sudhackar

import os

os.system("adb exec-out screencap -p > screen.png")

from PIL import Image
img = Image.open("screen.png")
xi = 32
yi = 240
delta = 6
for j in xrange(12):

sudhackar

sudhackar

def genf(a,b,i):
    stub = '''void f%d(){ // %c - %c
        if (((int)(flag[%d])*(int)(flag[%d]) + %d * (int)(flag[%d]) + %d ) || ((int)(flag[%d])*(int)(flag[%d]) + %d * (int)(flag[%d]) + %d )){
                fin = 1;
        }
        else{
        fin = 0;
        }
    }'''

sudhackar

from pwn import *

e = ELF("./leak")
l = ELF("/lib/x86_64-linux-gnu/libc.so.6")

pppr = 0x000000000040068a

s = remote('127.0.0.1', 5000)
s.recvuntil(": ")

sudhackar

from z3 import *

size = 10

for i in xrange(size):
    globals()['x%i' % i]=BitVec('x%i' %i,32)

one = BitVec("one", 32)
zero = BitVec("zero", 32)

sudhackar

breakpoints = []

def add_bp(symbol, nargs, thiscall):
    global breakpoints
    module_name = symbol.split("!")[0] 
    function_name = symbol.split("!")[1]
    module = pykd.module(module_name)
    module.reload()
    breakpoints.append((pykd.setBp(module.offset(function_name), breakCount),function_name, nargs, thiscall))
    print "Breakpoint %d added %s" % (len(breakpoints), symbol)

sudhackar

Java.perform(function () {
    var act1 = Java.use("CryptoUtilities");
    act1.getKey.implementation = function (arg1) {
        var ret = this.getKey("v2");
        return ret;
    };
    var db1 = Java.use("android.database.sqlite.SQLiteDatabase");
    db1.rawQuery.overload('java.lang.String', '[Ljava.lang.String;').implementation = function (arg1, arg2){
        console.log(arg1,arg1.replace("v1","v2"));
        var ret = this.rawQuery(arg1.replace("v1","v2"),arg2);

sudhackar

from pwn import *

h ={"U":[[] for i in xrange(10)], "D":[[] for i in xrange(10)], "L":[[] for i in xrange(10)], "R":[[] for i in xrange(10)]}

U = open("U","rb")
D = open("D","rb")
L = open("L","rb")
R = open("R","rb")

for i in xrange(10):

sudhackar

from pwn import *

class Node(object):
    def __init__(self, addr):
        self.addr = addr

e = ELF("./rabbithole")

name_addr = {}
for i in e.symbols:

sudhackar

import BaseHTTPServer
import os


# for i in `find / -type f`; do
class Multiplier(BaseHTTPServer.BaseHTTPRequestHandler):
    def do_GET(s):
        query = s.path.split('files')[1]
        s.send_response(200)
        s.send_header("Content-type", "text/plain")