def fmtstring(towrite,
buf_offset,
writesize=1,
pre_written=0,
use_posix_extension=True):
out = ''
if not (1 <= writesize <= 4):
pwn.die('fmtstring: writesize has to be between 1-4')
if not isinstance(towrite, dict):
pwn.die('fmtstring: towrite has to be {address,data}')
for address in towrite.keys():
data = towrite[address]
out += pwn.flat(address + n * writesize for n in range(len(data)))
if '%' in out:
pwn.die('I do not know how to handle addresses with "%" in them')
if '\x00' in out:
pwn.die(
'I do not know how to handle addresses with null characters in them'
)
bytes_written = len(out) + pre_written
for data in towrite.values():
bufsize = len(data)
data = [pwn.uint(dat) for dat in pwn.group(writesize, data)]
for n, dat in enumerate(data):
bufpos = writesize * n
bufleft = bufsize - bufpos
mod_value = 0x100**min(bufleft, writesize)
cur_num_bytes = (dat - bytes_written) % mod_value
cur_num_bytes = (cur_num_bytes + mod_value) % mod_value
bytes_written += cur_num_bytes
if cur_num_bytes == 0:
pass
if cur_num_bytes == 1:
out += '%c'
elif cur_num_bytes > 1:
out += '%' + str(cur_num_bytes) + 'c'
out += '%' + str(buf_offset + n) + '$'
if use_posix_extension:
if bufleft == 1:
out += 'hh'
elif bufleft == 2:
out += 'h'
out += 'n'
return out
def fmtstring(towrite, buf_offset, writesize = 1, pre_written = 0, use_posix_extension = True):
out = ''
if not (1 <= writesize <= 4):
pwn.die('fmtstring: writesize has to be between 1-4')
if not isinstance(towrite,dict):
pwn.die('fmtstring: towrite has to be {address,data}')
for address in towrite.keys():
data = towrite[address]
out += pwn.flat(address + n * writesize for n in range(len(data)))
if '%' in out:
pwn.die('I do not know how to handle addresses with "%" in them')
if '\x00' in out:
pwn.die('I do not know how to handle addresses with null characters in them')
bytes_written = len(out) + pre_written
for data in towrite.values():
bufsize = len(data)
data = [pwn.uint(dat) for dat in pwn.group(writesize, data)]
for n, dat in enumerate(data):
bufpos = writesize*n
bufleft = bufsize - bufpos
mod_value = 0x100 ** min(bufleft, writesize)
cur_num_bytes = (dat - bytes_written) % mod_value
cur_num_bytes = (cur_num_bytes + mod_value) % mod_value
bytes_written += cur_num_bytes
if cur_num_bytes == 0:
pass
if cur_num_bytes == 1:
out += '%c'
elif cur_num_bytes > 1:
out += '%' + str(cur_num_bytes) + 'c'
out += '%' + str(buf_offset+n) + '$'
if use_posix_extension:
if bufleft == 1:
out += 'hh'
elif bufleft == 2:
out += 'h'
out += 'n'
return out
def ordlist(s, size = 1):
"""Turns a string into a list of the corresponding ascii values."""
return [pwn.uint(c) for c in group(size, s)]
def ordlist(s, size=1):
"""Turns a string into a list of the corresponding ascii values."""
return [pwn.uint(c) for c in group(size, s)]