Last active
February 18, 2025 08:50
-
-
Save morkev/284f7e426ead76413b0ad0787f5de86e to your computer and use it in GitHub Desktop.
Compute the most common byte
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| from pwn import * | |
| import warnings | |
| warnings.filterwarnings('ignore') | |
| context.arch = 'amd64' | |
| context.log_level = 'critical' | |
| # Start the challenge process | |
| r = process('/challenge/run') | |
| # Send the assembled code to the challenge | |
| r.send(asm(''' | |
| .intel_syntax noprefix | |
| push rbp | |
| mov rbp, rsp | |
| sub rsp, 520 | |
| mov r8, rdi | |
| mov r9, rsi | |
| lea rdi, [rbp - 512] | |
| mov rcx, 256 | |
| xor eax, eax | |
| rep stosw | |
| xor rcx, rcx | |
| process_loop: | |
| cmp rcx, r9 | |
| jae find_max | |
| movzx eax, byte ptr [r8 + rcx] | |
| movzx edx, al | |
| lea rdi, [rbp - 512] | |
| inc word ptr [rdi + rdx * 2] | |
| inc rcx | |
| jmp process_loop | |
| find_max: | |
| xor rcx, rcx | |
| xor rax, rax | |
| xor rdx, rdx | |
| find_max_loop: | |
| cmp rcx, 256 | |
| je end_find_max | |
| lea rdi, [rbp - 512] | |
| movzx r10, word ptr [rdi + rcx * 2] | |
| cmp r10w, ax | |
| jbe skip_update | |
| mov ax, r10w | |
| mov dx, cx | |
| skip_update: | |
| inc rcx | |
| jmp find_max_loop | |
| end_find_max: | |
| movzx eax, dx | |
| mov rsp, rbp | |
| pop rbp | |
| ret | |
| ''')) | |
| # Receive and print the result from the challenge | |
| print(r.recvline_contains('pwn.college').decode()) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment