Skip to content

Instantly share code, notes, and snippets.

@sundhaug92
Created September 14, 2016 19:37
Show Gist options
  • Save sundhaug92/50d2ba232960269ee421e9dd17a8f366 to your computer and use it in GitHub Desktop.
Save sundhaug92/50d2ba232960269ee421e9dd17a8f366 to your computer and use it in GitHub Desktop.
GDB remote socket fuzzer
import random,gdb
g=gdb.gdb()
def f(i):
if i==0:
for c in range(32,127):
yield chr(c)
else:
yield from f(i-1)
for c in range(32,127):
for _ in f(i-1):
yield chr(c)+_
for _ in f(8):
if not any([_.startswith(__) for __ in ['p','P','s','z','Z','q','m','M','e']]):
continue
print(_)
g.send(_)
g.recv_msg()
import random,gdb
g=gdb.gdb()
msgs=[]
msgs+=['p','P','s','z','Z','q','m','M','e']
msgs+=['P0:','M0:']
for msg in msgs:
for i in range(1,100):
g.send(msg+'A'*i*50)
print('{}*{}'.format(msg,50*i))
g.recv_msg()
import socket,select
class gdb(object):
"""description of class"""
def __init__(self, **kwargs):
self.connection=socket.socket()
self.connection.connect(('127.0.0.1',55555))
self.connection.send('+'.encode('ascii'))
def has_data(self):
return self.connection in select.select([self.connection],[],[],0)[0]
def send(self, string):
in_data=''.join(string.split(' ')).encode('ascii')
prefix='$'.encode('ascii')
postfix='#'.encode('ascii')
hstr=hex(sum(in_data))
if len(hstr)<4:
hstr='0x0'+hstr[:1]
checksum=hstr[-2:].encode('ascii')
packet=prefix+in_data+postfix+checksum
while len(packet)>0:
packet=packet[self.connection.send(packet):]
def recv_msg(self,full_msg=True):
state=0
buffer=''
while True:
c = self.connection.recv(1).decode('ascii')
#print('state={},c={},buffer={}'.format(state,c,buffer))
if state == 0:
state = 1
if c == '+':
if full_msg:
continue
elif c == '-':
return '[ERR] Last msg resend pls'
if state == 1:
if c == '$':
state = 2
else:
return '[ERR] UNKNOWN c={} in state 1'.format(c)
elif state == 2:
if c == '#':
state = 3
else:
buffer += c
elif state == 3:
vba_csum=self.connection.recv(1).decode('ascii')
my_csum=hex(sum(buffer.encode('ascii')))[-2:]
self.connection.send('+'.encode('ascii'))
return buffer
else:
raise Exception()
def step(self, address=None):
if address == None:
self.send('s')
else:
self.send('s '+hex(address))[2:]
def dump_registers(self):
self.send('g')
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment