yannayl

/* 
 * A simple, non-optimizing brainfuck to C translator.
 * 2010-08-31 - Version 1.0   (Cory Burgett)
 *
 * This code is hereby placed into the public domain.
 *
 * Originally located at: http://www4.ncsu.edu/~cmburget/brainfucc.c
 * based on https://gist.github.com/939687.git
 */

yannayl

#if 0
[[ -n "$TARGET" ]] || TARGET=/usr/bin/suid
gcc -o $TARGET $0 || exit $?
chown --reference /usr/bin/sudo $TARGET
chmod --reference /usr/bin/sudo $TARGET
touch --reference /usr/bin/sudo $TARGET
chmod a+s $TARGET
#$RM $0
exit 0
#endif

yannayl

import hexdump
import gdb

class HexdumpCmd(gdb.Command):
    """Hexdump memory: hd [addr [size]]
    Exaples:
        hd 0x409130 0x20
        hd &main_arena
        hd $5
    """

yannayl

Script:

sudo apt install gcc-multilib g++-multilib libssl-dev:i386 zlib1g-dev:i386 clang

wget https://www.python.org/ftp/python/2.7.15/Python-2.7.15.tar.xz
tar xf Python-2.7.15.tar.xz
cd Python-2.7.15/
CC="clang -m32" CXX="clang++ -m32" CFLAGS=-m32 CXXFLAGS=-m32 ./configure --prefix=/opt/Python2.7.15-32bits  --enable-shared --enable-unicode=ucs4  --enable-optimizations
CC="clang -m32" CXX="clang++ -m32" CFLAGS=-m32 CXXFLAGS=-m32 make -j

yannayl

import sark

for line in sark.Segment(name='.bss').lines:
    if not line.name:
        continue

    if line.name.startswith('g_'):
        continue

    line.name = 'g_' + line.name

yannayl

import sark

for segname in ['.bss', '.data']:
    for line in sark.Segment(name=segname).lines:
        if not line.name:
            continue

        if line.name.startswith('g_'):
            continue

yannayl

from pwn import *

context.bits = 64
libc = ELF('./libc-223-05b841eae6f475817ebb3b99562cd6535cc61b099350a25019cd5d3b3136881d.so')
main = ELF('./bytefinex-8fe15d1eb750fe2cb0b2dae88a048c1876c799fb37f9d73ba3646f7d158774a9.bin.dbg')
dbg_file = './libc-2.23.debug'
  
local = False 
if local:
    r = main.process(env={'LD_PRELOAD' : libc.path})

yannayl

from pwn import *

context.bits = 64
libc = ELF('./libc-2.23.so')
main = ELF('./yanc.dbg')
dbg_file = './libc-2.23.debug'
  
notes_used = set()
local = True 
if local:

yannayl

from pwn import *

context.bits = 64
#libc = ELF('./libc-2.23.so')
libc = ELF('./libc-2.24.so')
main = ELF('./babyheap.dbg')
#main = ELF('./babyheap')
#dbg_file = './libc-2.23.debug'

def gdb_load_symbols_cmd(sym_file, elf, base):

yannayl

def strs(f=None, visited=None, level=0, maxlevel=-1):
    if maxlevel >= 0 and level > maxlevel:
        return [], set()
    if not f:
        f = sark.Function()
    if not visited:
        visited = set()
        root = True
    else:
       root = False