1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143
| [0x00000970]> pdf @sym.vul ┌ 640: sym.vul (); │ ; var size_t nbyte @ rbp-0x4ec │ ; var file*stream @ rbp-0x4e8 │ ; var char *filename @ rbp-0x4e0 │ ; var char *s @ rbp-0x4c0 │ ; var char *buf @ rbp-0x260 │ ; var int64_t canary @ rbp-0x8 │ ; CALL XREF from main @ 0xd29 │ 0x00000aa0 55 push rbp ; .//rop1.c:6 │ 0x00000aa1 4889e5 mov rbp, rsp ; /types.h:125 │ 0x00000aa4 4881ecf00400. sub rsp, 0x4f0 ; /types.h:459 │ 0x00000aab 64488b042528. mov rax, qword fs:[0x28] ; .//rop1.c:6 │ 0x00000ab4 488945f8 mov qword [canary], rax ; /types.h:2483 │ 0x00000ab8 31c0 xor eax, eax │ 0x00000aba 488b05cf1520. mov rax, qword [obj.stdin] ; .//rop1.c:7 ; obj.stdin__GLIBC_2.2.5 │ ; [0x202090:8]=0 │ 0x00000ac1 b900000000 mov ecx, 0 ; /types.h:4325 ; size_t size │ 0x00000ac6 ba02000000 mov edx, 2 ; /types.h:4932 ; int mode │ 0x00000acb be00000000 mov esi, 0 ; /types.h:6088 ; char *buf │ 0x00000ad0 4889c7 mov rdi, rax ; FILE*stream │ 0x00000ad3 e858feffff call sym.imp.setvbuf ; int setvbuf(FILE*stream, char *buf, int mode, size_t size) │ 0x00000ad8 488b05a11520. mov rax, qword [obj.stdout] ; .//rop1.c:8 ; rdi │ ; [0x202080:8]=0 │ 0x00000adf b900000000 mov ecx, 0 ; size_t size │ 0x00000ae4 ba02000000 mov edx, 2 ; int mode │ 0x00000ae9 be00000000 mov esi, 0 ; char *buf │ 0x00000aee 4889c7 mov rdi, rax ; FILE*stream │ 0x00000af1 e83afeffff call sym.imp.setvbuf ; int setvbuf(FILE*stream, char *buf, int mode, size_t size) │ 0x00000af6 488d8540fbff. lea rax, [s] ; .//rop1.c:14 │ 0x00000afd ba58020000 mov edx, 0x258 ; size_t n │ 0x00000b02 be00000000 mov esi, 0 ; int c │ 0x00000b07 4889c7 mov rdi, rax ; void *s │ 0x00000b0a e8f1fdffff call sym.imp.memset ; void *memset(void *s, int c, size_t n) │ 0x00000b0f 488d8520fbff. lea rax, [filename] ; .//rop1.c:15 │ 0x00000b16 ba14000000 mov edx, 0x14 ; size_t n │ 0x00000b1b be00000000 mov esi, 0 ; int c │ 0x00000b20 4889c7 mov rdi, rax ; void *s │ 0x00000b23 e8d8fdffff call sym.imp.memset ; void *memset(void *s, int c, size_t n) │ 0x00000b28 488d85a0fdff. lea rax, [buf] ; .//rop1.c:16 │ 0x00000b2f ba58020000 mov edx, 0x258 ; size_t n │ 0x00000b34 be00000000 mov esi, 0 ; int c │ 0x00000b39 4889c7 mov rdi, rax ; void *s │ 0x00000b3c e8bffdffff call sym.imp.memset ; void *memset(void *s, int c, size_t n) │ 0x00000b41 488d3de00200. lea rdi, str.welcome_to_noteRead_system ; .//rop1.c:18 ; 0xe28 ; "welcome to noteRead system" ; const char *s │ 0x00000b48 e863fdffff call sym.imp.puts ; int puts(const char *s) │ 0x00000b4d 488d3df40200. lea rdi, str.there_is_there_notebook:_flag__flag1__flag2 ; .//rop1.c:19 ; 0xe48 ; "there is there notebook: flag, flag1, flag2" ; const char *s │ 0x00000b54 e857fdffff call sym.imp.puts ; int puts(const char *s) │ 0x00000b59 488d3d140300. lea rdi, str.Please_input_the_note_path: ; .//rop1.c:20 ; 0xe74 ; " Please input the note path:" ; const char *s │ 0x00000b60 e84bfdffff call sym.imp.puts ; int puts(const char *s) │ 0x00000b65 488d8520fbff. lea rax, [filename] ; .//rop1.c:21 │ 0x00000b6c ba14000000 mov edx, 0x14 ; size_t nbyte │ 0x00000b71 4889c6 mov rsi, rax ; void *buf │ 0x00000b74 bf00000000 mov edi, 0 ; int fildes │ 0x00000b79 b800000000 mov eax, 0 │ 0x00000b7e e88dfdffff call sym.imp.read ; ssize_t read(int fildes, void *buf, size_t nbyte) │ 0x00000b83 488d8520fbff. lea rax, [filename] ; .//rop1.c:23 │ 0x00000b8a 4889c7 mov rdi, rax ; const char *s │ 0x00000b8d e84efdffff call sym.imp.strlen ; size_t strlen(const char *s) │ 0x00000b92 4883e801 sub rax, 1 │ 0x00000b96 0fb6840520fb. movzx eax, byte [rbp + rax - 0x4e0] │ 0x00000b9e 3c0a cmp al, 0xa │ ┌─< 0x00000ba0 751b jne 0xbbd │ │ 0x00000ba2 488d8520fbff. lea rax, [filename] ; .//rop1.c:24 │ │ 0x00000ba9 4889c7 mov rdi, rax ; const char *s │ │ 0x00000bac e82ffdffff call sym.imp.strlen ; size_t strlen(const char *s) │ │ 0x00000bb1 4883e801 sub rax, 1 │ │ 0x00000bb5 c6840520fbff. mov byte [rbp + rax - 0x4e0], 0 │ │ ; CODE XREF from sym.vul @ 0xba0 │ └─> 0x00000bbd 488d8520fbff. lea rax, [filename] ; .//rop1.c:26 │ 0x00000bc4 4889c7 mov rdi, rax ; const char *s │ 0x00000bc7 e814fdffff call sym.imp.strlen ; size_t strlen(const char *s) │ 0x00000bcc 4883f805 cmp rax, 5 │ ┌─< 0x00000bd0 775b ja 0xc2d │ │ 0x00000bd2 488d8520fbff. lea rax, [filename] ; .//rop1.c:27 │ │ 0x00000bd9 488d35b20200. lea rsi, [0x00000e92] ; "r" ; const char *mode │ │ 0x00000be0 4889c7 mov rdi, rax ; const char *filename │ │ 0x00000be3 e858fdffff call sym.imp.fopen ; file*fopen(const char *filename, const char *mode) │ │ 0x00000be8 48898518fbff. mov qword [stream], rax │ │ 0x00000bef 488d8d40fbff. lea rcx, [s] ; .//rop1.c:28 │ │ 0x00000bf6 488b8518fbff. mov rax, qword [stream] │ │ 0x00000bfd ba44020000 mov edx, 0x244 ; "nux-x86-64.so.2" │ │ 0x00000c02 4889ce mov rsi, rcx │ │ 0x00000c05 4889c7 mov rdi, rax │ │ 0x00000c08 e828010000 call sym.noteRead ; /types.h:6382 │ │ 0x00000c0d 488d8540fbff. lea rax, [s] ; .//rop1.c:29 │ │ 0x00000c14 4889c7 mov rdi, rax ; const char *s │ │ 0x00000c17 e894fcffff call sym.imp.puts ; int puts(const char *s) │ │ 0x00000c1c 488b8518fbff. mov rax, qword [stream] ; .//rop1.c:30 │ │ 0x00000c23 4889c7 mov rdi, rax ; FILE *stream │ │ 0x00000c26 e8a5fcffff call sym.imp.fclose ; int fclose(FILE *stream) │ ┌──< 0x00000c2b eb0c jmp 0xc39 │ ││ ; CODE XREF from sym.vul @ 0xbd0 │ │└─> 0x00000c2d 488d3d600200. lea rdi, str.note_path_false ; .//rop1.c:33 ; 0xe94 ; "note path false!" ; const char *s │ │ 0x00000c34 e877fcffff call sym.imp.puts ; int puts(const char *s) │ │ ; CODE XREF from sym.vul @ 0xc2b │ └──> 0x00000c39 488d3d650200. lea rdi, str.write_some_note: ; .//rop1.c:36 ; 0xea5 ; "write some note:" ; const char *s │ 0x00000c40 e86bfcffff call sym.imp.puts ; int puts(const char *s) │ 0x00000c45 488d3d6a0200. lea rdi, str.please_input_the_note_len: ; .//rop1.c:37 ; 0xeb6 ; " please input the note len:" ; const char *s │ 0x00000c4c e85ffcffff call sym.imp.puts ; int puts(const char *s) │ 0x00000c51 c78514fbffff. mov dword [nbyte], 0 ; .//rop1.c:38 │ 0x00000c5b 488d8514fbff. lea rax, [nbyte] ; .//rop1.c:39 │ 0x00000c62 4889c6 mov rsi, rax │ 0x00000c65 488d3d670200. lea rdi, [0x00000ed3] ; "%d" ; const char *format │ 0x00000c6c b800000000 mov eax, 0 │ 0x00000c71 e8dafcffff call sym.imp.__isoc99_scanf ; int scanf(const char *format) │ 0x00000c76 488d3d590200. lea rdi, str.please_input_the_note: ; .//rop1.c:40 ; 0xed6 ; "please input the note:" ; const char *s │ 0x00000c7d e82efcffff call sym.imp.puts ; int puts(const char *s) │ 0x00000c82 8b9514fbffff mov edx, dword [nbyte] ; .//rop1.c:41 ; size_t nbyte │ 0x00000c88 488d85a0fdff. lea rax, [buf] │ 0x00000c8f 4889c6 mov rsi, rax ; void *buf │ 0x00000c92 bf00000000 mov edi, 0 ; int fildes │ 0x00000c97 b800000000 mov eax, 0 │ 0x00000c9c e86ffcffff call sym.imp.read ; ssize_t read(int fildes, void *buf, size_t nbyte) │ 0x00000ca1 488d3d450200. lea rdi, str.the_note_is: ; .//rop1.c:43 ; 0xeed ; "the note is: " ; const char *s │ 0x00000ca8 e803fcffff call sym.imp.puts ; int puts(const char *s) │ 0x00000cad 488d85a0fdff. lea rax, [buf] ; .//rop1.c:44 │ 0x00000cb4 4889c7 mov rdi, rax ; const char *s │ 0x00000cb7 e8f4fbffff call sym.imp.puts ; int puts(const char *s) │ 0x00000cbc 488d85a0fdff. lea rax, [buf] ; .//rop1.c:45 │ 0x00000cc3 4889c7 mov rdi, rax ; const char *s │ 0x00000cc6 e815fcffff call sym.imp.strlen ; size_t strlen(const char *s) │ 0x00000ccb 483d70020000 cmp rax, 0x270 ; " " │ ┌─< 0x00000cd1 7436 je 0xd09 │ │ 0x00000cd3 488d3d260200. lea rdi, str.error:_the_note_len_must_be__624 ; .//rop1.c:46 ; 0xf00 ; "error: the note len must be 624" ; const char *s │ │ 0x00000cda e8d1fbffff call sym.imp.puts ; int puts(const char *s) │ │ 0x00000cdf 488d3d420200. lea rdi, str.so_please_input_note_len_is_624 ; .//rop1.c:47 ; 0xf28 ; " so please input note(len is 624)" ; const char *s │ │ 0x00000ce6 e8c5fbffff call sym.imp.puts ; int puts(const char *s) │ │ 0x00000ceb 488d85a0fdff. lea rax, [buf] ; .//rop1.c:48 │ │ 0x00000cf2 ba70020000 mov edx, 0x270 ; " " ; size_t nbyte │ │ 0x00000cf7 4889c6 mov rsi, rax ; void *buf │ │ 0x00000cfa bf00000000 mov edi, 0 ; int fildes │ │ 0x00000cff b800000000 mov eax, 0 │ │ 0x00000d04 e807fcffff call sym.imp.read ; ssize_t read(int fildes, void *buf, size_t nbyte) │ │ ; CODE XREF from sym.vul @ 0xcd1 │ └─> 0x00000d09 90 nop ; .//rop1.c:50 │ 0x00000d0a 488b45f8 mov rax, qword [canary] │ 0x00000d0e 644833042528. xor rax, qword fs:[0x28] │ ┌─< 0x00000d17 7405 je 0xd1e │ │ 0x00000d19 e8d2fbffff call sym.imp.__stack_chk_fail ; void __stack_chk_fail(void) │ │ ; CODE XREF from sym.vul @ 0xd17 │ └─> 0x00000d1e c9 leave └ 0x00000d1f c3 ret
|