From 5660ef31669a5917d67b227d37e36e7887a839b0 Mon Sep 17 00:00:00 2001
From: Brett Weiland <brett_weiland@bpcspace.com>
Date: Sun, 20 Dec 2020 17:29:46 -0600
Subject: 	modified:   x86_64/ret2csu/exploit.py 	modified:  
 x86_64/ret2csu/gadgets

---
 x86_64/ret2csu/gadgets | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

(limited to 'x86_64/ret2csu/gadgets')

diff --git a/x86_64/ret2csu/gadgets b/x86_64/ret2csu/gadgets
index 87a3bb8..f3adc78 100644
--- a/x86_64/ret2csu/gadgets
+++ b/x86_64/ret2csu/gadgets
@@ -71,16 +71,18 @@ Disassembly of section .fini:
 calling x86: 
 
 controlling rdx: 
-1: 0x00000000004006a3
-  rdi : 0xdeadbeefdeadbeef 
 
 2: 0x40069a
   rbx: 0                          <--
-  rbp: whatever
-  r12: 0x601020                   <-- next location. lets try to make it ret2win
-  r13: 0xdeadbeef                 <-- would be nice if we could use a 64 bit value
+  rbp: 1
+  r12: 0xffffffff                 <-- next location. lets try to make it 
+  r13: whatever I guess           <-- would be nice if we could use a 64 bit value
   r14: 0xcafebabecafebabe                 
   r15: 0xd00df00dd00df00d         <--
 
+we can set r12 to [function@plt], and rbx to desired offset.
 
-3: 0x0000000000400510 (ret2win) 
+0x00000000004004e0 : call rax
+
+target address: 0x00000000004006a3 
+0000000000400510 ret2csu
-- 
cgit v1.2.3