(state_raw: angr.SimState, challenge: Challenge, new_mem: list, binary: InteractiveBinary)
| 123 | |
| 124 | |
| 125 | def jmp2shellcode(state_raw: angr.SimState, challenge: Challenge, new_mem: list, binary: InteractiveBinary): |
| 126 | payload = get_shellcode(challenge.target_property) |
| 127 | constraints = [state_raw.memory.load(new_mem[0], size=len(payload) + challenge.target_property['arch_bytes']) == |
| 128 | challenge.le(binary.io_seg_addr['text'] + binary.io_seg_addr['jmp_esp']) + payload] |
| 129 | for constraint in constraints: |
| 130 | state_raw.add_constraints(constraint) |
| 131 | binary.get_flag(state_raw, dump_payload(state_raw, True)) |
| 132 | |
| 133 | |
| 134 | def ret2win(state_raw: angr.SimState, challenge: Challenge, new_mem: list, binary: InteractiveBinary, align_=False): |
nothing calls this directly
no test coverage detected