Skip to content

Instantly share code, notes, and snippets.

@taiyoslime
Created October 3, 2021 07:12
Show Gist options
  • Save taiyoslime/8fb5586440452b2c18f42e966e7e3124 to your computer and use it in GitHub Desktop.
Save taiyoslime/8fb5586440452b2c18f42e966e7e3124 to your computer and use it in GitHub Desktop.
import sys
def call_is_correct(ch, index):
gdb.execute(f"r '{'*' * 32}'")
gdb.execute(f"set $rdi={ch}")
gdb.execute(f"set $rsi={index}")
gdb.execute("j *check+90") # just skip `fork` and so on
gdb.execute("fin")
res = gdb.execute("p $rax", to_string=True)
return int(res.split(" ")[2], 16)
def solve():
gdb.execute("b check")
gdb.execute("b is_correct")
flag = ""
for i in range(32):
for ch in range(33, 127):
if call_is_correct(ch, i):
flag += chr(ch)
print(flag, file=sys.stderr)
if __name__ == "__main__":
solve()
gdb -q -x solve.py beginners_rev > /dev/null
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment