bruce30262

# Check out the issue for more detail : https://github.com/NationalSecurityAgency/ghidra/issues/2466  
# The script will calculate the value of gp register base on the code in entry(), then apply the value to all the functions
# This only work in the `RV64I` language though, since other language like `RV64GC` won't set the gp register in entry()

from java.math import BigInteger

def newAddress(offset):
    """
    Helper function to get a Ghidra Address type
    """

bruce30262

Setting up Qemu with a tap interface

There are two parts to networking within QEMU:

• The virtual network device that is provided to the guest (e.g. a PCI network card).
• The network backend that interacts with the emulated NIC (e.g. puts packets onto the host's network).

Example: User mode network

bruce30262

#include <stdio.h>
#include <stdlib.h>
#include <assert.h>
#include <signal.h>
#include <errno.h>
#include <fcntl.h>
#include <stddef.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/stat.h>

bruce30262

#!/usr/bin/env python

# HeapHeaven
# solved by bruce30262

from pwn import *
import subprocess
import sys
import time

bruce30262

#include <stdio.h>
#include <stdlib.h>
#include <windows.h>
int main()
{
    char v1[1000]; // ebx@3
    signed int result; // eax@7
    DWORD BytesReturned; // [sp+Ch] [bp-1Ch]@2
    char OutBuffer[1000]; // [sp+10h] [bp-18h]@2
    LONG lDistanceToMove = 512; // [sp+24h] [bp-4h]@3

bruce30262

#!/usr/bin/env python

# By Sean @ HITCON

import re
import socket
import sys
import string
import random

bruce30262

#!/usr/bin/env python2.7
# -*- coding: utf-8 -*-

import signal
import sys
from random import randint
import os, pipes
from shutil import rmtree
from shutil import copyfile
import subprocess

bruce30262

#!/bin/bash
set -e

# Given a shared library, print the symbols it uses from other libraries it
# directly depends on.

LIB=$1
# Use readelf rather than ldd here to only get direct dependencies.
DEPS=$(readelf -d $LIB | awk '/Shared library:/{ print substr($5, 2, length($5) - 2) }')

bruce30262

== disasm: #<ISeq:<compiled>@<compiled>>================================
== catch table
| catch type: break  st: 0096 ed: 0102 sp: 0000 cont: 0102
| catch type: break  st: 0239 ed: 0245 sp: 0000 cont: 0245
|------------------------------------------------------------------------
local table (size: 3, argc: 0 [opts: 0, rest: -1, post: 0, block: -1, kw: -1@-1, kwrest: -1])
[ 3] k          [ 2] xs         
0000 trace            1                                               (   1)
0002 putself          
0003 putstring        "digest"

bruce30262

#!/usr/bin/env python

# reference: http://fadec0d3.blogspot.tw/2016/05/defcon-ctf-quals-2016-legit00003.html

TEMPLATE = """
<?xml version="1.0" standalone="no" ?>
<!DOCTYPE pov SYSTEM "/usr/share/cgc-replay/replay.dtd">
<pov>
<cbid>service</cbid>
<replay>{}</replay>