Jinmo Jinmo
bruce30262
/ exp_heaven.py
Last active
October 20, 2017 05:44
Solutions for HeapHeaven, HeapsOfPrint & HouseOfScepticism from Hack.lu 2017 CTF
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/env python | |
| # HeapHeaven | |
| # solved by bruce30262 | |
| from pwn import * | |
| import subprocess | |
| import sys | |
| import time |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| // | |
| // Quick and dirty exploit for the "roll a d8" challenge of PlaidCTF 2018. | |
| // N-day exploit for https://chromium.googlesource.com/v8/v8/+/b5da57a06de8791693c248b7aafc734861a3785d | |
| // | |
| // Scroll down do "BEGIN EXPLOIT" to skip the utility functions. | |
| // | |
| // Copyright (c) 2018 Samuel Groß | |
| // | |
| // |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| import struct | |
| import numpy as np | |
| d = open('./baby_nn', 'rb').read() | |
| def inv_sigmoid(x): | |
| return np.log(x / (1 - x)) | |
| biases_info = [(0x0A8A0, 0x28), (0x07560, 0x28), (0x04220, 0x28), (0x00EE0, 0x28)] |