arm pwn基础知识

all in one arm ret2csu 参考博客

arm汇编学习

arm汇编学习

调试

#类似用gdbserver启动运行这个二进制文件
binary_path = "/home/zp9080/PWN/pwn"
qemu_bin = 'qemu-aarch64'  # Ensure this is installed
p = process([qemu_bin,'-L','/usr/aarch64-linux-gnu/','-g', '1234', binary_path]) 
# p = process([qemu_bin, '-L','/usr/aarch64-linux-gnu/', binary_path])

#另一端连接上去
p = process(['gdb-multiarch', './pwn', '-q'])
script='''

set architecture aarch64
target remote localhost:1234
b *$rebase(0xD0C)
'''

def dbg():
    gdb.attach(p,script)
    pause()

dbg()