Skip to content

Instantly share code, notes, and snippets.

@mmkhitaryan
Last active September 11, 2022 21:26
Show Gist options
  • Save mmkhitaryan/50ba3cc942100e1a1dc9eec6c364c480 to your computer and use it in GitHub Desktop.
Save mmkhitaryan/50ba3cc942100e1a1dc9eec6c364c480 to your computer and use it in GitHub Desktop.
Bug in r2pipe?
# r2 /bin/ls
# . ./run_in_r2.py
# 1
# 2
# ... 1000+
import r2pipe
r = r2pipe.open()
FILE_NAME = "README"
r.cmd('ood')
r.cmd('aaa')
all_imports = r.cmdj('iaj')
for r2_import in all_imports["imports"]:
if r2_import["name"]=="opendir":
opendir_pointer = r2_import["plt"]
last_pointer = ''
r.cmd(f'dcu {opendir_pointer}')
# there is no way to stop loop
done = False
counter = 0
while not done:
poiner_from_stack = str(r.cmdj('pxqj 8 @rsp')[0])
# skip same pointer
if last_pointer == poiner_from_stack:
counter+=1
print(counter)
if last_pointer != poiner_from_stack:
heap_read = r.cmd(f'prx 1024 @ {poiner_from_stack}')
if FILE_NAME in heap_read:
print(heap_read)
done = True
last_pointer = poiner_from_stack
r.cmd('ds')
# python run_without_r2.py
# 1
# 2
# ...
# 326
import r2pipe
r = r2pipe.open('/bin/ls')
FILE_NAME = "README"
r.cmd('ood')
r.cmd('aaa')
all_imports = r.cmdj('iaj')
for r2_import in all_imports["imports"]:
if r2_import["name"]=="opendir":
opendir_pointer = r2_import["plt"]
last_pointer = ''
r.cmd(f'dcu {opendir_pointer}')
# there is no way to stop loop
done = False
counter = 0
while not done:
poiner_from_stack = str(r.cmdj('pxqj 8 @rsp')[0])
# skip same pointer
if last_pointer == poiner_from_stack:
counter+=1
print(counter)
if last_pointer != poiner_from_stack:
heap_read = r.cmd(f'prx 1024 @ {poiner_from_stack}')
if FILE_NAME in heap_read:
print(heap_read)
done = True
last_pointer = poiner_from_stack
r.cmd('ds')
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment