integeruser

#!/usr/bin/env python3
import ctypes

LC_SYMTAB = 0x2


class mach_header_64(ctypes.Structure):
    _fields_ = (
        ("magic", ctypes.c_uint32),
        ("cputype", ctypes.c_uint32),

integeruser

#!/usr/bin/env python3
import ctypes

if __name__ == "__main__":
    # $ ./export.py ./playground 0x0000000000000778 f3
    playground = ctypes.CDLL("./playground-f1")
    res = playground.f1(1, 2)
    print(res)

    print()

integeruser

#!/usr/bin/env python3
import collections
import random
import re
import shutil

import gdb

colors = {
    'red': '\u001b[31m',

integeruser

#!/usr/bin/env python2
# -*- coding: utf-8 -*-
#
# Retrieve back names of header file constants
#
# $ ./flags.py PROT 5
# PROT_EXEC           0x4
# PROT_NONE           0x0
# PROT_READ           0x1
# PROT_WRITE          0x2

integeruser

#!/usr/bin/env python3
import argparse
import os
import re
import subprocess
import tempfile

BAD_BYTES = {0x00, 0x0a, 0x0d}

integeruser

#!/usr/bin/env python2
from ctypes import c_int, c_uint

# http://www.mscs.dal.ca/~selinger/random/


def srand(seed):
    srand.r = [0 for _ in range(34)]
    srand.r[0] = c_int(seed).value
    for i in range(1, 31):

integeruser

#include <algorithm>
#include <cassert>
#include <cstddef>
#include <cstdint>
#include <cstdlib>
#include <chrono>
#include <fstream>
#include <iomanip>
#include <iostream>
#include <string>

integeruser

#!/usr/bin/python2
def exploit():
    payload = '\xde\xad\xbe\xef'
    return payload

# Usage: in gdb, execute `set exec-wrapper ./wrapper.py`

# Set arguments and environment variables for the program
# arg0 (real path of the executable to run) is set automatically
args = ['arg1', exploit(), 'arg3']

integeruser

GDB Cheat Sh*t

gdb [options] [PROGRAM [COREFILE or PID]] gdb [options] --args PROGRAM [INFARGS...] to pass any arguments after the executable file to the inferior

Options

• --silent [or -q/--quiet] to start without printing the front material
• --core COREFILE [or -c] to analyze a core dump
• --pid PID [or -p] to debug a running process (as with the attach command)
• --command EXECFILE [or -x] to execute commands from file (as with the source command)

integeruser

#define _GNU_SOURCE
#include <dlfcn.h>
#include <stdio.h>
#include <stdlib.h>

/* gcc -shared -fPIC exit-on-EOF.c -o exit-on-EOF.so -ldl */
/* LD_PRELOAD=./exit-on-EOF.so ./test */
/* AFL_PRELOAD=./exit-on-EOF.so afl-fuzz -i in -o out -n -- ./test */

typedef int (*orig_read_f_type)(int fd, void *buf, int count);