-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathsol.py
32 lines (26 loc) · 866 Bytes
/
sol.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
import gdb
import string
import shlex
gdb.execute("file ./x8")
gdb.execute("b*0x0000555555567080") # <<x8::instruction::CmpReg8Reg8 as x8::instruction::Instruction>::execute>
flag = 'TFCCTF{'
while flag[-1] != '}':
for c in string.printable.strip():
gdb.execute(f"r --file program.bin <<< {shlex.quote(flag + c)}")
for i in range(len(flag)):
gdb.execute("continue")
try:
rsi = int(gdb.parse_and_eval('$rsi'))
a = gdb.execute(f"x/b $rsi+1025+3", to_string=True).split()[-1]
b = gdb.execute(f"x/b $rsi+1025+5", to_string=True).split()[-1]
if a == b:
flag += c
print('[*]', flag)
break
else:
print("!", flag+c)
except KeyboardInterrupt:
exit()
else:
break
print(flag)