Closed heapcrash closed 4 years ago
It looks like pushstr
itself is also broken
It looks like each 16-byte block is correct, but they are pushed in the wrong order. e.g.:
00:0000│ sp 0x40007ffaa0 ◂— 0x6161616661616165 ('eaaafaaa')
01:0008│ 0x40007ffaa8 ◂— 0x6161616861616167 ('gaaahaaa')
02:0010│ 0x40007ffab0 ◂— 0x6161616261616161 ('aaaabaaa')
03:0018│ 0x40007ffab8 ◂— 0x6161616461616163 ('caaadaaa')
There's also a missing colon after the
if
statement, and it seems this was never never finished since there's no%endif
.https://github.com/Gallopsled/pwntools/blob/813749493288fd7330b7b44b81a7f2f7a8a02dac/pwnlib/shellcraft/templates/aarch64/pushstr_array.asm#L76-L79