Created
October 3, 2021 07:12
-
-
Save taiyoslime/8fb5586440452b2c18f42e966e7e3124 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import sys | |
def call_is_correct(ch, index): | |
gdb.execute(f"r '{'*' * 32}'") | |
gdb.execute(f"set $rdi={ch}") | |
gdb.execute(f"set $rsi={index}") | |
gdb.execute("j *check+90") # just skip `fork` and so on | |
gdb.execute("fin") | |
res = gdb.execute("p $rax", to_string=True) | |
return int(res.split(" ")[2], 16) | |
def solve(): | |
gdb.execute("b check") | |
gdb.execute("b is_correct") | |
flag = "" | |
for i in range(32): | |
for ch in range(33, 127): | |
if call_is_correct(ch, i): | |
flag += chr(ch) | |
print(flag, file=sys.stderr) | |
if __name__ == "__main__": | |
solve() |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
gdb -q -x solve.py beginners_rev > /dev/null |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment