Skip to content

Commit 777271b

Browse files
committed
fix getOverFlowOffset.py, from decimal to hex
1 parent de4df1c commit 777271b

1 file changed

Lines changed: 16 additions & 4 deletions

File tree

getOverFlowOffset.py

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,13 @@ def usage():
2020
print "[*] Example: python getOverFlowOffset.py 0x080484BD example_bin/xdctf15-pwn200"
2121

2222

23+
def print_log(response):
24+
for each in response:
25+
try:
26+
print "[%s]\t%s\t%s" % (each['type'], each['message'], each['payload'])
27+
except:
28+
pass
29+
2330
try:
2431
ret_address = sys.argv[1]
2532
target_program = sys.argv[2]
@@ -41,16 +48,16 @@ def usage():
4148
# print(gdbmi.get_subprocess_cmd()) # print actual command run as subprocess
4249

4350
response = gdbmi.write('-file-exec-file %s' % (target_program))
44-
# print(response)
51+
# print_log(response)
4552

4653
response = gdbmi.write('break *%s' % (ret_address))
47-
# print(response)
54+
# print_log(response)
4855

4956
response = gdbmi.write('run < %s' % (pattern_file_name))
50-
# print(response)
57+
# print_log(response)
5158

5259
response = gdbmi.write('print $ebp')
53-
# print(response)
60+
# print_log(response)
5461

5562
over_write_str = ""
5663
for eachResp in response:
@@ -60,9 +67,14 @@ def usage():
6067
except:
6168
pass
6269

70+
# transform the offset into hex.
71+
if over_write_str.find('0x') == -1:
72+
over_write_str = hex(int(over_write_str))
73+
6374
# finally, to find the offset to the EBP.
6475
op = commands.getstatusoutput("python patternLocOffset.py -l %d -s %s" % (pattern_len, over_write_str))
6576
op_str = op[1]
77+
# print_log(op)
6678

6779
op = commands.getstatusoutput("rm %s" % (pattern_file_name))
6880

0 commit comments

Comments
 (0)