gbdngb12 / pwn_dong

pwnable template
Apache License 2.0
1 stars 0 forks source link

Support struct _IO_FILE #2

Open gbdngb12 opened 9 months ago

gbdngb12 commented 9 months ago
class IO_FILE:
    def __init__(self) -> None:
        self._flags = 0xfbad0000
        self._IO_read_ptr = 0
        self._IO_read_end = 0
        self._IO_read_base = 0
        self._IO_write_base = 0
        self._IO_write_ptr = 0
        self._IO_write_end = 0
        self._IO_buf_base = 0
        self._IO_buf_end = 0
        self._IO_save_base = 0
        self._IO_backup_base = 0
        self._save_end = 0
        self._markers = 0
        self._chain = 0
        self._fileno = 0
        self._flags2 = 0
        self._old_offset = 0xffffffffffffffff
        self._cur_column = 0
        self._vtable_offset = 0
        self._shortbuf = 0
        self._lock = 0         
        self._offset = 0xffffffffffffffff
        self._codecvt = 0 
        self._wide_data = 0
        self._freeres_list = 0
        self._freeres_buf = 0
        self.__pad5 = 0
        self._mode = 0
        self._unused2 = 0
        self.vtable = 0
    def get_bytes(self) -> bytes:
        return  p64(self._flags) + \
                p64(self._IO_read_ptr) + \
                p64(self._IO_read_end) + \
                p64(self._IO_read_base) + \
                p64(self._IO_write_base) + \
                p64(self._IO_write_ptr) + \
                p64(self._IO_write_end) + \
                p64(self._IO_buf_base) + \
                p64(self._IO_buf_end) + \
                p64(self._IO_save_base) + \
                p64(self._IO_backup_base) + \
                p64(self._save_end) + \
                p64(self._markers) + \
                p64(self._chain) + \
                p32(self._fileno) + \
                p32(self._flags2) + \
                p64(self._old_offset) + \
                p16(self._cur_column) + \
                p8(self._vtable_offset) + \
                p8(self._shortbuf) + \
                p32(0) + \
                p64(self._lock) + \
                p64(self._offset) + \
                p64(self._codecvt) + \
                p64(self._wide_data) + \
                p64(self._freeres_list) + \
                p64(self._freeres_buf) + \
                p64(self.__pad5) + \
                p32(0) + \
                p32(self._mode) + \
                p64(self._unused2)*2 + \
                p64(self.vtable)
gbdngb12 commented 9 months ago
    def get_offset(self, member_name):
        offset = 0
        for attr in self.__dict__:
            if attr == member_name:
                return offset
            else:
                val = getattr(self, attr)
                if isinstance(val, int):
                    offset += struct.calcsize("P")  # for 64-bit system
                elif isinstance(val, str):
                    offset += len(val)
                else:
                    offset += struct.calcsize("P")  # default to pointer size
        return "No such member in the class"
gbdngb12 commented 9 months ago

    def get_member(self, offset_target):
        offset = 0
        for attr in self.__dict__:
            val = getattr(self, attr)
            if isinstance(val, int):
                size = struct.calcsize("P")  # for 64-bit system
            elif isinstance(val, str):
                size = len(val)
            else:
                size = struct.calcsize("P")  # default to pointer size
            if offset <= offset_target < offset + size:
                return attr
            offset += size
        return "No member found at the given offset"