Files
ctf/2025/cscg/pwn/intro1/rop_gadgedts
2025-06-06 03:13:31 +02:00

113 lines
28 KiB
Plaintext
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

Gadgets
=======
0x0000000000401098: adc al, byte ptr [rax]; call qword ptr [rip + 0x2f37]; hlt; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
0x000000000040110e: adc dword ptr [rax], edi; test rax, rax; je 0x1120; mov edi, 0x404038; jmp rax; 
0x000000000040109c: adc eax, 0x2f37; hlt; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
0x00000000004010cc: adc edi, dword ptr [rax]; test rax, rax; je 0x10e0; mov edi, 0x404038; jmp rax; 
0x000000000040113c: adc edx, dword ptr [rbp + 0x48]; mov ebp, esp; call 0x10c0; mov byte ptr [rip + 0x2f1b], 1; pop rbp; ret; 
0x00000000004010a0: add ah, dh; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
0x000000000040109a: add bh, bh; adc eax, 0x2f37; hlt; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
0x000000000040100a: add byte ptr [rax - 0x7b], cl; sal byte ptr [rdx + rax - 1], 0xd0; add rsp, 8; ret; 
0x0000000000401217: add byte ptr [rax], al; add byte ptr [rax], al; call 0x1050; nop; leave; ret; 
0x000000000040123d: add byte ptr [rax], al; add byte ptr [rax], al; call 0x11dd; mov eax, 0; leave; ret; 
0x00000000004010a8: add byte ptr [rax], al; add byte ptr [rax], al; nop dword ptr [rax]; ret; 
0x00000000004010ce: add byte ptr [rax], al; add byte ptr [rax], al; test rax, rax; je 0x10e0; mov edi, 0x404038; jmp rax; 
0x0000000000401110: add byte ptr [rax], al; add byte ptr [rax], al; test rax, rax; je 0x1120; mov edi, 0x404038; jmp rax; 
0x0000000000401247: add byte ptr [rax], al; add byte ptr [rax], al; leave; ret; 
0x0000000000401248: add byte ptr [rax], al; add cl, cl; ret; 
0x0000000000401219: add byte ptr [rax], al; call 0x1050; nop; leave; ret; 
0x000000000040123f: add byte ptr [rax], al; call 0x11dd; mov eax, 0; leave; ret; 
0x00000000004011d0: add byte ptr [rax], al; mov rdi, rax; call 0x1040; nop; pop rbp; ret; 
0x00000000004011ba: add byte ptr [rax], al; mov rdi, rax; call 0x1070; nop; pop rbp; ret; 
0x00000000004010aa: add byte ptr [rax], al; nop dword ptr [rax]; ret; 
0x000000000040124e: add byte ptr [rax], al; sub rsp, 8; add rsp, 8; ret; 
0x0000000000401009: add byte ptr [rax], al; test rax, rax; je 0x1012; call rax; 
0x0000000000401009: add byte ptr [rax], al; test rax, rax; je 0x1012; call rax; add rsp, 8; ret; 
0x00000000004010d0: add byte ptr [rax], al; test rax, rax; je 0x10e0; mov edi, 0x404038; jmp rax; 
0x0000000000401112: add byte ptr [rax], al; test rax, rax; je 0x1120; mov edi, 0x404038; jmp rax; 
0x000000000040109f: add byte ptr [rax], al; hlt; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
0x0000000000401249: add byte ptr [rax], al; leave; ret; 
0x000000000040114b: add byte ptr [rcx], al; pop rbp; ret; 
0x000000000040124a: add cl, cl; ret; 
0x0000000000401099: add dil, dil; adc eax, 0x2f37; hlt; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
0x0000000000401006: add eax, 0x2fd5; test rax, rax; je 0x1012; call rax; 
0x0000000000401006: add eax, 0x2fd5; test rax, rax; je 0x1012; call rax; add rsp, 8; ret; 
0x00000000004011cd: add eax, 0xe36; mov rdi, rax; call 0x1040; nop; pop rbp; ret; 
0x0000000000401013: add esp, 8; ret; 
0x0000000000401012: add rsp, 8; ret; 
0x00000000004011d5: call 0x1040; nop; pop rbp; ret; 
0x000000000040121b: call 0x1050; nop; leave; ret; 
0x00000000004011bf: call 0x1070; nop; pop rbp; ret; 
0x0000000000401141: call 0x10c0; mov byte ptr [rip + 0x2f1b], 1; pop rbp; ret; 
0x0000000000401237: call 0x1166; mov eax, 0; call 0x11dd; mov eax, 0; leave; ret; 
0x0000000000401241: call 0x11dd; mov eax, 0; leave; ret; 
0x000000000040109b: call qword ptr [rip + 0x2f37]; hlt; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
0x0000000000401010: call rax; 
0x0000000000401010: call rax; add rsp, 8; ret; 
0x0000000000401002: in al, dx; or byte ptr [rax - 0x75], cl; add eax, 0x2fd5; test rax, rax; je 0x1012; call rax; 
0x000000000040100e: je 0x1012; call rax; 
0x000000000040100e: je 0x1012; call rax; add rsp, 8; ret; 
0x00000000004010cb: je 0x10e0; mov eax, 0; test rax, rax; je 0x10e0; mov edi, 0x404038; jmp rax; 
0x00000000004010d5: je 0x10e0; mov edi, 0x404038; jmp rax; 
0x000000000040110d: je 0x1120; mov eax, 0; test rax, rax; je 0x1120; mov edi, 0x404038; jmp rax; 
0x0000000000401117: je 0x1120; mov edi, 0x404038; jmp rax; 
0x00000000004010dc: jmp rax; 
0x00000000004011cc: lea eax, [rip + 0xe36]; mov rdi, rax; call 0x1040; nop; pop rbp; ret; 
0x00000000004011cb: lea rax, [rip + 0xe36]; mov rdi, rax; call 0x1040; nop; pop rbp; ret; 
0x0000000000401146: mov byte ptr [rip + 0x2f1b], 1; pop rbp; ret; 
0x0000000000401216: mov eax, 0; call 0x1050; nop; leave; ret; 
0x000000000040123c: mov eax, 0; call 0x11dd; mov eax, 0; leave; ret; 
0x00000000004010cd: mov eax, 0; test rax, rax; je 0x10e0; mov edi, 0x404038; jmp rax; 
0x000000000040110f: mov eax, 0; test rax, rax; je 0x1120; mov edi, 0x404038; jmp rax; 
0x0000000000401246: mov eax, 0; leave; ret; 
0x0000000000401005: mov eax, dword ptr [rip + 0x2fd5]; test rax, rax; je 0x1012; call rax; 
0x0000000000401005: mov eax, dword ptr [rip + 0x2fd5]; test rax, rax; je 0x1012; call rax; add rsp, 8; ret; 
0x000000000040113f: mov ebp, esp; call 0x10c0; mov byte ptr [rip + 0x2f1b], 1; pop rbp; ret; 
0x00000000004010d7: mov edi, 0x404038; jmp rax; 
0x00000000004011d3: mov edi, eax; call 0x1040; nop; pop rbp; ret; 
0x00000000004011bd: mov edi, eax; call 0x1070; nop; pop rbp; ret; 
0x0000000000401214: mov edi, eax; mov eax, 0; call 0x1050; nop; leave; ret; 
0x0000000000401004: mov rax, qword ptr [rip + 0x2fd5]; test rax, rax; je 0x1012; call rax; 
0x0000000000401004: mov rax, qword ptr [rip + 0x2fd5]; test rax, rax; je 0x1012; call rax; add rsp, 8; ret; 
0x000000000040113e: mov rbp, rsp; call 0x10c0; mov byte ptr [rip + 0x2f1b], 1; pop rbp; ret; 
0x00000000004011d2: mov rdi, rax; call 0x1040; nop; pop rbp; ret; 
0x00000000004011bc: mov rdi, rax; call 0x1070; nop; pop rbp; ret; 
0x0000000000401213: mov rdi, rax; mov eax, 0; call 0x1050; nop; leave; ret; 
0x00000000004010a4: nop dword ptr [rax + rax]; nop dword ptr [rax]; ret; 
0x00000000004010ac: nop dword ptr [rax]; ret; 
0x00000000004010a3: nop dword ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
0x00000000004010a2: nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
0x0000000000401003: or byte ptr [rax - 0x75], cl; add eax, 0x2fd5; test rax, rax; je 0x1012; call rax; 
0x00000000004010d6: or dword ptr [rdi + 0x404038], edi; jmp rax; 
0x000000000040114d: pop rbp; ret; 
0x0000000000401205: pop rdi; ret; 
0x000000000040113d: push rbp; mov rbp, rsp; call 0x10c0; mov byte ptr [rip + 0x2f1b], 1; pop rbp; ret; 
0x0000000000401042: ret 0x2f; 
0x000000000040100d: sal byte ptr [rdx + rax - 1], 0xd0; add rsp, 8; ret; 
0x0000000000401251: sub esp, 8; add rsp, 8; ret; 
0x0000000000401001: sub esp, 8; mov rax, qword ptr [rip + 0x2fd5]; test rax, rax; je 0x1012; call rax; 
0x0000000000401250: sub rsp, 8; add rsp, 8; ret; 
0x0000000000401000: sub rsp, 8; mov rax, qword ptr [rip + 0x2fd5]; test rax, rax; je 0x1012; call rax; 
0x00000000004010a6: test byte ptr [rax], al; add byte ptr [rax], al; add byte ptr [rax], al; nop dword ptr [rax]; ret; 
0x000000000040100c: test eax, eax; je 0x1012; call rax; 
0x000000000040100c: test eax, eax; je 0x1012; call rax; add rsp, 8; ret; 
0x00000000004010d3: test eax, eax; je 0x10e0; mov edi, 0x404038; jmp rax; 
0x0000000000401115: test eax, eax; je 0x1120; mov edi, 0x404038; jmp rax; 
0x000000000040100b: test rax, rax; je 0x1012; call rax; 
0x000000000040100b: test rax, rax; je 0x1012; call rax; add rsp, 8; ret; 
0x00000000004010d2: test rax, rax; je 0x10e0; mov edi, 0x404038; jmp rax; 
0x0000000000401114: test rax, rax; je 0x1120; mov edi, 0x404038; jmp rax; 
0x00000000004010a1: hlt; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
0x0000000000401221: leave; ret; 
0x00000000004011c4: nop; pop rbp; ret; 
0x0000000000401220: nop; leave; ret; 
0x00000000004010df: nop; ret; 
0x0000000000401016: ret; 
103 gadgets found