summaryrefslogtreecommitdiff
path: root/x86_64/ret2csu/gadgets
blob: 87a3bb8d7060da818dd2dabf6ae33e5a7d3a2fd3 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
First three arguments: 
rdi   0xdeadbeefdeadbeef
rsi   0xcafebabecafebabe
rdx   0xd00df00dd00df00d


weird-ass instructions:
0x0000000000000a08 : retf 0xbabe


ret2win@plt: 0000000000400510

0x00000000004006a3 : pop rdi ; ret 
0x00000000004006a1 : pop rsi ; pop r15 ; ret 




ret2csu:     file format elf64-x86-64


Disassembly of section .init:

Disassembly of section .plt:

Disassembly of section .text:

0000000000400640 <__libc_csu_init>:
  400640: 41 57                 push   r15
  400642: 41 56                 push   r14
  400644: 49 89 d7              mov    r15,rdx
  400647: 41 55                 push   r13
  400649: 41 54                 push   r12
  40064b: 4c 8d 25 9e 07 20 00  lea    r12,[rip+0x20079e]        # 600df0 <__frame_dummy_init_array_entry>
  400652: 55                    push   rbp
  400653: 48 8d 2d 9e 07 20 00  lea    rbp,[rip+0x20079e]        # 600df8 <__do_global_dtors_aux_fini_array_entry>
  40065a: 53                    push   rbx
  40065b: 41 89 fd              mov    r13d,edi
  40065e: 49 89 f6              mov    r14,rsi
  400661: 4c 29 e5              sub    rbp,r12
  400664: 48 83 ec 08           sub    rsp,0x8
  400668: 48 c1 fd 03           sar    rbp,0x3
  40066c: e8 5f fe ff ff        call   4004d0 <_init>
  400671: 48 85 ed              test   rbp,rbp
  400674: 74 20                 je     400696 <__libc_csu_init+0x56>
  400676: 31 db                 xor    ebx,ebx
  400678: 0f 1f 84 00 00 00 00  nop    DWORD PTR [rax+rax*1+0x0]
  40067f: 00 
 _______this shit is importaint!!!!!!
\/
  400680: 4c 89 fa              mov    rdx,r15
  400683: 4c 89 f6              mov    rsi,r14
  400686: 44 89 ef              mov    edi,r13d
  400689: 41 ff 14 dc           call   QWORD PTR [r12+rbx*8]
_________________________
  40068d: 48 83 c3 01           add    rbx,0x1
  400691: 48 39 dd              cmp    rbp,rbx
  400694: 75 ea                 jne    400680 <__libc_csu_init+0x40> 
  400696: 48 83 c4 08           add    rsp,0x8                       
_________________________
  40069a: 5b                    pop    rbx
  40069b: 5d                    pop    rbp
  40069c: 41 5c                 pop    r12
  40069e: 41 5d                 pop    r13
  4006a0: 41 5e                 pop    r14
  4006a2: 41 5f                 pop    r15
  4006a4: c3                    ret    

Disassembly of section .fini:

calling x86: 

controlling rdx: 
1: 0x00000000004006a3
  rdi : 0xdeadbeefdeadbeef 

2: 0x40069a
  rbx: 0                          <--
  rbp: whatever
  r12: 0x601020                   <-- next location. lets try to make it ret2win
  r13: 0xdeadbeef                 <-- would be nice if we could use a 64 bit value
  r14: 0xcafebabecafebabe                 
  r15: 0xd00df00dd00df00d         <--


3: 0x0000000000400510 (ret2win)