PewZ

#include <stdio.h>
#include <assert.h>
#include <stdlib.h>
#include <capstone/capstone.h>
#include <unistd.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <string.h>

#ifdef INFO

PewZ

from pwn import *

local = True
free = 0x000000601f78

#r = remote("localhost", 4444)
r = remote("54.202.7.144", 8888)

secret_func = 0x400b47
main = 0x40113e

PewZ

time_t time (time_t *result)
int stime (const time_t *newtime)
int fcntl (int filedes, int command, ...)
size_t mbstowcs (wchar_t *wstring, const char *string, size_t size)
size_t wcstombs (char *string, const wchar_t *wstring, size_t size)
int sched_setscheduler (pid_t pid, int policy, const struct sched_param *param)
int sched_getscheduler (pid_t pid)
int sched_setparam (pid_t pid, const struct sched_param *param)
int sched_getparam (pid_t pid, struct sched_param *param)
int sched_get_priority_min (int policy)

PewZ

#!/bin/bash
~/git/qemu/build/arm-softmmu/qemu-system-arm -M versatilepb \
	-kernel vmlinuz-3.2.0-4-versatile \
	-initrd initrd.img-3.2.0-4-versatile \
	-hda debian_wheezy_armel_standard.qcow2 \
	-append "root=/dev/sda1" \
	-m 256 \
	-net nic \
	-net user,hostfwd=tcp::5555-:22

PewZ

from pwn import *

# CANARY    : ENABLED
# FORTIFY   : disabled
# NX        : ENABLED
# PIE       : disabled
# RELRO     : Partial
# 0x603188 <templeWisdom>:        0x8 ; number of wisdoms
# 0x6031a0 <temple>:      0x0     0x625040 ; temple
# your scribes start at idx 8

PewZ

Keybase proof

I hereby claim:

• I am PewZ on github.
• I am pewz (https://keybase.io/pewz) on keybase.
• I have a public key whose fingerprint is 9751 7397 E473 B8E5 A6CE DF36 C070 860F DAC0 4A88

To claim this, I am signing this object: