| 13 | |
| 14 | # Find offset to EIP/RIP for buffer overflows |
| 15 | def find_ip(payload): |
| 16 | # Launch process and send payload |
| 17 | p = process(exe) |
| 18 | p.recvline() |
| 19 | p.sendline(payload) |
| 20 | # Wait for the process to crash |
| 21 | p.wait() |
| 22 | # Print out the address of EIP/RIP at the time of crashing |
| 23 | # ip_offset = cyclic_find(p.corefile.pc) # x86 |
| 24 | ip_offset = cyclic_find(p.corefile.read(p.corefile.sp, 4)) # x64 |
| 25 | info('located EIP/RIP offset at {a}'.format(a=ip_offset)) |
| 26 | return ip_offset |
| 27 | |
| 28 | |
| 29 | # Specify GDB script here (breakpoints etc) |