bruce30262

You might want to read this to get an introduction to armel vs armhf.

If the below is too much, you can try Ubuntu-ARMv7-Qemu but note it contains non-free blobs.

Running ARM programs under linux (without starting QEMU VM!)

First, cross-compile user programs with GCC-ARM toolchain. Then install qemu-arm-static so that you can run ARM executables directly on linux

If there's no qemu-arm-static in the package list, install qemu-user-static instead

bruce30262

#define unlink(AV, P, BK, FD) {                                            
        FD = P->fd;                                                                      
        BK = P->bk;                                                                      
        if (__builtin_expect (FD->bk != P || BK->fd != P, 0))                      
            malloc_printerr (check_action, "corrupted double-linked list", P, AV);  
        else {                                                                     
            FD->bk = BK;                                                              
            BK->fd = FD;                                                              
            if (!in_smallbin_range (P->size)                                      
                && __builtin_expect (P->fd_nextsize != NULL, 0)) {                      

bruce30262

#!/usr/bin/env python

# reference: http://fadec0d3.blogspot.tw/2016/05/defcon-ctf-quals-2016-legit00003.html

TEMPLATE = """
<?xml version="1.0" standalone="no" ?>
<!DOCTYPE pov SYSTEM "/usr/share/cgc-replay/replay.dtd">
<pov>
<cbid>service</cbid>
<replay>{}</replay>

bruce30262

== disasm: #<ISeq:<compiled>@<compiled>>================================
== catch table
| catch type: break  st: 0096 ed: 0102 sp: 0000 cont: 0102
| catch type: break  st: 0239 ed: 0245 sp: 0000 cont: 0245
|------------------------------------------------------------------------
local table (size: 3, argc: 0 [opts: 0, rest: -1, post: 0, block: -1, kw: -1@-1, kwrest: -1])
[ 3] k          [ 2] xs         
0000 trace            1                                               (   1)
0002 putself          
0003 putstring        "digest"

bruce30262

#!/bin/bash
set -e

# Given a shared library, print the symbols it uses from other libraries it
# directly depends on.

LIB=$1
# Use readelf rather than ldd here to only get direct dependencies.
DEPS=$(readelf -d $LIB | awk '/Shared library:/{ print substr($5, 2, length($5) - 2) }')

bruce30262

#!/usr/bin/env python2.7
# -*- coding: utf-8 -*-

import signal
import sys
from random import randint
import os, pipes
from shutil import rmtree
from shutil import copyfile
import subprocess

bruce30262

#!/usr/bin/env python

# By Sean @ HITCON

import re
import socket
import sys
import string
import random

bruce30262

#include <stdio.h>
#include <stdlib.h>
#include <windows.h>
int main()
{
    char v1[1000]; // ebx@3
    signed int result; // eax@7
    DWORD BytesReturned; // [sp+Ch] [bp-1Ch]@2
    char OutBuffer[1000]; // [sp+10h] [bp-18h]@2
    LONG lDistanceToMove = 512; // [sp+24h] [bp-4h]@3

bruce30262

#!/usr/bin/env python

# HeapHeaven
# solved by bruce30262

from pwn import *
import subprocess
import sys
import time

bruce30262

#include <stdio.h>
#include <stdlib.h>
#include <assert.h>
#include <signal.h>
#include <errno.h>
#include <fcntl.h>
#include <stddef.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/stat.h>