mirror of
https://github.com/radareorg/radare.git
synced 2026-11-07 18:37:48 -10:00
pancake
6692ec7595
--HG-- rename : scripts/anal.lua => api/lua/anal.lua rename : scripts/fuzzer-loop.lua => api/lua/fuzzer-loop.lua rename : scripts/fuzzer-target.c => api/lua/fuzzer-target.c rename : scripts/opcleaner.lua => api/lua/opcleaner.lua rename : scripts/lua/posix/Makefile => api/lua/posix/Makefile rename : scripts/lua/posix/modemuncher.c => api/lua/posix/modemuncher.c rename : scripts/lua/posix/posix.c => api/lua/posix/posix.c rename : scripts/pushpop.lua => api/lua/pushpop.lua rename : scripts/search-demo.lua => api/lua/search-demo.lua rename : scripts/vozme.lua => api/lua/vozme.lua rename : scripts/rscript.pl => api/perl/rscript.pl rename : scripts/radapy_bochs.py => api/python/bochs.py rename : scripts/radapy_client.py => api/python/client.py rename : scripts/example.py => api/python/example.py rename : scripts/standalone.py => api/python/standalone.py
68 lines
1.4 KiB
Lua
Executable File
68 lines
1.4 KiB
Lua
Executable File
--
|
|
-- 2008 th0rpe <nopcode.org>
|
|
--
|
|
-- P0C loop entry
|
|
--
|
|
--
|
|
|
|
entry_addr = "0x00401050"
|
|
jump_addr = "0x004010b7"
|
|
|
|
do
|
|
local ret;
|
|
local buf_addr;
|
|
local lebuf_addr;
|
|
local param_addr;
|
|
local addr;
|
|
|
|
-- set breakpoint at entry address
|
|
cmd("!bp "..entry_addr);
|
|
-- continue execution
|
|
cmd("!cont");
|
|
-- remove breakpoint at entry address
|
|
cmd("!bp -"..entry_addr);
|
|
|
|
--alloc memory
|
|
buf_addr = string.format("0x%x", cmd("!alloc 4096"));
|
|
|
|
--get stack frame address
|
|
param_addr = string.format("0x%x", cmd("!get esp") + 12);
|
|
|
|
-- translate to little endian
|
|
lebuf_addr = "0x"..string.sub(buf_addr, 9, 10)..
|
|
string.sub(buf_addr, 7, 8)..
|
|
string.sub(buf_addr, 5, 6)..
|
|
string.sub(buf_addr, 3, 4);
|
|
|
|
--seek at 3 arg
|
|
cmd("s "..param_addr);
|
|
|
|
--write buffer address(allocated)
|
|
cmd("w "..lebuf_addr);
|
|
|
|
-- init randomize seed
|
|
math.randomseed(os.time());
|
|
|
|
--seek at buffer
|
|
cmd("s "..buf_addr);
|
|
|
|
--write random sequence
|
|
cmd("w "..string.format("0x%x%x",math.random(1,255), math.random(1,255)));
|
|
--begin loop
|
|
ret = cmd("!loop 0x"..jump_addr);
|
|
while(ret == 0) do
|
|
cmd("w "..string.format("0x%x%x",math.random(1,255), math.random(1,255)));
|
|
|
|
-- call again
|
|
ret = cmd("!loop 0x"..jump_addr);
|
|
end
|
|
|
|
if ret == 3 then
|
|
print "fatal exception (possible bug)";
|
|
else if ret == 2 then
|
|
print "exit program";
|
|
end
|
|
end
|
|
|
|
end
|