Skip to content

Instantly share code, notes, and snippets.

@morkev
Last active February 18, 2025 08:50
Show Gist options
  • Select an option

  • Save morkev/284f7e426ead76413b0ad0787f5de86e to your computer and use it in GitHub Desktop.

Select an option

Save morkev/284f7e426ead76413b0ad0787f5de86e to your computer and use it in GitHub Desktop.
Compute the most common byte
from pwn import *
import warnings
warnings.filterwarnings('ignore')
context.arch = 'amd64'
context.log_level = 'critical'
# Start the challenge process
r = process('/challenge/run')
# Send the assembled code to the challenge
r.send(asm('''
.intel_syntax noprefix
push rbp
mov rbp, rsp
sub rsp, 520
mov r8, rdi
mov r9, rsi
lea rdi, [rbp - 512]
mov rcx, 256
xor eax, eax
rep stosw
xor rcx, rcx
process_loop:
cmp rcx, r9
jae find_max
movzx eax, byte ptr [r8 + rcx]
movzx edx, al
lea rdi, [rbp - 512]
inc word ptr [rdi + rdx * 2]
inc rcx
jmp process_loop
find_max:
xor rcx, rcx
xor rax, rax
xor rdx, rdx
find_max_loop:
cmp rcx, 256
je end_find_max
lea rdi, [rbp - 512]
movzx r10, word ptr [rdi + rcx * 2]
cmp r10w, ax
jbe skip_update
mov ax, r10w
mov dx, cx
skip_update:
inc rcx
jmp find_max_loop
end_find_max:
movzx eax, dx
mov rsp, rbp
pop rbp
ret
'''))
# Receive and print the result from the challenge
print(r.recvline_contains('pwn.college').decode())
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment