try to find a gadget that looks like: 0x40116a # mov qword ptr [rdi], rax ; ret
#!/usr/bin/env python3
from pwn import *
context.binary = elf = ELF('./buffer_overflow_partial_relro', checksec=True)
libc = elf.libc
libc.address = 0x7ffff7c00000
p = elf.process()
rop = ROP(elf)
# 0x40116a # mov qword ptr [rdi], rax ; ret
write_what_where_gadget = pop_rax = rop.find_gadget(['mov rdi, rax'])
print(write_what_where_gadget)
pop_rax = rop.find_gadget(['pop rax'])[0]
pop_rdi = rop.find_gadget(['pop rdi'])[0]
pop_rsi = rop.find_gadget(['pop rsi'])[0]
pop_rdx = rop.find_gadget(['pop rdx'])[0]
syscall = rop.find_gadget(['syscall'])[0]
p.sendline()
p.interactive()
i have tryed:
rop.find_gadget([‘mov rdi, rax’])
rop.find_gadget([‘mov qword ptr [rdi], rax ; ret’])