Files
ctf/2026/cscg/rev/gloomweaver/dump_hook.c
2026-04-15 01:05:54 +02:00

46 lines
1.3 KiB
C

#include <string.h>
#include <stdio.h>
#include <unistd.h>
#include <stdint.h>
int puts(const char *s) {
FILE *maps = fopen("/proc/self/maps", "r");
char line[512];
uintptr_t base = 0;
while (fgets(line, sizeof(line), maps)) {
if (strstr(line, "gloomweaver") && strstr(line, "rwxp")) {
sscanf(line, "%lx", &base);
break;
}
}
fclose(maps);
if (base) {
uintptr_t text = base - 0x1000; // file base (rwxp is at offset 0x1000)
// Dump the 55x55 matrix at virtual 0x1253 (in rw-p segment at offset 0)
FILE *f;
f = fopen("/tmp/matrix_1253.bin", "wb");
fwrite((void *)(text + 0x1253), 1, 55*55, f); fclose(f);
f = fopen("/tmp/table_2605.bin", "wb");
fwrite((void *)(text + 0x2605), 1, 55, f); fclose(f);
f = fopen("/tmp/table_2697.bin", "wb");
fwrite((void *)(text + 0x2697), 1, 55, f); fclose(f);
// Expected output: 55 words = 110 bytes
f = fopen("/tmp/expected_2119.bin", "wb");
fwrite((void *)(text + 0x2119), 1, 110, f); fclose(f);
// Also dump the full patched code again with broader range
f = fopen("/tmp/full_dump.bin", "wb");
fwrite((void *)text, 1, 0x8000, f); fclose(f);
}
write(1, s, strlen(s));
write(1, "\n", 1);
return 0;
}