar

import lief
from collections import namedtuple
from dataclasses import dataclass
from typing import Any
from capstone import *
from z3 import *
import numpy as np

hgarrereyn

import bpy
import bmesh
from scipy.spatial import KDTree
import numpy as np


def get_mesh(obj):
    if bpy.context.mode != 'EDIT_MESH':
        bpy.ops.object.editmode_toggle()
        

hgarrereyn

import struct

# get symbols with https://github.com/pzl/ciqdb
sym = open('./run/info.txt', 'r').read()
sym = sym.strip().split('\n')
sym = sym[508:-8]
sym = [x.strip().split(': ') for x in sym]
sym = {int(v):s for v,s in sym}

def get_str(off):

hgarrereyn

057A :: 35 01           :: ARGC 1
057C :: 01 00           :: INCSP 0
057E :: 12 00           :: LGETV 0
0580 :: 27 00 80 01 A4  :: SPUSH 0x8001a4 (MenuInputDelegate)
0585 :: 0D              :: GETV
0586 :: 27 00 80 00 5E  :: SPUSH 0x80005e (initialize)
058B :: 0D              :: GETV
058C :: 2A              :: FRPUSH
058D :: 0F 01           :: INVOKE 1

hgarrereyn

var idx;
var flag;

function onLayout(dc) {
    var v2;

    WatchFace.onUpdate(dc);

    myTimer.stop();

hgarrereyn

0000 :: &r0 = 0x217000 
0010 :: mmap r0, 0x1, 0x7, 0x22, 0x0, 0x0
0018 :: read 0x0, 0x217000, 0x20
0020 :: WRITE 0x217050 - 0x217070, b' p!\x00\x00\x00\x00\x00\x04\x00\x00\x04\x00\x00\x00\x00Dp!\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
0120 :: WRITE 0x217020 - 0x21704c, b'H\xb9,4:y\xf5\x95\x84?\x8bV\x04f\x89\x11H\x8d\r\xeb\xff\xff\xffH\xff\x01H\xff\x01\xc3\xcc\xcc\xcc\xcc\xcc\xcc1\xc0\xb0\x0f\x0f\x05\xcc\xcc'
0280 :: &r0 = 0x217050 
0290 :: rt_sigaction 0x1f, r0, 0x0, 0x8
0298 :: prctl 0x26, 0x1, 0x0, 0x0
02A0 :: WRITE 0x217050 - 0x217054, b'G\x00\x00\x00'

hgarrereyn

# Memory Maze - DragonCTF 2020
# by hgarrereyn

from pwn import *
import time

PAGE_SIZE = 0x1000
BASE = 0x13370000

hgarrereyn

hgarrereyn

    _start:
[2000] :: 01 01 00 00 :: ld r1, 0
[2004] :: 01 02 28 00 :: ld r2, 40
[2008] :: 0C 01 02 00 :: write(buf=r1, n=r2)    # hello!
[200C] :: 01 01 28 00 :: ld r1, 40
[2010] :: 01 02 03 00 :: ld r2, 3
[2014] :: 0C 01 02 00 :: write(buf=r1, n=r2)    # >>
[2018] :: 0E 00 D2 04 :: setkey 4D204D2
[201C] :: 01 04 00 08 :: ld r4, 2048
[2020] :: 01 05 2F 00 :: ld r5, 47              # flag len

hgarrereyn

0x0AdE495C332354C3Aca8283FD750bEEeA1A78148