Skip to content

Instantly share code, notes, and snippets.

@kos0ng
Created February 22, 2021 03:19
Show Gist options
  • Save kos0ng/f52d69afe83a38a9a82ae4ba2d37aa7a to your computer and use it in GitHub Desktop.
Save kos0ng/f52d69afe83a38a9a82ae4ba2d37aa7a to your computer and use it in GitHub Desktop.
darkCON CTF 2021 - Too Much ( Helper ) [ RE ]
#!/usr/bin/python3
static_val=[]
class SolverEquation(gdb.Command):
def __init__ (self):
super (SolverEquation, self).__init__ ("solve-equation",gdb.COMMAND_OBSCURE)
def invoke (self, arg, from_tty):
address_arr =['0x0000000000001189','0x00000000000011b4','0x00000000000011df','0x000000000000120a','0x0000000000001237','0x0000000000001262','0x000000000000128f','0x00000000000012bc','0x00000000000012e9','0x0000000000001314','0x000000000000133f','0x000000000000136a','0x0000000000001397','0x00000000000013c4','0x00000000000013ef','0x000000000000141a','0x0000000000001447','0x0000000000001472','0x000000000000149d','0x00000000000014c8','0x00000000000014f5','0x0000000000001522','0x000000000000154f','0x000000000000157c','0x00000000000015a7','0x00000000000015d4','0x00000000000015ff','0x000000000000162c','0x0000000000001659','0x0000000000001684','0x00000000000016b1','0x00000000000016de','0x000000000000170b','0x0000000000001736','0x0000000000001763','0x000000000000178e','0x00000000000017b9','0x00000000000017e6','0x0000000000001813','0x000000000000183e','0x0000000000001869','0x0000000000001896','0x00000000000018c1','0x00000000000018ec','0x0000000000001919','0x0000000000001946','0x0000000000001971','0x000000000000199c','0x00000000000019c9','0x00000000000019f6','0x0000000000001a21','0x0000000000001a4e','0x0000000000001a79','0x0000000000001aa4','0x0000000000001ad1','0x0000000000001afe','0x0000000000001b29','0x0000000000001b56','0x0000000000001b81','0x0000000000001bac','0x0000000000001bd9','0x0000000000001c06','0x0000000000001c33','0x0000000000001c60','0x0000000000001c8d','0x0000000000001cba','0x0000000000001ce7','0x0000000000001d14','0x0000000000001d41','0x0000000000001d6e','0x0000000000001d9b','0x0000000000001dc8','0x0000000000001df3','0x0000000000001e20','0x0000000000001e4b','0x0000000000001e78','0x0000000000001ea5','0x0000000000001ed2','0x0000000000001eff','0x0000000000001f2a','0x0000000000001f55','0x0000000000001f82','0x0000000000001fad','0x0000000000001fd8','0x0000000000002003','0x000000000000202e','0x0000000000002059','0x0000000000002084','0x00000000000020b1','0x00000000000020dc','0x0000000000002107','0x0000000000002132','0x000000000000215f','0x000000000000218a','0x00000000000021b5','0x00000000000021e2','0x000000000000220d','0x000000000000223a','0x0000000000002265','0x0000000000002290','0x00000000000022bb','0x00000000000022e6','0x0000000000002313','0x000000000000233e','0x0000000000002369','0x0000000000002394','0x00000000000023bf','0x00000000000023ec','0x0000000000002417','0x0000000000002442','0x000000000000246d','0x000000000000249a','0x00000000000024c5','0x00000000000024f2','0x000000000000251f','0x000000000000254a','0x0000000000002577','0x00000000000025a2','0x00000000000025cf','0x00000000000025fa','0x0000000000002627','0x0000000000002654','0x000000000000267f','0x00000000000026ac','0x00000000000026d7','0x0000000000002702','0x000000000000272f','0x000000000000275c','0x0000000000002787','0x00000000000027b4','0x00000000000027df','0x000000000000280a','0x0000000000002837','0x0000000000002864','0x000000000000288f','0x00000000000028bc','0x00000000000028e7','0x0000000000002914','0x0000000000002941','0x000000000000296c','0x0000000000002997','0x00000000000029c2','0x00000000000029ef','0x0000000000002a1c','0x0000000000002a47','0x0000000000002a72','0x0000000000002a9d','0x0000000000002aca','0x0000000000002af7','0x0000000000002b22','0x0000000000002b4d','0x0000000000002b7a','0x0000000000002ba7','0x0000000000002bd2','0x0000000000002bfd','0x0000000000002c28','0x0000000000002c53','0x0000000000002c7e','0x0000000000002ca9','0x0000000000002cd6','0x0000000000002d01','0x0000000000002d2c','0x0000000000002d59','0x0000000000002d84','0x0000000000002daf','0x0000000000002dda','0x0000000000002e05','0x0000000000002e30','0x0000000000002e5d','0x0000000000002e88','0x0000000000002eb3','0x0000000000002ede','0x0000000000002f0b','0x0000000000002f36','0x0000000000002f61','0x0000000000002f8e','0x0000000000002fb9','0x0000000000002fe4','0x0000000000003011','0x000000000000303e','0x000000000000306b','0x0000000000003098','0x00000000000030c3','0x00000000000030f0','0x000000000000311b','0x0000000000003148','0x0000000000003173','0x000000000000319e','0x00000000000031c9','0x00000000000031f6','0x0000000000003223','0x000000000000324e','0x000000000000327b','0x00000000000032a6','0x00000000000032d3','0x0000000000003300','0x000000000000332b','0x0000000000003358','0x0000000000003383','0x00000000000033ae']
global static_val
for i in address_arr:
tmp=gdb.execute('x/i '+hex(int(i,16)+35), to_string=True).strip().split(",")[1]
static_val.append(int(tmp,16))
print(static_val)
def addr2num(addr):
try:
return int(addr)&0xff # Python 3
except:
return long(addr) # Python 2
SolverEquation()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment