all in one
arm ret2csu
参考博客
arm汇编学习
arm汇编学习
调试
#类似用gdbserver启动运行这个二进制文件
binary_path = "/home/zp9080/PWN/pwn"
qemu_bin = 'qemu-aarch64' # Ensure this is installed
p = process([qemu_bin,'-L','/usr/aarch64-linux-gnu/','-g', '1234', binary_path])
# p = process([qemu_bin, '-L','/usr/aarch64-linux-gnu/', binary_path])
#另一端连接上去
p = process(['gdb-multiarch', './pwn', '-q'])
script='''
set architecture aarch64
target remote localhost:1234
b *$rebase(0xD0C)
'''
def dbg():
gdb.attach(p,script)
pause()
dbg()